last executing test programs: 2m35.933913958s ago: executing program 32 (id=347): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x4000020) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000080)=0x6100204) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x800, 0x0, 0xe7}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) pwritev(r0, &(0x7f0000000940)=[{&(0x7f0000000340)='\x00!', 0x2}], 0x1, 0x739, 0xade) 2m27.594181013s ago: executing program 1 (id=441): bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x2], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) 2m27.436063351s ago: executing program 1 (id=444): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x16c, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, '1234567890123456dcba'}}, @encap={0x1c, 0x4, {0x2, 0x1194, 0x1194}}]}, 0x16c}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000500)={0xa, 0x1234, 0x0, @loopback}, 0x1c) 2m27.383589203s ago: executing program 1 (id=445): syz_emit_ethernet(0x2a, &(0x7f0000000140)={@local, @random="ce3500590a7f", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e23, 0x0, 0x8}}}}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000280)={@broadcast, @random="67eaa8fce250", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x4, 0x0, 0x10, 0x0, @opaque="3196b913fb8ebb82"}}}}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x4) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) socket$netlink(0x10, 0x3, 0x6) 2m27.282146537s ago: executing program 1 (id=446): io_submit(0x0, 0x1, &(0x7f0000001b00)=[&(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x49, 0x4}]) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x40000000, 0x0, 0x0, 0x6, "000000000600000000ff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000000)) 2m27.223176123s ago: executing program 1 (id=447): socket$packet(0x11, 0x3, 0x300) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000000c0)=0x3, 0x4) sendmmsg$inet(r0, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000100)='f', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000002800)="c9", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000780)='xew', 0x3}], 0x1, &(0x7f0000001180)=ANY=[], 0x168}}], 0x4, 0x40488c1) 2m26.262571256s ago: executing program 1 (id=452): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='udp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='-2', 0x2) 2m18.467052862s ago: executing program 5 (id=559): ioperm(0x3, 0x9, 0x80) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_ublk_setup_io_uring(0x3, &(0x7f0000000200)={0x0, 0xa4b7, 0x2, 0x3, 0x4f}, &(0x7f0000000280), &(0x7f0000000340), &(0x7f0000000380)) 2m18.268555392s ago: executing program 5 (id=562): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x6020400) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, &(0x7f00000002c0), &(0x7f0000000300)=r0}, 0x20) 2m18.148196401s ago: executing program 5 (id=564): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[], 0xb) 2m17.84578563s ago: executing program 5 (id=568): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x145091, 0x0) umount2(&(0x7f00000000c0)='./file0/../file0\x00', 0x0) 2m17.72937071s ago: executing program 5 (id=570): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000002240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2m16.997241589s ago: executing program 5 (id=581): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x54}}, 0x24008844) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x1300}, [{0x34, 0x1, [@m_mirred={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'dummy0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c000000240005040200"/20, @ANYRES32=r1, @ANYBLOB="00000100ffffffff000000000c00010063616b655f6d71000c0002"], 0x3c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 2m16.655979801s ago: executing program 33 (id=581): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x54}}, 0x24008844) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x1300}, [{0x34, 0x1, [@m_mirred={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'dummy0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c000000240005040200"/20, @ANYRES32=r1, @ANYBLOB="00000100ffffffff000000000c00010063616b655f6d71000c0002"], 0x3c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 2m11.17205462s ago: executing program 34 (id=452): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='udp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='-2', 0x2) 2m1.650141377s ago: executing program 7 (id=739): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r3, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x88a8}, @TCA_FLOWER_KEY_CVLAN_ETH_TYPE={0x6, 0x4f, 0x8100}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000810}, 0x20084084) 2m1.535264699s ago: executing program 7 (id=740): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000060026008500000061000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r2, 0x0, 0x17, 0x0, &(0x7f0000000140)) 2m1.434294507s ago: executing program 7 (id=741): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x201}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbb70}, 0x94) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 2m0.204727423s ago: executing program 7 (id=759): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x0) 2m0.056886514s ago: executing program 7 (id=761): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x700) 1m59.661302373s ago: executing program 7 (id=765): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000000)=0xffffff16, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 1m59.388430278s ago: executing program 35 (id=765): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000000)=0xffffff16, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 1m43.645194321s ago: executing program 8 (id=944): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='appraise func=FIRMWARE_CHECK', 0x1c) write(r0, &(0x7f0000000200)='appraise func=MOD', 0x11) write(r0, &(0x7f0000000300)='appraise func=POLICY_CHECK', 0x1a) close(r0) 1m43.319922408s ago: executing program 8 (id=949): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010001e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000240)={0x0, 0x12, 0x3, "5443d1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000000), 0x3, 0x400) setsockopt$sock_int(r1, 0x1, 0x2d, &(0x7f0000000040)=0x5, 0x4) syz_usb_control_io$uac1(r0, 0x0, 0x0) 1m41.135211839s ago: executing program 8 (id=968): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x8, 0x0, &(0x7f0000000180)="bf2572170e41586f", 0x0, 0x8d01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r0, &(0x7f0000000180)=ANY=[@ANYRES32=r0, @ANYBLOB="814c8d"], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) 1m40.714145861s ago: executing program 8 (id=972): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000240)='./file0\x00') 1m40.543822413s ago: executing program 8 (id=973): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='2', 0x49) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) 1m40.241321988s ago: executing program 8 (id=978): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000001280)={0x2c, &(0x7f0000001100)={0x20, 0x14, 0x1, 'z'}, 0x0, 0x0, 0x0, 0x0}) 1m39.891205089s ago: executing program 36 (id=978): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000001280)={0x2c, &(0x7f0000001100)={0x20, 0x14, 0x1, 'z'}, 0x0, 0x0, 0x0, 0x0}) 30.779268315s ago: executing program 3 (id=1701): r0 = timerfd_create(0x0, 0x80000) timerfd_settime(r0, 0x0, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x989680}}, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x2002) r1 = syz_io_uring_setup(0x1cfd, &(0x7f0000000280)={0x0, 0x800, 0x10000, 0x1, 0x3d22}, &(0x7f0000000340)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r1, 0xd000941e, 0x0) readv(r0, &(0x7f0000000740)=[{&(0x7f0000000040)=""/52, 0x34}], 0x1) 30.520605567s ago: executing program 3 (id=1702): keyctl$dh_compute(0x17, &(0x7f0000000140), 0x0, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='lz4', 0x3) madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15) 30.298162504s ago: executing program 3 (id=1705): socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x40000}, 0x44044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) epoll_create1(0x80000) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) 30.204779183s ago: executing program 3 (id=1708): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x9801) move_mount(r0, &(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000240)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(&(0x7f0000000340)='./file0/file0\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x2125099, 0x0) umount2(&(0x7f00000003c0)='./file0\x00', 0x8) 30.041325158s ago: executing program 3 (id=1710): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) recvmsg$unix(r0, 0x0, 0x40002022) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 29.343822752s ago: executing program 3 (id=1714): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x3, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x8}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x739, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x33000000}, 0x48) 28.780483776s ago: executing program 37 (id=1714): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x3, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x8}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x739, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x33000000}, 0x48) 5.347293287s ago: executing program 6 (id=1911): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665"], 0x48}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xf1d, 0x200, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff1, 0xffff}, {0x0, 0x17}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x40080c4) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@delchain={0x34, 0x2e, 0x1, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 5.275038614s ago: executing program 6 (id=1913): openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x3, 0xfffc, 0xe652, 0x2, 0x14, 0x8, 0xff}, 0x9c) 5.005749325s ago: executing program 6 (id=1918): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) read(r0, &(0x7f0000000540)=""/157, 0x9d) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000e, 0x2072, 0xffffffffffffffff, 0xd0fb8000) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f00001cc000/0x2000)=nil, &(0x7f0000c34000/0x3000)=nil, 0x2000}) 3.497020549s ago: executing program 6 (id=1932): socket$inet_udp(0x2, 0x2, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a1a44000000001010902"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3.139455641s ago: executing program 9 (id=1937): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000200)={0x20, 0xff, 0x4, 0x40, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xff, 0x2, 0x1, 0x93}, 0xe) r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 2.91315761s ago: executing program 4 (id=1938): socket$inet6(0xa, 0x2, 0x0) pselect6(0x40, &(0x7f0000000040), &(0x7f00000000c0)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)="0e02d54228c260ac4631bb8cf4aff4b6fd", 0x11) 2.841583325s ago: executing program 9 (id=1939): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x240007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='lp', 0x2) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000a00)="91", 0x1}], 0x1}}], 0x1, 0x2091) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000140)="6c988855d6f7ee87c14169555d04716c2492a39f83707c2efe841c8aa2bd8fbf60180b65b12ebf7602986f8dc37931c1a60e45afb52fd9e1194a7216a8f86e902b921a5015cd84eed2b851e6368cf3e55c2a08e6d078b15d1021445cb199bc7e89a072f5aa6e1d07ec7a6416910f142fac825e6f8304c5e0a52de88cf4b154736689b4c556a5b59bb73c9b8817a17618604f98090fad1948f8502772233a7e66993184286c74081ce947bb1253e571f7e251afed056fba5cbb8705ce8e8b607e0c72ddedd5dbc5d6fadc8a8b4a9b92f7f6452784", 0xd4}, {&(0x7f00000002c0)="e6ed7e297fddb5fa64e59ae5c39948c92fa802f2fcda7c14b765100354e31c83b3651512112d48b2921e61371e4e65ec6ae0e5deaf65e50086328f35e33659f82475728a7590ac3606f7f3267c9b6400bdc0b3a130204e3e89103adafd5cb545a854f062056ab7943c9174d79c04995427c57bb98c31edbff2db1152484e1e790b5d217d", 0x84}, {&(0x7f0000000380)="b704ee9d685bdef1565e991eeb07c007a81af7ced96e9fbcf855d88a21dbb4a1f2653dd18367c8f404914d85a8cfc547b87bf23abacdc8e41db9607a94f6617f682d264413688b978b", 0x49}, {&(0x7f0000000400)="3fe3a3a70465018d6f66510bf4b02f53608791072afecedf59abfc74291a75baed28d67be03c956b10e2eeb57be2ca07d7fef7f46585c12d7c71939ff3919741216b05e1", 0x44}, {&(0x7f0000000500)="72bef51f42bcd387eaafff845220df654188287b3df95e6bccb67b8c8fffe4016650ebb37fac50e9457ba3c8040d6b719f267a68d59d", 0x36}, {&(0x7f0000000580)="fb411a9c8518", 0x6}], 0x6) write(r0, &(0x7f0000001e00), 0x0) 2.740801087s ago: executing program 0 (id=1940): setns(0xc9, 0x0) r0 = socket(0x2a, 0x2, 0x9) bind$inet(r0, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) recvmsg(r0, &(0x7f0000000800)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0xf2ff}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) 2.740573426s ago: executing program 4 (id=1941): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xb0}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x3e8, 0xf, 0x0, &(0x7f0000000100)="c1df0600000200000000000000a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 2.443697498s ago: executing program 4 (id=1945): r0 = add_key(0x0, 0x0, &(0x7f0000000200)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d3230303130313030303030305a170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010201010106082a85030701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a85030701010302034100020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x10f, 0xfffffffffffffffd) request_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000340)='-*.\x00', r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random="000300"}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x3004c047}, 0x4000050) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 2.44062558s ago: executing program 4 (id=1947): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendmmsg(r0, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="500000002700010000000000000000000a0001"], 0x50}, 0x1, 0x0, 0x0, 0x2000c0c0}, 0x40000) 2.191641506s ago: executing program 2 (id=1949): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x48, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) 2.143460669s ago: executing program 2 (id=1950): syz_open_procfs(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 2.094026541s ago: executing program 2 (id=1951): r0 = openat$kvm(0xffffff9c, &(0x7f00000002c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x803, 0x9, 0x0, 0x400, 0x80, 0x89, 0xfffffffffffffffd, 0x8, 0x8d], 0x100000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 2.086118631s ago: executing program 6 (id=1952): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x7, 0x4) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000080)=0x44, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 2.004838828s ago: executing program 2 (id=1953): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="180300003f0007012bbd700000000000017c0000e402fc80b00215806a4b4767ef29e5317dbe81cb7de0203ee72ec55ce049121c273120d45f7f360500109f58472b6d5371afc5ca2de5a1c14cbfedfa5363edd2ccc02813c08d1df81c7c15f732285519470ddf35cf5cf5fc8c71b4aa5351828f2f57af12e5d98e2eb4a849e4328e2cb8e61c024296f5ad2d351a5c7960dca8d98cc8fe8e8a48809ea287b746136d79be7cf397275f5d5cddc331f54ff9f7bc97dbc71329085b28dadfd8d25dc1b1f0036e96cef4a01d64e238c23e29774334769f32fe03806535641f5d37003d1d74881c9e9b73792b7c5f5871b49f3dac0ef126e466cb349bf67e", @ANYRES32, @ANYBLOB="3d3668c91db02d5da40b867662c8238467dec63baa8faa428f086cdffaf2d95157392235c8aaff9de9dcb900a000a166ba80322accf55c0c767755bc1ab7084522b51d536b8940b4090df7caaef7907d665fcc01d1c05cd79956f7779696daafee87331484887e2bae20241cc6af0bef4b7c66968a77b38b22493aabf251316820cac664c5a63d9053fe1fc081f99f965d07a220117c951b534abc8fc79bea699d15e670a9d71eb71da6d56e976f907406551dfe19e03bfb092757792fa8228c28bab6f430cca7e930a1ea4a5dc03e5794e664ad34938ae1dc14440f12392832fff021000000c7002500b16659d73a3e415dfc3286bf8fee575ddc0ef3e6eef9505912b264644cecae2d0368668a5624ab70ae7a488178ff81d41e8c4e0f1b058f0d5e5eca09cf130422285017e5fa8451c635277015f246a6cbda429d5fa753de667ea24b34c7c6ed32fd74a9706e7a65ee41ddcb1ec19e3abf4c37d6c16d77f29d22e4ea088975b9b418b645d43e19a9738809987bcb185e3df3b4839330a01a7c62010c993e48569a225ac133ae44fe5270431128f74670ed7baf3f303d65377c4bbc7f82076cdfacdc1ed6000800e900ac1414bb000005006e000000000008000800", @ANYRES32, @ANYBLOB="0c00018008000600", @ANYRES32, @ANYBLOB="0c0002800500230000000000080005"], 0x318}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000801}, 0x40) 1.874800314s ago: executing program 4 (id=1954): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x20}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x107ffffe, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x1c1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5880, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, r4, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbb70}, 0x94) ioctl$NILFS_IOCTL_GET_VINFO(r8, 0xc0186e86, 0x0) syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2) 1.869834677s ago: executing program 9 (id=1955): unshare(0x40000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x14, &(0x7f00000000c0), 0x4) write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16) write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16) 1.743207981s ago: executing program 0 (id=1956): r0 = memfd_create(&(0x7f0000000480)='\xecO\xdd\xbd\xfc\xfa\xe1\xea\xea\x00\xb0\xd8Y\x03\x00\x00\x00\x00\x00\x00\x7f.\x14\x89|cW\x11\x0e$]7\x99\x11\xfd\xbe/6&\xe6\x97\x1e\xfbon\'\x0f<;\xbe\xa5`\"E]\xda]\xb9\xeb>\xe9\xf2\x99\xa8\xbeOA\xf8\\\xeb[\xd7:{\r\x91.\xdbxn\x1b\x17\xccMz\x1dc\x1d5\x9fe/\xb7k}\xd7\xa6\xd1\xcf\x1f\xf3\xae\x9e\xd6\x040\x19\x88\xa7:OYw\xfe\xaf\xdf\x16\x88\xfe\xd3\x13\x9f!\xd7\xcf\x86\x9f\xe8)\x01\x01\x00\x00\x06^\xb4', 0x0) ftruncate(r0, 0x8800000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = dup3(r2, r1, 0x0) sendfile(r3, r0, 0x0, 0x1000009) read$FUSE(r3, &(0x7f0000000540)={0x2020}, 0x2020) 1.727893508s ago: executing program 2 (id=1957): r0 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) write(0xffffffffffffffff, &(0x7f0000001000)="4f4f4f4fffffffff000000010000028000000168", 0x14) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@userptr={0x0, 0x1, 0x400000, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000401000)}, 0x400000}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f00000001c0)=0x2) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000200)=0x1) 1.387723915s ago: executing program 2 (id=1958): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x2e3}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd52, 0x40000, 0x2, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4020, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x12, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_clone(0xc0000, 0x0, 0x19, 0x0, 0x0, 0x0) 1.246344506s ago: executing program 0 (id=1959): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xe, 0x2, 0xfff, 0x7000000, 0x0, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x25, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) 918.057528ms ago: executing program 6 (id=1960): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="2ef26f0f3566b842000f00d8b805000000b9a00000000f01c166baf80cb8b7351187ef66bafc0cb000ee0fde460b0f0130670f01c28fe868cfe20a", 0x3b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 624.188252ms ago: executing program 0 (id=1961): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x401) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x6, &(0x7f0000000040)={0x0, 0x9355, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 484.396698ms ago: executing program 0 (id=1962): prlimit64(0x0, 0xe, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f00000006c0)='.\x00', 0x40001a2) r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200009, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000806, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000100)=0x4, 0x8112) 450.785979ms ago: executing program 9 (id=1963): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x5, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xffffff7d, 0x25dfdbfc, {0x60, 0x0, 0x0, 0x0, {0x7, 0x2}, {0xa, 0x10}, {0x6, 0xfff2}}, [@TCA_INGRESS_BLOCK={0x0, 0xd, 0x80000001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffd, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRES32], 0x48) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 439.22298ms ago: executing program 4 (id=1964): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) syz_open_dev$usbmon(&(0x7f0000000240), 0x8, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_usb_connect$uac3(0x3, 0x98, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100100000008410e494240000102030109028600030109200c080b0001010130080904000000010130000a24010122000010000013240303000001060004000002050004000a001f24", @ANYRES16=r1, @ANYRES16=r0], 0x0) 143.63403ms ago: executing program 9 (id=1965): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000a0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 66.816274ms ago: executing program 0 (id=1966): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001500)=@newqdisc={0x70, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x40, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x80000001, 0x6, 0x8, 0xfffffffe, 0xd99d}}]}]}}}]}, 0x70}}, 0x0) sendto$packet(r0, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c288a8", 0xe, 0x830, &(0x7f0000000440)={0x11, 0x0, r3, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, 0x14) 0s ago: executing program 9 (id=1967): setns(0xc9, 0x0) r0 = socket(0x2a, 0x2, 0x9) bind$inet(r0, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) recvmsg(r0, &(0x7f0000000800)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0xf2ff}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) kernel console output (not intermixed with test programs): utex+0x34f/0x4d0 [ 155.583197][ T9129] ? __x64_sys_futex+0x358/0x4d0 [ 155.583228][ T9129] ? xfd_validate_state+0x129/0x190 [ 155.583261][ T9129] do_syscall_64+0x123/0x790 [ 155.583290][ T9129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.583310][ T9129] RIP: 0033:0x7f714399e1d9 [ 155.583326][ T9129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.583344][ T9129] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 155.583363][ T9129] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 155.583375][ T9129] RDX: 0000200000002d40 RSI: 0000000000000002 RDI: 0000000000000003 [ 155.583386][ T9129] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 155.583397][ T9129] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 155.583408][ T9129] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 155.583435][ T9129] [ 155.891641][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 155.891657][ T30] audit: type=1400 audit(1791688776.209:3143): avc: denied { write } for pid=9131 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 156.222477][ T5262] 8021q: adding VLAN 0 to HW filter on device eth17 [ 156.576337][ T9176] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1103'. [ 156.576362][ T9176] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1103'. [ 156.576377][ T9176] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1103'. [ 157.180228][ T1214] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 157.340920][ T1214] usb 10-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 157.342954][ T1214] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 157.342995][ T1214] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.348760][ T1214] keyspan 10-1:1.0: Keyspan 2 port adapter converter detected [ 157.348939][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 81 [ 157.355022][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 1 [ 157.355983][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 84 [ 157.356109][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 2 [ 157.363119][ T1214] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 157.366480][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 88 [ 157.366537][ T1214] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 6 [ 157.369166][ T1214] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 157.523573][ T30] audit: type=1400 audit(1791688777.839:3144): avc: denied { mount } for pid=9217 comm="syz.3.1118" name="/" dev="hugetlbfs" ino=25395 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 157.529034][ T30] audit: type=1400 audit(1791688777.839:3145): avc: denied { mounton } for pid=9217 comm="syz.3.1118" path="/bus" dev="hugetlbfs" ino=25398 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 157.591473][ T9218] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 157.591497][ T9218] overlayfs: failed to set xattr on upper [ 157.591504][ T9218] overlayfs: ...falling back to redirect_dir=nofollow. [ 157.591511][ T9218] overlayfs: ...falling back to index=off. [ 157.591517][ T9218] overlayfs: ...falling back to uuid=null. [ 157.591532][ T9218] overlayfs: maximum fs stacking depth exceeded [ 158.057846][ T5732] usb 10-1: USB disconnect, device number 3 [ 158.072520][ T5732] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 158.113564][ T5732] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 158.116368][ T5732] keyspan 10-1:1.0: device disconnected [ 158.862945][ T9241] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1126'. [ 161.331087][ T30] audit: type=1400 audit(1791688781.639:3146): avc: denied { wake_alarm } for pid=9252 comm="syz.3.1129" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 161.393226][ T30] audit: type=1400 audit(1791688781.709:3147): avc: denied { name_bind } for pid=9256 comm="syz.9.1131" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 161.395601][ T30] audit: type=1400 audit(1791688781.709:3148): avc: denied { listen } for pid=9256 comm="syz.9.1131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 161.580807][ T9267] FAULT_INJECTION: forcing a failure. [ 161.580807][ T9267] name failslab, interval 1, probability 0, space 0, times 0 [ 161.580839][ T9267] CPU: 0 UID: 0 PID: 9267 Comm: syz.9.1134 Tainted: G L syzkaller #0 PREEMPT(full) [ 161.580865][ T9267] Tainted: [L]=SOFTLOCKUP [ 161.580872][ T9267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 161.580884][ T9267] Call Trace: [ 161.580890][ T9267] [ 161.580898][ T9267] dump_stack_lvl+0x100/0x190 [ 161.580931][ T9267] should_fail_ex.cold+0x5/0xa [ 161.580957][ T9267] should_failslab+0xc2/0x120 [ 161.580984][ T9267] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 161.581008][ T9267] ? nfs4_init_server.isra.0+0x5ad/0xf60 [ 161.581027][ T9267] ? nfs4_try_get_tree+0x93/0x140 [ 161.581044][ T9267] ? kvasprintf_const+0x66/0x1a0 [ 161.581079][ T9267] kvasprintf+0xbc/0x150 [ 161.581104][ T9267] ? __pfx_kvasprintf+0x10/0x10 [ 161.581141][ T9267] kvasprintf_const+0x66/0x1a0 [ 161.581169][ T9267] kobject_set_name_vargs+0x5a/0x140 [ 161.581193][ T9267] kobject_init_and_add+0xe7/0x180 [ 161.581215][ T9267] ? __pfx_kobject_init_and_add+0x10/0x10 [ 161.581236][ T9267] ? __kasan_kmalloc+0xaa/0xb0 [ 161.581258][ T9267] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 161.581277][ T9267] ? rpc_sysfs_xprt_switch_setup+0xe0/0x370 [ 161.581310][ T9267] rpc_sysfs_xprt_switch_setup+0x189/0x370 [ 161.581341][ T9267] xprt_switch_alloc+0x28e/0x3c0 [ 161.581366][ T9267] rpc_create_xprt+0x2dc/0x440 [ 161.581391][ T9267] rpc_create+0x46e/0x7f0 [ 161.581414][ T9267] ? lock_acquire+0x1d1/0x380 [ 161.581436][ T9267] ? __pfx_rpc_create+0x10/0x10 [ 161.581488][ T9267] ? net_generic+0xea/0x2a0 [ 161.581515][ T9267] ? net_generic+0xea/0x2a0 [ 161.581555][ T9267] nfs_create_rpc_client+0x6a1/0x8f0 [ 161.581575][ T9267] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 161.581608][ T9267] ? lockdep_init_map_type+0x5c/0x250 [ 161.581634][ T9267] ? lockdep_init_map_type+0x5c/0x250 [ 161.581662][ T9267] nfs4_alloc_client+0x8f0/0xd70 [ 161.581687][ T9267] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 161.581707][ T9267] ? __lock_acquire+0x5c0/0x1f40 [ 161.581729][ T9267] ? stack_trace_save+0x8e/0xc0 [ 161.581748][ T9267] ? __pfx_stack_trace_save+0x10/0x10 [ 161.581771][ T9267] ? lock_acquire+0x1d1/0x380 [ 161.581792][ T9267] ? net_generic+0x25/0x2a0 [ 161.581823][ T9267] ? nfs_get_client+0x849/0x1230 [ 161.581839][ T9267] ? nfs_get_client+0x849/0x1230 [ 161.581862][ T9267] nfs_get_client+0x87b/0x1230 [ 161.581879][ T9267] ? do_raw_spin_lock+0x128/0x260 [ 161.581911][ T9267] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 161.581938][ T9267] nfs4_set_client+0x3f6/0x640 [ 161.581958][ T9267] nfs4_init_server.isra.0+0x5ad/0xf60 [ 161.581978][ T9267] ? __pfx___debug_object_init+0x10/0x10 [ 161.582009][ T9267] ? __pfx_nfs4_init_server.isra.0+0x10/0x10 [ 161.582043][ T9267] ? __rpc_init_priority_wait_queue+0x38a/0x500 [ 161.582081][ T9267] nfs4_create_server+0x185/0x2b0 [ 161.582105][ T9267] nfs4_try_get_tree+0x93/0x140 [ 161.582124][ T9267] nfs_get_tree+0xa61/0x1450 [ 161.582151][ T9267] vfs_get_tree+0x92/0x320 [ 161.582171][ T9267] path_mount+0x7d0/0x2850 [ 161.582195][ T9267] ? __pfx_path_mount+0x10/0x10 [ 161.582212][ T9267] ? lockdep_hardirqs_on+0x7d/0x110 [ 161.582241][ T9267] ? putname+0xb1/0x110 [ 161.582255][ T9267] ? kmem_cache_free+0x127/0x6c0 [ 161.582284][ T9267] ? __x64_sys_mount+0x293/0x310 [ 161.582302][ T9267] __x64_sys_mount+0x293/0x310 [ 161.582322][ T9267] ? __pfx___x64_sys_mount+0x10/0x10 [ 161.582348][ T9267] do_syscall_64+0x123/0x790 [ 161.582377][ T9267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.582396][ T9267] RIP: 0033:0x7fafc859e1d9 [ 161.582413][ T9267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.582430][ T9267] RSP: 002b:00007fafc951e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 161.582449][ T9267] RAX: ffffffffffffffda RBX: 00007fafc8825fa0 RCX: 00007fafc859e1d9 [ 161.582461][ T9267] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000200000000080 [ 161.582472][ T9267] RBP: 00007fafc8635888 R08: 0000200000000140 R09: 0000000000000000 [ 161.582483][ T9267] R10: 0000000000000048 R11: 0000000000000246 R12: 0000000000000000 [ 161.582495][ T9267] R13: 00007fafc8826038 R14: 00007fafc8825fa0 R15: 00007ffec2570d98 [ 161.582522][ T9267] [ 161.590122][ T9267] kobject: can not set name properly! [ 161.667774][ T9263] netlink: 'syz.0.1133': attribute type 5 has an invalid length. [ 162.394603][ T9301] ip_tables: iptables: counters copy to user failed while replacing table [ 162.615402][ T9311] fuse: Bad value for 'fd' [ 162.625369][ T9311] overlayfs: failed to clone upperpath [ 162.703962][ T9315] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 162.751732][ T30] audit: type=1400 audit(1791688783.069:3149): avc: denied { watch } for pid=9320 comm="syz.0.1155" path="pipe:[26096]" dev="pipefs" ino=26096 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 162.837004][ T30] audit: type=1400 audit(1791688783.149:3150): avc: denied { create } for pid=9323 comm="syz.0.1157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 162.837878][ T30] audit: type=1400 audit(1791688783.149:3151): avc: denied { sys_admin } for pid=9323 comm="syz.0.1157" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 163.094718][ T30] audit: type=1400 audit(1791688783.409:3152): avc: denied { getopt } for pid=9345 comm="syz.9.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 163.396216][ T9362] dummy0: left promiscuous mode [ 163.686170][ T30] audit: type=1400 audit(1791688783.999:3153): avc: denied { mount } for pid=9367 comm="syz.0.1168" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 163.829266][ T9374] netlink: 558 bytes leftover after parsing attributes in process `syz.9.1171'. [ 164.457818][ T30] audit: type=1400 audit(1791688784.769:3154): avc: denied { write } for pid=9371 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 164.720847][ T30] audit: type=1400 audit(1791688785.029:3155): avc: denied { write } for pid=9410 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 164.903885][ T9419] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 165.070981][ T189] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 165.220101][ T189] usb 7-1: Using ep0 maxpacket: 16 [ 165.222562][ T189] usb 7-1: New USB device found, idVendor=0c70, idProduct=f00d, bcdDevice= 0.00 [ 165.223835][ T189] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 165.223873][ T189] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.228102][ T189] usb 7-1: config 0 descriptor?? [ 165.228660][ T9418] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 165.435131][ T9418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.435500][ T9418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.702408][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702446][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702466][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702485][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702504][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702523][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702571][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702591][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702610][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.702629][ T189] hid-sensor-hub 0003:0C70:F00D.0002: unknown main item tag 0x0 [ 165.740463][ T189] hid-sensor-hub 0003:0C70:F00D.0002: hiddev0,hidraw0: USB HID v0.08 Device [HID 0c70:f00d] on usb-dummy_hcd.6-1/input0 [ 166.036272][ T189] usb 7-1: USB disconnect, device number 6 [ 166.369931][ T9471] fuse: fd is not a fuse device [ 166.447345][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 166.447362][ T30] audit: type=1326 audit(1791688786.759:3177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fad5ff9dfd7 code=0x7ffc0000 [ 166.447528][ T30] audit: type=1326 audit(1791688786.759:3178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 166.447935][ T30] audit: type=1326 audit(1791688786.759:3179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fad5ff5aed1 code=0x7ffc0000 [ 166.448102][ T30] audit: type=1326 audit(1791688786.759:3180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 166.448280][ T30] audit: type=1326 audit(1791688786.759:3181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7fad5ff9efc9 code=0x7ffc0000 [ 166.448602][ T30] audit: type=1326 audit(1791688786.759:3182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fad5ff5af3b code=0x7ffc0000 [ 166.448797][ T30] audit: type=1326 audit(1791688786.759:3183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fad5ff5a62c code=0x7ffc0000 [ 166.448964][ T30] audit: type=1326 audit(1791688786.759:3184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 166.449120][ T30] audit: type=1326 audit(1791688786.759:3185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fad5ff5a68e code=0x7ffc0000 [ 166.449327][ T30] audit: type=1326 audit(1791688786.759:3186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9466 comm="syz.0.1196" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 166.845396][ T9484] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 167.198145][ T9501] kvm_intel: kvm [9500]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0xffffefc1 [ 167.202987][ T9501] kvm [9500]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0xffffb203 [ 167.203034][ T9501] kvm [9500]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xffffb0b8 [ 167.205809][ T9501] kvm [9500]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x11e) = 0xffffe9d2 [ 167.207429][ T9501] kvm [9500]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0xffffe802 [ 167.438517][ T9518] fuse: fd is not a fuse device [ 167.705990][ T9537] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1225'. [ 167.888431][ T9544] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1228'. [ 167.888522][ T9544] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 167.984568][ T9544] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.020828][ T9542] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.047020][ T9542] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.109271][ T9546] erspan0: entered promiscuous mode [ 168.114407][ T9546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1227'. [ 168.940084][ T5712] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 169.080696][ T10] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 169.090805][ T5712] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 169.091709][ T5712] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.091742][ T5712] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.100278][ T5712] usb 10-1: config 0 descriptor?? [ 169.110194][ T5712] pwc: Askey VC010 type 2 USB webcam detected. [ 169.160529][ T9592] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 169.238771][ T10] usb 7-1: not running at top speed; connect to a high speed hub [ 169.238801][ T10] usb 7-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 169.239720][ T10] usb 7-1: config 1 has an invalid descriptor of length 115, skipping remainder of the config [ 169.239761][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 169.239782][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 169.239837][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.266962][ T10] keyspan 7-1:1.0: Keyspan 2 port adapter converter detected [ 169.298760][ T10] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 169.313516][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 88 [ 169.313577][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 6 [ 169.337487][ T10] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 169.379944][ T5712] pwc: send_video_command error -71 [ 169.379961][ T5712] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 169.380138][ T5712] Philips webcam 10-1:0.0: probe with driver Philips webcam failed with error -71 [ 169.393132][ T5712] usb 10-1: USB disconnect, device number 4 [ 169.747343][ T9614] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1245'. [ 169.763572][ T5334] usb 7-1: USB disconnect, device number 7 [ 169.777037][ T9614] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1245'. [ 169.795107][ T5334] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 169.822258][ T5334] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 169.823036][ T5334] keyspan 7-1:1.0: device disconnected [ 169.940102][ T5712] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 170.052694][ T9629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1249'. [ 170.092608][ T5712] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 170.093441][ T5712] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 170.093477][ T5712] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.096196][ T5712] usb 10-1: config 0 descriptor?? [ 170.123404][ T5712] pwc: Askey VC010 type 2 USB webcam detected. [ 170.506046][ T5712] pwc: recv_control_msg error -32 req 02 val 2b00 [ 170.506935][ T5712] pwc: recv_control_msg error -32 req 02 val 2700 [ 170.507473][ T5712] pwc: recv_control_msg error -32 req 02 val 2c00 [ 170.598454][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058314c00: rx timeout, send abort [ 170.711685][ T5712] pwc: recv_control_msg error -71 req 04 val 1300 [ 170.712905][ T5712] pwc: recv_control_msg error -71 req 04 val 1400 [ 170.714264][ T5712] pwc: recv_control_msg error -71 req 02 val 2000 [ 170.714658][ T5712] pwc: recv_control_msg error -71 req 02 val 2100 [ 170.715690][ T5712] pwc: recv_control_msg error -71 req 04 val 1500 [ 170.716016][ T5712] pwc: recv_control_msg error -71 req 02 val 2500 [ 170.716442][ T5712] pwc: recv_control_msg error -71 req 02 val 2400 [ 170.717997][ T5712] pwc: recv_control_msg error -71 req 02 val 2600 [ 170.718343][ T5712] pwc: recv_control_msg error -71 req 02 val 2900 [ 170.719918][ T5712] pwc: recv_control_msg error -71 req 02 val 2800 [ 170.776207][ T5712] pwc: recv_control_msg error -71 req 04 val 1100 [ 170.797452][ T5712] pwc: recv_control_msg error -71 req 04 val 1200 [ 170.842753][ T5712] pwc: Registered as video103. [ 170.844460][ T5712] input: PWC snapshot button as /devices/platform/dummy_hcd.9/usb10/10-1/input/input9 [ 170.876027][ T5712] usb 10-1: USB disconnect, device number 5 [ 171.100455][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058314c00: abort rx timeout. Force session deactivation [ 171.455984][ T9679] bridge0: port 3(vlan3) entered blocking state [ 171.456068][ T9679] bridge0: port 3(vlan3) entered disabled state [ 171.456183][ T9679] vlan3: entered allmulticast mode [ 171.481856][ T9679] vlan3: entered promiscuous mode [ 171.489621][ T9650] netlink: 'syz.0.1252': attribute type 4 has an invalid length. [ 171.519421][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 171.519436][ T30] audit: type=1400 audit(1791688791.829:3214): avc: denied { write } for pid=9668 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.533930][ T9684] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1257'. [ 171.601635][ T9689] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1257'. [ 171.625970][ T9679] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 171.746832][ T30] audit: type=1400 audit(1791688792.059:3215): avc: denied { write } for pid=9691 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.817740][ T9695] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1259'. [ 172.851420][ T5608] Bluetooth: hci0: unexpected cc 0x041a length: 8 > 7 [ 172.859477][ T30] audit: type=1400 audit(1791688793.169:3216): avc: denied { write } for pid=9722 comm="syz.3.1266" name="usbmon3" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 172.859822][ T30] audit: type=1400 audit(1791688793.169:3217): avc: denied { open } for pid=9722 comm="syz.3.1266" path="/dev/usbmon3" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 172.929400][ T9725] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1265'. [ 173.087817][ T30] audit: type=1400 audit(1791688793.399:3218): avc: denied { write } for pid=9704 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.196167][ T30] audit: type=1400 audit(1791688793.499:3219): avc: denied { write } for pid=9736 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.358259][ T9743] netlink: 2028 bytes leftover after parsing attributes in process `syz.9.1268'. [ 173.358281][ T9743] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1268'. [ 173.549200][ T9751] FAULT_INJECTION: forcing a failure. [ 173.549200][ T9751] name failslab, interval 1, probability 0, space 0, times 0 [ 173.549222][ T9751] CPU: 1 UID: 0 PID: 9751 Comm: syz.6.1272 Tainted: G L syzkaller #0 PREEMPT(full) [ 173.549239][ T9751] Tainted: [L]=SOFTLOCKUP [ 173.549243][ T9751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 173.549251][ T9751] Call Trace: [ 173.549256][ T9751] [ 173.549261][ T9751] dump_stack_lvl+0x100/0x190 [ 173.549282][ T9751] should_fail_ex.cold+0x5/0xa [ 173.549299][ T9751] should_failslab+0xc2/0x120 [ 173.549316][ T9751] __kmalloc_noprof+0xfc/0x840 [ 173.549330][ T9751] ? lockdep_init_map_type+0x5c/0x250 [ 173.549344][ T9751] ? ops_init+0x77/0x5f0 [ 173.549360][ T9751] ops_init+0x77/0x5f0 [ 173.549375][ T9751] setup_net+0x118/0x3a0 [ 173.549387][ T9751] ? __pfx_setup_net+0x10/0x10 [ 173.549405][ T9751] copy_net_ns+0x345/0x7a0 [ 173.549421][ T9751] create_new_namespaces+0x3ea/0xac0 [ 173.549439][ T9751] unshare_nsproxy_namespaces+0xf2/0x220 [ 173.549455][ T9751] ksys_unshare+0x4a2/0xb30 [ 173.549476][ T9751] ? __pfx_ksys_unshare+0x10/0x10 [ 173.549506][ T9751] __x64_sys_unshare+0x31/0x40 [ 173.549528][ T9751] do_syscall_64+0x123/0x790 [ 173.549552][ T9751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.549564][ T9751] RIP: 0033:0x7f714399e1d9 [ 173.549574][ T9751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.549585][ T9751] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 173.549598][ T9751] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 173.549605][ T9751] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 173.549613][ T9751] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 173.549620][ T9751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.549626][ T9751] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 173.549642][ T9751] [ 173.596168][ T9753] FAULT_INJECTION: forcing a failure. [ 173.596168][ T9753] name failslab, interval 1, probability 0, space 0, times 0 [ 173.596196][ T9753] CPU: 1 UID: 0 PID: 9753 Comm: syz.3.1273 Tainted: G L syzkaller #0 PREEMPT(full) [ 173.596218][ T9753] Tainted: [L]=SOFTLOCKUP [ 173.596224][ T9753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 173.596234][ T9753] Call Trace: [ 173.596239][ T9753] [ 173.596246][ T9753] dump_stack_lvl+0x100/0x190 [ 173.596274][ T9753] should_fail_ex.cold+0x5/0xa [ 173.596296][ T9753] should_failslab+0xc2/0x120 [ 173.596324][ T9753] __kmalloc_cache_node_noprof+0x94/0x720 [ 173.596346][ T9753] ? lockdep_init_map_type+0x5c/0x250 [ 173.596368][ T9753] ? __alloc_workqueue+0x1211/0x1950 [ 173.596393][ T9753] __alloc_workqueue+0x1211/0x1950 [ 173.596420][ T9753] alloc_workqueue_noprof+0xc7/0x130 [ 173.596442][ T9753] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 173.596466][ T9753] ? lockdep_init_map_type+0x5c/0x250 [ 173.596486][ T9753] ? lockdep_init_map_type+0x5c/0x250 [ 173.596509][ T9753] __rds_conn_create+0x1290/0x2650 [ 173.596541][ T9753] ? __pfx___rds_conn_create+0x10/0x10 [ 173.596561][ T9753] ? trace_kmalloc+0xeb/0x110 [ 173.596582][ T9753] ? __kasan_kmalloc+0xaa/0xb0 [ 173.596603][ T9753] ? lockdep_init_map_type+0x5c/0x250 [ 173.596626][ T9753] rds_conn_create_outgoing+0x44/0x60 [ 173.596653][ T9753] rds_sendmsg+0x10da/0x34d0 [ 173.596681][ T9753] ? __pfx_rds_sendmsg+0x10/0x10 [ 173.596710][ T9753] ? selinux_socket_sendmsg+0x198/0x2f0 [ 173.596736][ T9753] ? ____sys_sendmsg+0xa4d/0xbe0 [ 173.596755][ T9753] ____sys_sendmsg+0xa4d/0xbe0 [ 173.596773][ T9753] ? __pfx_rds_sendmsg+0x10/0x10 [ 173.596791][ T9753] ? __pfx_____sys_sendmsg+0x10/0x10 [ 173.596815][ T9753] ? plist_check_list+0x1b8/0x280 [ 173.596834][ T9753] ? plist_del+0x308/0x510 [ 173.596856][ T9753] ___sys_sendmsg+0x190/0x1e0 [ 173.596883][ T9753] ? __pfx____sys_sendmsg+0x10/0x10 [ 173.596904][ T9753] ? futex_wake+0x220/0x5e0 [ 173.596930][ T9753] ? find_held_lock+0x2b/0x80 [ 173.596968][ T9753] __sys_sendmsg+0x160/0x210 [ 173.596984][ T9753] ? __pfx___sys_sendmsg+0x10/0x10 [ 173.597014][ T9753] do_syscall_64+0x123/0x790 [ 173.597040][ T9753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.597059][ T9753] RIP: 0033:0x7f7416d9e1d9 [ 173.597074][ T9753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.597089][ T9753] RSP: 002b:00007f7417c7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 173.597105][ T9753] RAX: ffffffffffffffda RBX: 00007f7417025fa0 RCX: 00007f7416d9e1d9 [ 173.597116][ T9753] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 173.597125][ T9753] RBP: 00007f7416e35888 R08: 0000000000000000 R09: 0000000000000000 [ 173.597134][ T9753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.597144][ T9753] R13: 00007f7417026038 R14: 00007f7417025fa0 R15: 00007ffe1dbc5488 [ 173.597166][ T9753] [ 173.809492][ T30] audit: type=1400 audit(1791688794.129:3220): avc: denied { shutdown } for pid=9754 comm="syz.2.1274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 174.384602][ T30] audit: type=1400 audit(1791688794.699:3221): avc: denied { bind } for pid=9775 comm="syz.3.1281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 175.170516][ T9] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 175.321801][ T9] usb 10-1: Using ep0 maxpacket: 32 [ 175.322323][ T9] usb 10-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 175.323406][ T9] usb 10-1: config index 0 descriptor too short (expected 35577, got 27) [ 175.323428][ T9] usb 10-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 175.323445][ T9] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 175.323464][ T9] usb 10-1: config 1 has no interface number 0 [ 175.323496][ T9] usb 10-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 175.323519][ T9] usb 10-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 175.323553][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.437601][ T9] snd_usb_pod 10-1:1.1: Line 6 Pocket POD found [ 175.540844][ T9] snd_usb_pod 10-1:1.1: Line 6 Pocket POD now attached [ 175.608259][ T9815] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1294'. [ 175.719357][ T9817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1295'. [ 176.005894][ T9] usb 10-1: USB disconnect, device number 6 [ 176.007375][ T9] snd_usb_pod 10-1:1.1: Line 6 Pocket POD now disconnected [ 178.470094][ T9] usb 10-1: new full-speed USB device number 7 using dummy_hcd [ 178.629399][ T9] usb 10-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice= 0.40 [ 178.634347][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.634369][ T9] usb 10-1: Product: syz [ 178.634382][ T9] usb 10-1: Manufacturer: syz [ 178.634395][ T9] usb 10-1: SerialNumber: syz [ 178.648032][ T9] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 178.648693][ T9] snd-usb-audio 10-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 178.770394][ T10] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 179.089591][ T25] usb 10-1: USB disconnect, device number 7 [ 179.210273][ T30] audit: type=1400 audit(1791688799.499:3222): avc: denied { write } for pid=9869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.290463][ T30] audit: type=1400 audit(1791688799.609:3223): avc: denied { write } for pid=9885 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.654034][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 179.654668][ T10] usb 7-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 179.655120][ T10] usb 7-1: config 0 has no interfaces? [ 179.656762][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.656783][ T10] usb 7-1: Product: syz [ 179.656798][ T10] usb 7-1: Manufacturer: syz [ 179.656812][ T10] usb 7-1: SerialNumber: syz [ 179.659097][ T10] usb 7-1: config 0 descriptor?? [ 179.886040][ T30] audit: type=1400 audit(1791688800.199:3224): avc: denied { write } for pid=9859 comm="syz.6.1312" name="functions" dev="configfs" ino=9870 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 179.912519][ T10] usb 7-1: USB disconnect, device number 8 [ 179.913268][ T30] audit: type=1400 audit(1791688800.209:3225): avc: denied { write } for pid=9859 comm="syz.6.1312" name="out_ports" dev="configfs" ino=27421 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 179.913313][ T30] audit: type=1400 audit(1791688800.209:3226): avc: denied { open } for pid=9859 comm="syz.6.1312" path="/136/config/usb_gadget/g1/functions/midi.usb0/out_ports" dev="configfs" ino=27421 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 180.257072][ T9905] fuse: fd is not a fuse device [ 180.294310][ T30] audit: type=1400 audit(1791688800.609:3227): avc: denied { listen } for pid=9894 comm="syz.3.1322" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 180.343291][ T9909] overlayfs: missing 'lowerdir' [ 180.370147][ T10] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 180.403786][ T9913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1329'. [ 180.522247][ T10] usb 10-1: unable to get BOS descriptor or descriptor too short [ 180.522286][ T10] usb 10-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice= 6.38 [ 180.525544][ T10] usb 10-1: config 114 has an invalid interface number: 240 but max is 0 [ 180.525569][ T10] usb 10-1: config 114 has no interface number 0 [ 180.525603][ T10] usb 10-1: config 114 interface 240 altsetting 232 bulk endpoint 0x1 has invalid maxpacket 1023 [ 180.525626][ T10] usb 10-1: config 114 interface 240 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 180.525655][ T10] usb 10-1: config 114 interface 240 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 180.525675][ T10] usb 10-1: config 114 interface 240 has no altsetting 0 [ 180.535723][ T10] usb 10-1: string descriptor 0 read error: -22 [ 180.535814][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.542387][ T9900] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 180.542466][ T9900] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 180.549074][ T10] ir_usb 10-1:114.240: IR Dongle converter detected [ 180.613577][ T9918] tipc: Started in network mode [ 180.613593][ T9918] tipc: Node identity 4, cluster identity 4711 [ 180.613602][ T9918] tipc: Node number set to 4 [ 180.767390][ T10] usb 10-1: IR Dongle converter now attached to ttyUSB0 [ 180.992972][ T5732] usb 10-1: USB disconnect, device number 8 [ 181.026925][ T5732] ir-usb ttyUSB0: IR Dongle converter now disconnected from ttyUSB0 [ 181.027461][ T5732] ir_usb 10-1:114.240: device disconnected [ 181.225621][ T9932] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 181.251558][ T9932] bond1: left promiscuous mode [ 181.251579][ T9932] bond2: left promiscuous mode [ 181.407400][ T1517] IPVS: starting estimator thread 0... [ 181.462991][ T30] audit: type=1400 audit(1791688801.779:3228): avc: denied { ioctl } for pid=9940 comm="syz.2.1339" path="socket:[27482]" dev="sockfs" ino=27482 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 181.490129][ T9938] IPVS: using max 44 ests per chain, 105600 per kthread [ 181.637779][ T9949] ip_tables: iptables: counters copy to user failed while replacing table [ 181.855098][ T30] audit: type=1400 audit(1791688802.169:3229): avc: denied { ioctl } for pid=9955 comm="syz.2.1344" path="socket:[27574]" dev="sockfs" ino=27574 ioctlcmd=0x8905 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 181.876263][ T9958] lo speed is unknown, defaulting to 1000 [ 181.876314][ T9958] lo speed is unknown, defaulting to 1000 [ 181.879402][ T9958] lo speed is unknown, defaulting to 1000 [ 181.884118][ T9958] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 181.884148][ T9958] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 181.884185][ T9958] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 181.885339][ T30] audit: type=1400 audit(1791688802.189:3230): avc: denied { getopt } for pid=9957 comm="syz.0.1345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 181.895097][ T9958] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 182.049444][ T9958] lo speed is unknown, defaulting to 1000 [ 182.112892][ T9958] lo speed is unknown, defaulting to 1000 [ 182.133032][ T9958] lo speed is unknown, defaulting to 1000 [ 182.144080][ T9958] lo speed is unknown, defaulting to 1000 [ 182.150667][ T9958] lo speed is unknown, defaulting to 1000 [ 182.166331][ T9958] lo speed is unknown, defaulting to 1000 [ 182.546896][ T9977] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1351'. [ 182.606862][ T9973] lo speed is unknown, defaulting to 1000 [ 182.805340][ T9988] syzkaller1: entered promiscuous mode [ 182.805362][ T9988] syzkaller1: entered allmulticast mode [ 182.867115][ T9992] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 182.867144][ T9992] overlayfs: missing 'lowerdir' [ 182.870299][ T9992] SELinux: Context system_u:object_r:modem_device_t:s0 is not valid (left unmapped). [ 182.897029][ T30] audit: type=1400 audit(1791688803.209:3231): avc: denied { relabelto } for pid=9991 comm="syz.9.1357" name="file0" dev="tmpfs" ino=284 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:modem_device_t:s0" [ 183.006800][ T9996] netlink: 'syz.9.1359': attribute type 11 has an invalid length. [ 183.289098][T10008] FAULT_INJECTION: forcing a failure. [ 183.289098][T10008] name failslab, interval 1, probability 0, space 0, times 0 [ 183.289135][T10008] CPU: 1 UID: 0 PID: 10008 Comm: syz.9.1363 Tainted: G L syzkaller #0 PREEMPT(full) [ 183.289162][T10008] Tainted: [L]=SOFTLOCKUP [ 183.289169][T10008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 183.289180][T10008] Call Trace: [ 183.289187][T10008] [ 183.289195][T10008] dump_stack_lvl+0x100/0x190 [ 183.289228][T10008] should_fail_ex.cold+0x5/0xa [ 183.289255][T10008] should_failslab+0xc2/0x120 [ 183.289283][T10008] __kmalloc_noprof+0xfc/0x840 [ 183.289308][T10008] ? tomoyo_encode2+0xfb/0x3c0 [ 183.289341][T10008] tomoyo_encode2+0xfb/0x3c0 [ 183.289375][T10008] tomoyo_encode+0x29/0x50 [ 183.289401][T10008] tomoyo_realpath_from_path+0x18c/0x690 [ 183.289432][T10008] tomoyo_check_open_permission+0x2af/0x3c0 [ 183.289456][T10008] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 183.289486][T10008] ? hook_file_open+0x248/0x8e0 [ 183.289526][T10008] ? path_get+0x61/0x80 [ 183.289545][T10008] tomoyo_file_open+0x6b/0x90 [ 183.289566][T10008] security_file_open+0xb5/0x1e0 [ 183.289593][T10008] do_dentry_open+0x588/0x14d0 [ 183.289622][T10008] vfs_open+0x82/0x3f0 [ 183.289651][T10008] path_openat+0x19fa/0x2440 [ 183.289681][T10008] ? __pfx_path_openat+0x10/0x10 [ 183.289714][T10008] do_file_open+0x20e/0x430 [ 183.289742][T10008] ? __pfx_do_file_open+0x10/0x10 [ 183.289785][T10008] ? _raw_spin_unlock+0x28/0x50 [ 183.289808][T10008] ? alloc_fd+0x471/0x7a0 [ 183.289846][T10008] do_sys_openat2+0x10f/0x1e0 [ 183.289865][T10008] ? __pfx_do_sys_openat2+0x10/0x10 [ 183.289882][T10008] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 183.289916][T10008] __x64_sys_openat+0x12d/0x210 [ 183.289935][T10008] ? __pfx___x64_sys_openat+0x10/0x10 [ 183.289964][T10008] do_syscall_64+0x123/0x790 [ 183.289993][T10008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.290010][T10008] RIP: 0033:0x7fafc855ea0e [ 183.290027][T10008] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 183.290043][T10008] RSP: 002b:00007fafc951bea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 183.290062][T10008] RAX: ffffffffffffffda RBX: 00007fafc951e6c0 RCX: 00007fafc855ea0e [ 183.290074][T10008] RDX: 0000000000000002 RSI: 00007fafc8634c1a RDI: ffffffffffffff9c [ 183.290092][T10008] RBP: 00007fafc8635888 R08: 0000000000000000 R09: 0000000000000000 [ 183.290103][T10008] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 183.290114][T10008] R13: 0000200000000040 R14: 0000000000000003 R15: 00007ffec2570d98 [ 183.290140][T10008] [ 183.350715][T10008] ERROR: Out of memory at tomoyo_realpath_from_path. [ 183.392156][T10011] clocksource: Switched to clocksource kvm-clock [ 183.590743][ T5732] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 183.721401][ T5732] usb 10-1: device descriptor read/64, error -71 [ 183.912592][T10020] FAULT_INJECTION: forcing a failure. [ 183.912592][T10020] name failslab, interval 1, probability 0, space 0, times 0 [ 183.912626][T10020] CPU: 0 UID: 0 PID: 10020 Comm: syz.6.1368 Tainted: G L syzkaller #0 PREEMPT(full) [ 183.912653][T10020] Tainted: [L]=SOFTLOCKUP [ 183.912661][T10020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 183.912672][T10020] Call Trace: [ 183.912678][T10020] [ 183.912686][T10020] dump_stack_lvl+0x100/0x190 [ 183.912721][T10020] should_fail_ex.cold+0x5/0xa [ 183.912748][T10020] should_failslab+0xc2/0x120 [ 183.912777][T10020] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 183.912804][T10020] ? nfs_get_tree+0x7dd/0x1450 [ 183.912829][T10020] kmemdup_nul+0x49/0xd0 [ 183.912851][T10020] nfs_get_tree+0x7dd/0x1450 [ 183.912877][T10020] vfs_get_tree+0x92/0x320 [ 183.912897][T10020] path_mount+0x7d0/0x2850 [ 183.912922][T10020] ? __pfx_path_mount+0x10/0x10 [ 183.912941][T10020] ? lockdep_hardirqs_on+0x7d/0x110 [ 183.912970][T10020] ? putname+0xb1/0x110 [ 183.912986][T10020] ? kmem_cache_free+0x127/0x6c0 [ 183.913015][T10020] ? __x64_sys_mount+0x293/0x310 [ 183.913033][T10020] __x64_sys_mount+0x293/0x310 [ 183.913053][T10020] ? __pfx___x64_sys_mount+0x10/0x10 [ 183.913079][T10020] do_syscall_64+0x123/0x790 [ 183.913108][T10020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.913127][T10020] RIP: 0033:0x7f714399e1d9 [ 183.913143][T10020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.913160][T10020] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 183.913179][T10020] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 183.913192][T10020] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000200000000080 [ 183.913203][T10020] RBP: 00007f7143a35888 R08: 0000200000000140 R09: 0000000000000000 [ 183.913215][T10020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 183.913226][T10020] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 183.913252][T10020] [ 183.960318][ T5732] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 184.091711][ T5732] usb 10-1: device descriptor read/64, error -71 [ 184.201179][ T5732] usb usb10-port1: attempt power cycle [ 184.353779][T10029] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1372'. [ 184.550668][ T5732] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 184.573495][ T5732] usb 10-1: device descriptor read/8, error -71 [ 184.732854][T10046] fuse: fd is not a fuse device [ 184.788167][T10048] lo speed is unknown, defaulting to 1000 [ 184.810197][ T5732] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 184.832021][ T5732] usb 10-1: device descriptor read/8, error -71 [ 184.910613][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 184.910630][ T30] audit: type=1400 audit(1791688805.230:3235): avc: denied { read } for pid=10054 comm="syz.3.1382" name="sg0" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 184.910849][ T30] audit: type=1400 audit(1791688805.230:3236): avc: denied { open } for pid=10054 comm="syz.3.1382" path="/dev/sg0" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 184.915271][ T30] audit: type=1400 audit(1791688805.230:3237): avc: denied { append } for pid=10054 comm="syz.3.1382" name="sg0" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 184.940585][ T5732] usb usb10-port1: unable to enumerate USB device [ 185.642085][ T5609] Bluetooth: hci3: command 0x0406 tx timeout [ 185.642520][ T5609] Bluetooth: hci1: command 0x0406 tx timeout [ 185.642554][ T5609] Bluetooth: hci0: command 0x0406 tx timeout [ 185.643149][ T5609] Bluetooth: hci4: command 0x0406 tx timeout [ 186.966429][T10103] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input10 [ 187.079375][ T30] audit: type=1400 audit(1791688807.390:3238): avc: denied { create } for pid=10109 comm="syz.9.1400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 187.110194][ T30] audit: type=1400 audit(1791688807.400:3239): avc: denied { connect } for pid=10109 comm="syz.9.1400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 187.185233][T10113] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1402'. [ 187.658447][T10141] typec_fusb302 0-0002: I2C/SMBus block functionality not supported! [ 187.659453][T10141] i2c i2c-0: new_device: Instantiated device typec_fusb302 at 0x02 [ 187.747030][T10139] FAULT_INJECTION: forcing a failure. [ 187.747030][T10139] name failslab, interval 1, probability 0, space 0, times 0 [ 187.747066][T10139] CPU: 1 UID: 0 PID: 10139 Comm: syz.6.1408 Tainted: G L syzkaller #0 PREEMPT(full) [ 187.747093][T10139] Tainted: [L]=SOFTLOCKUP [ 187.747105][T10139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 187.747117][T10139] Call Trace: [ 187.747124][T10139] [ 187.747132][T10139] dump_stack_lvl+0x100/0x190 [ 187.747166][T10139] should_fail_ex.cold+0x5/0xa [ 187.747196][T10139] should_failslab+0xc2/0x120 [ 187.747225][T10139] __kmalloc_cache_noprof+0x91/0x6d0 [ 187.747247][T10139] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 187.747267][T10139] ? add_modify_gid+0x199/0xad0 [ 187.747298][T10139] add_modify_gid+0x199/0xad0 [ 187.747328][T10139] __ib_cache_gid_add+0x26d/0x3e0 [ 187.747354][T10139] ? __pfx___ib_cache_gid_add+0x10/0x10 [ 187.747393][T10139] ib_cache_gid_set_default_gid+0x2e1/0x350 [ 187.747422][T10139] ? __pfx_ib_cache_gid_set_default_gid+0x10/0x10 [ 187.747448][T10139] ? lock_acquire+0x1d1/0x380 [ 187.747486][T10139] enum_all_gids_of_dev_cb+0x21a/0x340 [ 187.747522][T10139] ib_enum_roce_netdev+0x1af/0x310 [ 187.747542][T10139] ? __pfx_pass_all_filter+0x10/0x10 [ 187.747567][T10139] ? __pfx_enum_all_gids_of_dev_cb+0x10/0x10 [ 187.747595][T10139] ? up_write+0x2dc/0x5b0 [ 187.747621][T10139] ib_cache_setup_one+0x39f/0x5f0 [ 187.747654][T10139] ib_register_device+0x6d1/0xdd0 [ 187.747679][T10139] rxe_register_device+0x277/0x360 [ 187.747704][T10139] rxe_net_add+0x95/0xf0 [ 187.747725][T10139] rxe_newlink+0x9c/0x160 [ 187.747743][T10139] nldev_newlink+0x3b0/0x630 [ 187.747773][T10139] ? __pfx_nldev_newlink+0x10/0x10 [ 187.747882][T10139] ? cred_has_capability.isra.0+0x186/0x300 [ 187.747913][T10139] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 187.747941][T10139] ? lock_acquire+0x1d1/0x380 [ 187.747975][T10139] ? cap_capable+0x107/0x430 [ 187.748002][T10139] ? security_capable+0x80/0x260 [ 187.748027][T10139] ? ns_capable+0xd2/0xf0 [ 187.748045][T10139] ? __pfx_nldev_newlink+0x10/0x10 [ 187.748074][T10139] rdma_nl_rcv_msg+0x392/0x6f0 [ 187.748108][T10139] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 187.748138][T10139] ? __lock_acquire+0x5c0/0x1f40 [ 187.748162][T10139] ? __netlink_lookup+0xa9/0x900 [ 187.748191][T10139] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 187.748221][T10139] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 187.748256][T10139] ? netlink_deliver_tap+0x1ae/0xcc0 [ 187.748287][T10139] netlink_unicast+0x585/0x850 [ 187.748318][T10139] ? __pfx_netlink_unicast+0x10/0x10 [ 187.748352][T10139] netlink_sendmsg+0x8b0/0xda0 [ 187.748383][T10139] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.748413][T10139] ? selinux_socket_sendmsg+0x198/0x2f0 [ 187.748443][T10139] ____sys_sendmsg+0xa4d/0xbe0 [ 187.748465][T10139] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.748496][T10139] ? __pfx_____sys_sendmsg+0x10/0x10 [ 187.748534][T10139] ___sys_sendmsg+0x190/0x1e0 [ 187.748561][T10139] ? __pfx____sys_sendmsg+0x10/0x10 [ 187.748587][T10139] ? futex_wait+0x11e/0x370 [ 187.748618][T10139] ? find_held_lock+0x2b/0x80 [ 187.748666][T10139] __sys_sendmsg+0x160/0x210 [ 187.748686][T10139] ? __pfx___sys_sendmsg+0x10/0x10 [ 187.748717][T10139] do_syscall_64+0x123/0x790 [ 187.748746][T10139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.748765][T10139] RIP: 0033:0x7f714399e1d9 [ 187.748780][T10139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.748798][T10139] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 187.748816][T10139] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 187.748828][T10139] RDX: 0000000020000800 RSI: 00002000000000c0 RDI: 0000000000000004 [ 187.748839][T10139] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 187.748850][T10139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 187.748861][T10139] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 187.748890][T10139] [ 187.760776][T10139] __ib_cache_gid_add: unable to add gid fe80:0000:0000:0000:a8aa:aaff:feaa:aa17 error=-12 [ 188.230206][T10139] infiniband syz1: set active [ 188.230227][T10139] infiniband syz1: added bond0 [ 188.282064][T10139] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 188.282101][T10139] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 188.282139][T10139] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 188.325723][T10139] RDS/IB: syz1: added [ 188.326160][T10139] smc: adding ib device syz1 with port count 1 [ 188.326248][T10139] smc: ib device syz1 port 1 has no pnetid [ 188.686125][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.686167][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.779797][ T30] audit: type=1400 audit(1791688809.090:3240): avc: denied { getopt } for pid=10173 comm="syz.3.1420" lport=37087 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 189.013498][T10183] fuse: fd is not a fuse device [ 189.173487][T10201] overlayfs: failed to clone upperpath [ 189.467791][ T30] audit: type=1400 audit(1791688809.780:3241): avc: denied { ioctl } for pid=10216 comm="syz.0.1432" path="socket:[28894]" dev="sockfs" ino=28894 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 190.928466][T10247] overlayfs: failed to clone upperpath [ 190.983382][T10249] ip_tables: iptables: counters copy to user failed while replacing table [ 191.009870][T10249] raw_sendmsg: syz.9.1445 forgot to set AF_INET. Fix it! [ 191.106429][T10254] fuse: fd is not a fuse device [ 191.107018][ T30] audit: type=1400 audit(1791688811.420:3242): avc: denied { read } for pid=10250 comm="syz.2.1446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 191.329486][T10263] af_packet: tpacket_rcv: packet too big, clamped from 4058 to 3956. macoff=92 [ 191.330359][T10265] erspan0: entered promiscuous mode [ 191.335515][T10265] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1451'. [ 191.335539][T10265] erspan0: left promiscuous mode [ 191.483344][ T30] audit: type=1400 audit(1791688811.800:3243): avc: denied { mount } for pid=10270 comm="syz.0.1454" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 191.750309][ T5732] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 191.768574][ T30] audit: type=1326 audit(1791688812.080:3244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10287 comm="syz.0.1463" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 191.768674][ T30] audit: type=1326 audit(1791688812.080:3245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10287 comm="syz.0.1463" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 191.769491][ T30] audit: type=1326 audit(1791688812.080:3246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10287 comm="syz.0.1463" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 191.932092][ T5732] usb 10-1: Using ep0 maxpacket: 8 [ 191.933861][ T5732] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 191.935036][ T5732] usb 10-1: config 0 has no interfaces? [ 191.935063][ T5732] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.975611][ T5732] usb 10-1: config 0 descriptor?? [ 192.114735][ T30] audit: type=1326 audit(1791688812.430:3247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10287 comm="syz.0.1463" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 192.114917][ T30] audit: type=1326 audit(1791688812.430:3248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10287 comm="syz.0.1463" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5ff9e1d9 code=0x7ffc0000 [ 192.200521][ T5732] usb 10-1: USB disconnect, device number 13 [ 192.769540][ T30] audit: type=1400 audit(1791688813.080:3249): avc: denied { read } for pid=10322 comm="syz.9.1478" name="event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 192.769853][ T30] audit: type=1400 audit(1791688813.080:3250): avc: denied { open } for pid=10322 comm="syz.9.1478" path="/dev/input/event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 193.013085][T10333] fuse: fd is not a fuse device [ 193.063752][T10335] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 193.215054][T10343] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1487'. [ 193.218530][ T30] audit: type=1400 audit(1791688813.530:3251): avc: denied { read } for pid=10342 comm="syz.6.1487" path="socket:[29064]" dev="sockfs" ino=29064 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 193.376474][T10345] kvm: Disabled LAPIC found during irq injection [ 193.407869][T10347] fuse: fd is not a fuse device [ 193.445100][T10349] fuse: fd is not a fuse device [ 193.618541][T10363] netlink: 52 bytes leftover after parsing attributes in process `syz.9.1495'. [ 193.630391][T10363] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.631143][T10363] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.641516][T10363] netlink: 52 bytes leftover after parsing attributes in process `syz.9.1495'. [ 193.724165][T10369] overlayfs: failed to clone upperpath [ 193.727797][ T52] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 193.727819][ T52] CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 193.727843][ T52] Tainted: [L]=SOFTLOCKUP [ 193.727854][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 193.727865][ T52] Workqueue: hci2 hci_rx_work [ 193.727888][ T52] Call Trace: [ 193.727894][ T52] [ 193.727902][ T52] dump_stack_lvl+0x100/0x190 [ 193.727930][ T52] sysfs_warn_dup.cold+0x1c/0x28 [ 193.727955][ T52] sysfs_create_dir_ns+0x24b/0x2b0 [ 193.727972][ T52] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 193.727991][ T52] ? find_held_lock+0x2b/0x80 [ 193.728014][ T52] ? kobject_add_internal+0x25f/0x930 [ 193.728037][ T52] ? kobject_add_internal+0x25f/0x930 [ 193.728056][ T52] ? do_raw_spin_unlock+0x145/0x1e0 [ 193.728080][ T52] kobject_add_internal+0x2c8/0x930 [ 193.728102][ T52] kobject_add+0x16a/0x1e0 [ 193.728119][ T52] ? __pfx_kobject_add+0x10/0x10 [ 193.728135][ T52] ? class_to_subsys+0x10f/0x150 [ 193.728160][ T52] ? kobject_put+0xb9/0x640 [ 193.728175][ T52] ? _raw_spin_unlock+0x28/0x50 [ 193.728204][ T52] device_add+0x294/0x1970 [ 193.728223][ T52] ? __pfx_dev_set_name+0x10/0x10 [ 193.728244][ T52] ? __pfx_device_add+0x10/0x10 [ 193.728262][ T52] ? mgmt_send_event_skb+0x2fb/0x460 [ 193.728288][ T52] hci_conn_add_sysfs+0x1a3/0x260 [ 193.728311][ T52] le_conn_complete_evt+0x122f/0x2130 [ 193.728337][ T52] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 193.728357][ T52] ? hci_event_packet+0x186/0xcd0 [ 193.728381][ T52] hci_le_conn_complete_evt+0x23c/0x3a0 [ 193.728401][ T52] ? skb_pull_data+0x15f/0x1e0 [ 193.728423][ T52] hci_le_meta_evt+0x34a/0x5f0 [ 193.728444][ T52] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 193.728467][ T52] hci_event_packet+0x51c/0xcd0 [ 193.728485][ T52] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 193.728505][ T52] ? __pfx_hci_event_packet+0x10/0x10 [ 193.728528][ T52] ? lockdep_hardirqs_on+0x7d/0x110 [ 193.728555][ T52] hci_rx_work+0x451/0xfc0 [ 193.728585][ T52] process_one_work+0xac7/0x1b10 [ 193.728624][ T52] ? __pfx_process_one_work+0x10/0x10 [ 193.728650][ T52] ? lock_acquire+0x1d1/0x380 [ 193.728675][ T52] ? __pfx_hci_rx_work+0x10/0x10 [ 193.728694][ T52] worker_thread+0x5ef/0xe50 [ 193.728719][ T52] ? kthread+0x13a/0x450 [ 193.728740][ T52] ? __pfx_worker_thread+0x10/0x10 [ 193.728754][ T52] kthread+0x373/0x450 [ 193.728775][ T52] ? __pfx_kthread+0x10/0x10 [ 193.728799][ T52] ret_from_fork+0x730/0xd60 [ 193.728820][ T52] ? __pfx_ret_from_fork+0x10/0x10 [ 193.728840][ T52] ? __switch_to+0x800/0x10f0 [ 193.728862][ T52] ? __pfx_kthread+0x10/0x10 [ 193.728887][ T52] ret_from_fork_asm+0x1a/0x30 [ 193.728916][ T52] [ 193.733609][ T52] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 193.733645][ T52] Bluetooth: hci2: failed to register connection device [ 194.217370][T10389] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 194.217446][T10389] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.253433][T10389] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 194.669487][ T5608] Bluetooth: hci1: unexpected event for opcode 0x2041 [ 194.967184][T10411] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 194.982272][T10411] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 195.353959][T10416] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1517'. [ 196.111748][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 196.111765][ T30] audit: type=1400 audit(1791688816.420:3254): avc: denied { mounton } for pid=10426 comm="syz.9.1523" path="/78/file0" dev="tmpfs" ino=419 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 196.930149][ T5732] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 197.080278][ T5732] usb 4-1: Using ep0 maxpacket: 32 [ 197.082948][ T5732] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 197.084150][ T5732] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 197.084172][ T5732] usb 4-1: config 0 has no interface number 0 [ 197.085876][ T5732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.085896][ T5732] usb 4-1: Product: syz [ 197.085909][ T5732] usb 4-1: Manufacturer: syz [ 197.085922][ T5732] usb 4-1: SerialNumber: syz [ 197.088192][ T5732] usb 4-1: config 0 descriptor?? [ 197.161595][ T5732] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 197.292637][ T5732] usb 4-1: qt2_attach - failed to power on unit: -71 [ 197.292842][ T5732] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 197.319020][ T5732] usb 4-1: USB disconnect, device number 9 [ 197.714780][ T30] audit: type=1326 audit(1791688818.030:3255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10484 comm="syz.2.1540" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0ac79e1d9 code=0x7ffc0000 [ 197.715499][ T30] audit: type=1326 audit(1791688818.030:3256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10484 comm="syz.2.1540" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0ac79e1d9 code=0x7ffc0000 [ 197.715619][ T30] audit: type=1326 audit(1791688818.030:3257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10484 comm="syz.2.1540" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fc0ac79e1d9 code=0x7ffc0000 [ 197.883972][ T30] audit: type=1326 audit(1791688818.200:3258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10484 comm="syz.2.1540" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0ac79e1d9 code=0x7ffc0000 [ 197.884162][ T30] audit: type=1326 audit(1791688818.200:3259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10484 comm="syz.2.1540" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0ac79e1d9 code=0x7ffc0000 [ 198.443682][T10506] hub 1-0:1.0: Interface 0 is not authorized for usage [ 198.445641][T10506] usbtest 1-0:1.0: Interface 0 is not authorized for usage [ 198.546027][T10509] overlayfs: failed to clone upperpath [ 198.912618][T10528] fuse: fd is not a fuse device [ 199.077269][T10536] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1563'. [ 199.947976][T10567] lo speed is unknown, defaulting to 1000 [ 200.732671][T10568] netlink: 'syz.9.1571': attribute type 4 has an invalid length. [ 200.990436][T10594] ip_tables: iptables: counters copy to user failed while replacing table [ 201.085700][T10603] rdma_rxe: rxe_newlink: failed to add bond0 [ 201.326316][T10610] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1585'. [ 201.700488][T10625] x_tables: duplicate underflow at hook 2 [ 201.708635][ T30] audit: type=1400 audit(1791688822.010:3260): avc: denied { setopt } for pid=10624 comm="syz.0.1591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 201.708679][ T30] audit: type=1400 audit(1791688822.010:3261): avc: denied { ioctl } for pid=10624 comm="syz.0.1591" path="socket:[30461]" dev="sockfs" ino=30461 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 201.845906][T10629] overlayfs: failed to clone upperpath [ 201.955552][T10631] bridge0: port 3(vlan2) entered blocking state [ 201.955636][T10631] bridge0: port 3(vlan2) entered disabled state [ 201.964070][T10631] vlan2: entered allmulticast mode [ 201.965384][T10631] vlan2: entered promiscuous mode [ 202.036273][T10642] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.069575][T10642] bridge_slave_1: left allmulticast mode [ 202.069599][T10642] bridge_slave_1: left promiscuous mode [ 202.069789][T10642] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.113927][T10642] bond0: (slave bond_slave_0): Releasing backup interface [ 202.129512][T10642] bond0: (slave bond_slave_1): Releasing backup interface [ 202.156487][T10642] team0: Port device team_slave_0 removed [ 202.175312][T10642] team0: Port device team_slave_1 removed [ 202.176041][T10642] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 202.176057][T10642] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 202.209412][T10642] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 202.318617][T10659] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1599'. [ 202.445975][T10663] SELinux: invalid class [ 202.461768][T10663] SELinux: failed to load policy [ 202.968909][ T30] audit: type=1400 audit(1791688823.280:3262): avc: denied { read } for pid=10687 comm="syz.6.1610" name="kmsg" dev="proc" ino=4026532047 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kmsg_t tclass=file permissive=1 [ 202.969496][ T30] audit: type=1400 audit(1791688823.280:3263): avc: denied { open } for pid=10687 comm="syz.6.1610" path="/185/proc/kmsg" dev="proc" ino=4026532047 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kmsg_t tclass=file permissive=1 [ 203.306897][T10693] bridge0: port 3(vlan2) entered blocking state [ 203.307020][T10693] bridge0: port 3(vlan2) entered disabled state [ 203.307112][T10693] vlan2: entered allmulticast mode [ 203.308580][T10693] vlan2: entered promiscuous mode [ 203.351183][T10693] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.363247][T10693] bridge_slave_1: left allmulticast mode [ 203.363270][T10693] bridge_slave_1: left promiscuous mode [ 203.366901][T10693] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.415953][ T30] audit: type=1400 audit(1791688823.730:3264): avc: denied { ioctl } for pid=10695 comm="syz.2.1622" path="socket:[30640]" dev="sockfs" ino=30640 ioctlcmd=0x7a8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 203.462628][T10693] bond0: (slave bond_slave_0): Releasing backup interface [ 203.490759][T10693] bond0: (slave bond_slave_1): Releasing backup interface [ 203.526530][T10693] team0: Port device team_slave_0 removed [ 203.546466][T10693] team0: Port device team_slave_1 removed [ 203.547045][T10693] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 203.547062][T10693] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 203.559662][T10693] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 203.734034][T10705] overlayfs: missing 'lowerdir' [ 203.795863][T10707] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1616'. [ 203.854041][ T30] audit: type=1400 audit(1791688824.170:3265): avc: denied { create } for pid=10712 comm="syz.9.1619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 203.883144][ T30] audit: type=1400 audit(1791688824.180:3266): avc: denied { write } for pid=10712 comm="syz.9.1619" path="socket:[30671]" dev="sockfs" ino=30671 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 204.085967][T10727] kAFS: unable to lookup cell 'ÿ' [ 204.208247][T10736] tipc: Started in network mode [ 204.208263][T10736] tipc: Node identity 4, cluster identity 4711 [ 204.208271][T10736] tipc: Node number set to 4 [ 204.778478][T10748] bridge0: port 3(vlan2) entered blocking state [ 204.778616][T10748] bridge0: port 3(vlan2) entered disabled state [ 204.778711][T10748] vlan2: entered allmulticast mode [ 204.802706][T10748] vlan2: entered promiscuous mode [ 204.803489][T10747] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 204.856478][T10748] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.873689][T10748] bridge_slave_1: left allmulticast mode [ 204.873714][T10748] bridge_slave_1: left promiscuous mode [ 204.873915][T10748] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.902301][T10748] bond0: (slave bond_slave_0): Releasing backup interface [ 204.911128][T10748] bond0: (slave bond_slave_1): Releasing backup interface [ 204.967221][T10748] team0: Port device team_slave_0 removed [ 204.993310][T10748] team0: Port device team_slave_1 removed [ 204.993781][T10748] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 204.993792][T10748] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 204.999626][T10748] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 204.999645][T10748] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 205.025645][T10748] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 205.084162][T10753] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1636'. [ 205.462764][T10771] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.533899][T10771] mac80211_hwsim hwsim17 wlan0: left promiscuous mode [ 205.535045][T10771] veth0_to_team: entered promiscuous mode [ 205.569877][T10771] bridge0: port 3(vlan2) entered blocking state [ 205.569977][T10771] bridge0: port 3(vlan2) entered forwarding state [ 206.108707][T10783] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 206.157490][T10790] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1648'. [ 206.324791][T10795] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input11 [ 206.542149][ T30] audit: type=1400 audit(1791688826.860:3267): avc: denied { getopt } for pid=10800 comm="syz.0.1653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 206.590270][ T5712] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 206.740557][ T5712] usb 10-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 206.741385][ T5712] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.741410][ T5712] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.741437][ T5712] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.744511][ T5712] usb 10-1: config 0 descriptor?? [ 207.153698][ T5712] hid_parser_main: 384 callbacks suppressed [ 207.153719][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153743][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153762][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153780][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153797][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153815][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.153833][ T5712] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 207.161249][ T5712] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.9-1/input0 [ 207.352597][ T5712] cp2112 0003:10C4:EA90.0003: error requesting version [ 207.374338][ T5712] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -32 [ 209.241870][ T30] audit: type=1400 audit(1791688829.550:3268): avc: denied { name_bind } for pid=10833 comm="syz.3.1664" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 209.242677][ T30] audit: type=1400 audit(1791688829.560:3269): avc: denied { name_connect } for pid=10833 comm="syz.3.1664" dest=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 209.502734][ T5334] usb 10-1: USB disconnect, device number 14 [ 209.802805][ T30] audit: type=1400 audit(1791688830.120:3270): avc: denied { shutdown } for pid=10855 comm="syz.2.1673" lport=55467 faddr=::ffff:100.1.1.0 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 211.979558][ T30] audit: type=1400 audit(1791688832.290:3271): avc: denied { audit_write } for pid=10894 comm="syz.9.1688" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 212.034803][ T30] audit: type=1400 audit(1791688832.350:3272): avc: denied { watch watch_reads } for pid=10894 comm="syz.9.1688" path="/proc/257/net" dev="proc" ino=30983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 212.512194][T10906] FAULT_INJECTION: forcing a failure. [ 212.512194][T10906] name failslab, interval 1, probability 0, space 0, times 0 [ 212.512230][T10906] CPU: 0 UID: 0 PID: 10906 Comm: syz.3.1692 Tainted: G L syzkaller #0 PREEMPT(full) [ 212.512259][T10906] Tainted: [L]=SOFTLOCKUP [ 212.512267][T10906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 212.512278][T10906] Call Trace: [ 212.512286][T10906] [ 212.512295][T10906] dump_stack_lvl+0x100/0x190 [ 212.512331][T10906] should_fail_ex.cold+0x5/0xa [ 212.512359][T10906] should_failslab+0xc2/0x120 [ 212.512390][T10906] __kmalloc_cache_noprof+0x91/0x6d0 [ 212.512412][T10906] ? netdev_init+0x151/0x3c0 [ 212.512442][T10906] netdev_init+0x151/0x3c0 [ 212.512466][T10906] ? __pfx_netdev_init+0x10/0x10 [ 212.512489][T10906] ops_init+0x1e2/0x5f0 [ 212.512512][T10906] setup_net+0x118/0x3a0 [ 212.512532][T10906] ? __pfx_setup_net+0x10/0x10 [ 212.512561][T10906] copy_net_ns+0x345/0x7a0 [ 212.512587][T10906] create_new_namespaces+0x3ea/0xac0 [ 212.512617][T10906] unshare_nsproxy_namespaces+0xf2/0x220 [ 212.512643][T10906] ksys_unshare+0x4a2/0xb30 [ 212.512665][T10906] ? __pfx_ksys_unshare+0x10/0x10 [ 212.512706][T10906] __x64_sys_unshare+0x31/0x40 [ 212.512730][T10906] do_syscall_64+0x123/0x790 [ 212.512760][T10906] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.512780][T10906] RIP: 0033:0x7f7416d9e1d9 [ 212.512798][T10906] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.512818][T10906] RSP: 002b:00007f7417c7f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 212.512838][T10906] RAX: ffffffffffffffda RBX: 00007f7417025fa0 RCX: 00007f7416d9e1d9 [ 212.512851][T10906] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 212.512863][T10906] RBP: 00007f7416e35888 R08: 0000000000000000 R09: 0000000000000000 [ 212.512875][T10906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 212.512886][T10906] R13: 00007f7417026038 R14: 00007f7417025fa0 R15: 00007ffe1dbc5488 [ 212.512913][T10906] [ 212.641767][T10908] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1693'. [ 212.783700][T10914] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1706'. [ 213.029810][ T30] audit: type=1400 audit(1791688833.340:3273): avc: denied { write } for pid=10926 comm="syz.3.1701" name="event1" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 213.309310][ T30] audit: type=1400 audit(1791688833.620:3274): avc: denied { shutdown } for pid=10931 comm="syz.9.1703" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.450913][T10936] FAULT_INJECTION: forcing a failure. [ 213.450913][T10936] name failslab, interval 1, probability 0, space 0, times 0 [ 213.450948][T10936] CPU: 0 UID: 0 PID: 10936 Comm: syz.3.1705 Tainted: G L syzkaller #0 PREEMPT(full) [ 213.450977][T10936] Tainted: [L]=SOFTLOCKUP [ 213.450984][T10936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 213.450996][T10936] Call Trace: [ 213.451002][T10936] [ 213.451010][T10936] dump_stack_lvl+0x100/0x190 [ 213.451045][T10936] should_fail_ex.cold+0x5/0xa [ 213.451073][T10936] should_failslab+0xc2/0x120 [ 213.451104][T10936] __kmalloc_noprof+0xfc/0x840 [ 213.451129][T10936] ? sk_prot_alloc+0x10b/0x2a0 [ 213.451157][T10936] sk_prot_alloc+0x10b/0x2a0 [ 213.451189][T10936] sk_alloc+0x36/0xe80 [ 213.451221][T10936] bt_sock_alloc+0x3b/0x3c0 [ 213.451245][T10936] rfcomm_sock_alloc.constprop.0+0x51/0x2a0 [ 213.451278][T10936] rfcomm_sock_create+0xf1/0x180 [ 213.451307][T10936] bt_sock_create+0x185/0x350 [ 213.451329][T10936] __sock_create+0x339/0x860 [ 213.451358][T10936] __sys_socket+0x14d/0x260 [ 213.451384][T10936] ? __pfx___sys_socket+0x10/0x10 [ 213.451419][T10936] __x64_sys_socket+0x72/0xb0 [ 213.451443][T10936] ? lockdep_hardirqs_on+0x7d/0x110 [ 213.451469][T10936] do_syscall_64+0x123/0x790 [ 213.451495][T10936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.451516][T10936] RIP: 0033:0x7f7416d9e1d9 [ 213.451530][T10936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.451547][T10936] RSP: 002b:00007f7417c7efc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 213.451565][T10936] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f7416d9e1d9 [ 213.451577][T10936] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 000000000000001f [ 213.451588][T10936] RBP: 00007f7416e35888 R08: 0000000000000000 R09: 0000000000000000 [ 213.451599][T10936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 213.451609][T10936] R13: 00007f7417026038 R14: 00007f7417025fa0 R15: 00007ffe1dbc5488 [ 213.451636][T10936] [ 213.588378][T10941] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1709'. [ 213.643346][ T30] audit: type=1400 audit(1791688833.960:3275): avc: denied { append } for pid=10937 comm="syz.9.1707" name="file0" dev="tmpfs" ino=541 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 213.858132][ T5712] lo speed is unknown, defaulting to 1000 [ 214.040812][T10948] FAULT_INJECTION: forcing a failure. [ 214.040812][T10948] name failslab, interval 1, probability 0, space 0, times 0 [ 214.040845][T10948] CPU: 1 UID: 0 PID: 10948 Comm: syz.6.1711 Tainted: G L syzkaller #0 PREEMPT(full) [ 214.040869][T10948] Tainted: [L]=SOFTLOCKUP [ 214.040876][T10948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 214.040887][T10948] Call Trace: [ 214.040894][T10948] [ 214.040902][T10948] dump_stack_lvl+0x100/0x190 [ 214.040934][T10948] should_fail_ex.cold+0x5/0xa [ 214.040957][T10948] should_failslab+0xc2/0x120 [ 214.040979][T10948] __kmalloc_noprof+0xfc/0x840 [ 214.040997][T10948] ? tomoyo_profile+0x47/0x60 [ 214.041011][T10948] ? tomoyo_supervisor+0x65d/0x1340 [ 214.041030][T10948] tomoyo_supervisor+0x65d/0x1340 [ 214.041049][T10948] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 214.041079][T10948] ? tomoyo_realpath_from_path+0x19c/0x690 [ 214.041105][T10948] ? tomoyo_check_path_number_acl+0x1e6/0x2f0 [ 214.041130][T10948] tomoyo_path_number_perm+0x445/0x580 [ 214.041151][T10948] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 214.041171][T10948] ? __pfx_futex_wait+0x10/0x10 [ 214.041192][T10948] ? __lock_acquire+0x5c0/0x1f40 [ 214.041219][T10948] ? __fget_files+0x34/0x3d0 [ 214.041241][T10948] ? find_held_lock+0x2b/0x80 [ 214.041262][T10948] ? hook_file_ioctl_common+0x140/0x440 [ 214.041284][T10948] ? __fget_files+0x21f/0x3d0 [ 214.041313][T10948] security_file_ioctl+0xd3/0x230 [ 214.041336][T10948] __x64_sys_ioctl+0xb7/0x210 [ 214.041355][T10948] do_syscall_64+0x123/0x790 [ 214.041388][T10948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.041404][T10948] RIP: 0033:0x7f714399e1d9 [ 214.041417][T10948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 214.041432][T10948] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 214.041448][T10948] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 214.041459][T10948] RDX: 0000000000000000 RSI: 00000000c0046686 RDI: 0000000000000003 [ 214.041468][T10948] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 214.041477][T10948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 214.041485][T10948] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 214.041506][T10948] [ 214.809557][ T6705] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 214.809591][ T6705] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.903973][ T6705] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 214.904008][ T6705] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.007693][ T30] audit: type=1400 audit(1791688835.320:3276): avc: denied { mounton } for pid=10960 comm="syz.0.1716" path="/file0" dev="autofs" ino=32148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 215.007816][T10963] overlay: filesystem on ./file0 not supported [ 215.114315][ T6705] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 215.114349][ T6705] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.335932][ T4918] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 215.349883][ T4918] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 215.358250][ T4918] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 215.367864][ T4918] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 215.378561][ T4918] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 215.416794][ T6705] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 215.416816][ T6705] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.665266][ T6705] vlan2: left allmulticast mode [ 215.665286][ T6705] bridge_slave_0: left allmulticast mode [ 215.665304][ T6705] vlan2: left promiscuous mode [ 215.665314][ T6705] bridge_slave_0: left promiscuous mode [ 215.665593][ T6705] bridge0: port 3(vlan2) entered disabled state [ 215.699792][ T6705] dvmrp0: left allmulticast mode [ 215.969544][ T6705] bond1 (unregistering): (slave ip6gre1): Releasing backup interface [ 215.969570][ T6705] ip6gre1 (unregistering): left promiscuous mode [ 216.112631][ T6705] bond0 (unregistering): Released all slaves [ 216.117864][ T6705] bond1 (unregistering): Released all slaves [ 216.131822][T10979] overlayfs: failed to clone upperpath [ 216.161110][ T6705] bond2 (unregistering): Released all slaves [ 216.355360][ T6705] tipc: Left network mode [ 216.727621][T10970] lo speed is unknown, defaulting to 1000 [ 217.018265][ T30] audit: type=1400 audit(1791688837.330:3277): avc: denied { write } for pid=10988 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 217.161345][ T5608] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 217.186050][ T30] audit: type=1400 audit(1791688837.500:3278): avc: denied { write } for pid=11005 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 217.347789][ T5262] 8021q: adding VLAN 0 to HW filter on device eth18 [ 217.480217][ T52] Bluetooth: hci6: command tx timeout [ 218.081624][ T6705] hsr_slave_0: left promiscuous mode [ 218.084734][ T6705] hsr_slave_1: left promiscuous mode [ 218.102870][ T6705] veth1_macvtap: left promiscuous mode [ 218.102918][ T6705] veth0_macvtap: left promiscuous mode [ 218.102999][ T6705] veth1_vlan: left promiscuous mode [ 218.103054][ T6705] veth0_vlan: left promiscuous mode [ 218.224913][ T30] audit: type=1400 audit(1791688838.540:3279): avc: denied { write } for pid=11022 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 218.446983][ T30] audit: type=1400 audit(1791688838.760:3280): avc: denied { write } for pid=11036 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 218.769350][ T5262] 8021q: adding VLAN 0 to HW filter on device eth20 [ 218.881975][T10970] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.882365][T10970] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.882460][T10970] bridge_slave_0: entered allmulticast mode [ 218.883814][T10970] bridge_slave_0: entered promiscuous mode [ 218.923826][T10970] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.923911][T10970] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.924023][T10970] bridge_slave_1: entered allmulticast mode [ 218.950683][T10970] bridge_slave_1: entered promiscuous mode [ 218.990808][T10970] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.004348][T10970] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.073259][ T6705] IPVS: stop unused estimator thread 0... [ 219.124277][T10970] team0: Port device team_slave_0 added [ 219.157171][T10970] team0: Port device team_slave_1 added [ 219.274516][T10970] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 219.274532][T10970] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 219.274554][T10970] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 219.293291][T10970] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 219.293309][T10970] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 219.293328][T10970] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 219.383936][T10970] hsr_slave_0: entered promiscuous mode [ 219.384668][T10970] hsr_slave_1: entered promiscuous mode [ 219.570251][ T52] Bluetooth: hci6: command tx timeout [ 219.638688][ T30] audit: type=1400 audit(1791688839.950:3281): avc: denied { write } for pid=11043 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 219.744059][ T30] audit: type=1400 audit(1791688840.060:3282): avc: denied { write } for pid=11054 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 219.796963][ T5262] 8021q: adding VLAN 0 to HW filter on device eth19 [ 220.073202][T10970] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 220.077241][T10970] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 220.078767][T10970] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 220.079235][ T30] audit: type=1400 audit(1791688840.390:3283): avc: denied { write } for pid=11057 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.081487][T10970] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 220.082933][T10970] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 220.094826][T10970] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 220.095403][T10970] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 220.119137][T10970] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 220.206908][ T30] audit: type=1400 audit(1791688840.520:3284): avc: denied { write } for pid=11074 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.237970][T10970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 220.255976][T10970] 8021q: adding VLAN 0 to HW filter on device team0 [ 220.262667][ T6705] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.262738][ T6705] bridge0: port 1(bridge_slave_0) entered forwarding state [ 220.277811][ T6648] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.277892][ T6648] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.324126][ T5262] 8021q: adding VLAN 0 to HW filter on device eth21 [ 220.579858][ T30] audit: type=1400 audit(1791688840.890:3285): avc: denied { write } for pid=11077 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.674791][ T30] audit: type=1400 audit(1791688840.990:3286): avc: denied { write } for pid=11097 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.678737][T10970] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.923769][T10970] veth0_vlan: entered promiscuous mode [ 220.931852][T10970] veth1_vlan: entered promiscuous mode [ 220.959170][T10970] veth0_macvtap: entered promiscuous mode [ 220.964072][T10970] veth1_macvtap: entered promiscuous mode [ 220.975692][T10970] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.986292][T10970] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 221.003478][ T6705] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.003990][ T6705] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.004491][ T6705] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.004523][ T6705] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.089095][ T30] audit: type=1400 audit(1791688841.400:3287): avc: denied { write } for pid=11102 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.132434][ T6644] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 221.132455][ T6644] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 221.185124][ T6705] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 221.185144][ T6705] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 221.188858][ T30] audit: type=1400 audit(1791688841.500:3288): avc: denied { write } for pid=11116 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.353393][T11123] FAULT_INJECTION: forcing a failure. [ 221.353393][T11123] name failslab, interval 1, probability 0, space 0, times 0 [ 221.353427][T11123] CPU: 0 UID: 0 PID: 11123 Comm: syz.6.1742 Tainted: G L syzkaller #0 PREEMPT(full) [ 221.353455][T11123] Tainted: [L]=SOFTLOCKUP [ 221.353462][T11123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 221.353474][T11123] Call Trace: [ 221.353481][T11123] [ 221.353488][T11123] dump_stack_lvl+0x100/0x190 [ 221.353520][T11123] should_fail_ex.cold+0x5/0xa [ 221.353551][T11123] should_failslab+0xc2/0x120 [ 221.353581][T11123] __kmalloc_noprof+0xfc/0x840 [ 221.353606][T11123] ? iter_file_splice_write+0x1d8/0x10b0 [ 221.353642][T11123] iter_file_splice_write+0x1d8/0x10b0 [ 221.353686][T11123] ? __pfx_iter_file_splice_write+0x10/0x10 [ 221.353715][T11123] ? __lock_acquire+0x5c0/0x1f40 [ 221.353739][T11123] ? shmem_file_splice_read+0x724/0xd80 [ 221.353784][T11123] ? __pfx_iter_file_splice_write+0x10/0x10 [ 221.353816][T11123] direct_splice_actor+0x192/0x690 [ 221.353849][T11123] splice_direct_to_actor+0x345/0xa30 [ 221.353881][T11123] ? __pfx_direct_splice_actor+0x10/0x10 [ 221.353917][T11123] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 221.353949][T11123] ? __pfx___file_has_perm+0x10/0x10 [ 221.353982][T11123] do_splice_direct+0x174/0x240 [ 221.354012][T11123] ? __pfx_do_splice_direct+0x10/0x10 [ 221.354042][T11123] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 221.354075][T11123] ? rw_verify_area+0xce/0x6d0 [ 221.354100][T11123] do_sendfile+0xadc/0xe20 [ 221.354128][T11123] ? __pfx_do_sendfile+0x10/0x10 [ 221.354160][T11123] __x64_sys_sendfile64+0x154/0x220 [ 221.354189][T11123] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 221.354224][T11123] do_syscall_64+0x123/0x790 [ 221.354254][T11123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.354274][T11123] RIP: 0033:0x7f714399e1d9 [ 221.354290][T11123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.354308][T11123] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 221.354328][T11123] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 221.354340][T11123] RDX: 0000200000001000 RSI: 0000000000000004 RDI: 0000000000000004 [ 221.354352][T11123] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 221.354362][T11123] R10: 000000000000ffff R11: 0000000000000246 R12: 0000000000000000 [ 221.354372][T11123] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 221.354398][T11123] [ 221.642207][ T52] Bluetooth: hci6: command tx timeout [ 221.839327][ T30] audit: type=1400 audit(1791688842.150:3289): avc: denied { write } for pid=11129 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.999333][ T30] audit: type=1400 audit(1791688842.310:3290): avc: denied { write } for pid=11151 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 222.034467][ T52] Bluetooth: hci5: unexpected cc 0x0c05 length: 4 > 1 [ 222.378925][T11172] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1738'. [ 222.420858][T11176] fuse: fd is not a fuse device [ 222.482373][ T30] audit: type=1400 audit(1791688842.800:3291): avc: denied { write } for pid=11161 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 222.594188][ T30] audit: type=1400 audit(1791688842.910:3292): avc: denied { write } for pid=11181 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.006070][T11199] ref_ctr_offset mismatch. inode: 0x909 offset: 0x0 ref_ctr_offset(old): 0x40000057f0006 ref_ctr_offset(new): 0x1000000210800 [ 223.352948][T11219] fuse: root generation should be zero [ 223.625231][T11233] FAULT_INJECTION: forcing a failure. [ 223.625231][T11233] name failslab, interval 1, probability 0, space 0, times 0 [ 223.625287][T11233] CPU: 1 UID: 0 PID: 11233 Comm: syz.9.1759 Tainted: G L syzkaller #0 PREEMPT(full) [ 223.625313][T11233] Tainted: [L]=SOFTLOCKUP [ 223.625320][T11233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 223.625331][T11233] Call Trace: [ 223.625337][T11233] [ 223.625345][T11233] dump_stack_lvl+0x100/0x190 [ 223.625378][T11233] should_fail_ex.cold+0x5/0xa [ 223.625405][T11233] should_failslab+0xc2/0x120 [ 223.625434][T11233] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 223.625460][T11233] ? __lock_acquire+0x5c0/0x1f40 [ 223.625483][T11233] ? __alloc_skb+0x140/0x710 [ 223.625508][T11233] __alloc_skb+0x140/0x710 [ 223.625526][T11233] ? __pfx___alloc_skb+0x10/0x10 [ 223.625543][T11233] ? lock_acquire+0x1d1/0x380 [ 223.625565][T11233] ? do_raw_write_lock+0x11e/0x260 [ 223.625596][T11233] tipc_buf_acquire+0x26/0xe0 [ 223.625621][T11233] named_prepare_buf+0x29/0x170 [ 223.625648][T11233] tipc_named_publish+0x1f2/0x760 [ 223.625678][T11233] tipc_nametbl_publish+0x1d5/0x300 [ 223.625702][T11233] tipc_sk_publish+0x1d8/0x430 [ 223.625723][T11233] ? __pfx_tipc_sk_publish+0x10/0x10 [ 223.625744][T11233] ? __local_bh_enable_ip+0xa5/0x120 [ 223.625769][T11233] tipc_sk_bind+0x16f/0x380 [ 223.625792][T11233] tipc_bind+0x18d/0x280 [ 223.625814][T11233] __sys_bind+0x1a9/0x260 [ 223.625841][T11233] ? __pfx___sys_bind+0x10/0x10 [ 223.625885][T11233] __x64_sys_bind+0x72/0xb0 [ 223.625910][T11233] ? lockdep_hardirqs_on+0x7d/0x110 [ 223.625938][T11233] do_syscall_64+0x123/0x790 [ 223.625968][T11233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.625988][T11233] RIP: 0033:0x7fafc859e1d9 [ 223.626003][T11233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.626021][T11233] RSP: 002b:00007fafc951e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 223.626040][T11233] RAX: ffffffffffffffda RBX: 00007fafc8825fa0 RCX: 00007fafc859e1d9 [ 223.626052][T11233] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 0000000000000003 [ 223.626064][T11233] RBP: 00007fafc8635888 R08: 0000000000000000 R09: 0000000000000000 [ 223.626075][T11233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 223.626086][T11233] R13: 00007fafc8826038 R14: 00007fafc8825fa0 R15: 00007ffec2570d98 [ 223.626114][T11233] [ 223.626122][T11233] tipc: Publication distribution failure [ 223.735220][ T52] Bluetooth: hci6: command tx timeout [ 223.895875][ T5602] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 224.050293][ T5602] usb 5-1: Using ep0 maxpacket: 8 [ 224.051916][ T5602] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 224.056210][ T5602] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 224.056232][ T5602] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 224.056253][ T5602] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 224.056273][ T5602] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 224.056303][ T5602] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.338048][ T5602] usb 5-1: GET_CAPABILITIES returned 0 [ 224.338084][ T5602] usbtmc 5-1:16.0: can't read capabilities [ 224.548055][ T5602] usb 5-1: USB disconnect, device number 5 [ 224.730148][T11272] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1773'. [ 224.986448][ T9167] block nbd64: NBD_DISCONNECT [ 225.092702][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 225.092720][ T30] audit: type=1326 audit(1791688845.410:3296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11284 comm="syz.9.1775" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fafc859e1d9 code=0x0 [ 225.231731][ T30] audit: type=1400 audit(1791688845.550:3297): avc: denied { write } for pid=11287 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.076850][ T30] audit: type=1400 audit(1791688846.390:3298): avc: denied { write } for pid=11303 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.106592][T11328] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1785'. [ 226.248596][ T30] audit: type=1400 audit(1791688846.560:3299): avc: denied { write } for pid=11334 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.279025][T11336] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1787'. [ 226.494169][T11346] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 226.494186][T11346] IPv6: NLM_F_CREATE should be set when creating new route [ 226.611151][T11350] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1795'. [ 226.614186][T11350] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1795'. [ 226.751900][T11358] FAULT_INJECTION: forcing a failure. [ 226.751900][T11358] name fail_futex, interval 1, probability 0, space 0, times 0 [ 226.751934][T11358] CPU: 1 UID: 0 PID: 11358 Comm: syz.9.1796 Tainted: G L syzkaller #0 PREEMPT(full) [ 226.751962][T11358] Tainted: [L]=SOFTLOCKUP [ 226.751969][T11358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 226.751981][T11358] Call Trace: [ 226.751988][T11358] [ 226.751996][T11358] dump_stack_lvl+0x100/0x190 [ 226.752028][T11358] should_fail_ex.cold+0x5/0xa [ 226.752054][T11358] get_futex_key+0x1d0/0x14f0 [ 226.752082][T11358] ? __pfx_get_futex_key+0x10/0x10 [ 226.752112][T11358] ? ___sys_sendmsg+0x127/0x1e0 [ 226.752143][T11358] futex_wake+0xf4/0x5e0 [ 226.752160][T11358] ? futex_wait+0x11e/0x370 [ 226.752182][T11358] ? __pfx_futex_wake+0x10/0x10 [ 226.752206][T11358] ? find_held_lock+0x2b/0x80 [ 226.752241][T11358] do_futex+0x2b2/0x440 [ 226.752270][T11358] ? __pfx_do_futex+0x10/0x10 [ 226.752299][T11358] ? fput+0x7c/0x100 [ 226.752329][T11358] __x64_sys_futex+0x34f/0x4d0 [ 226.752360][T11358] ? __pfx___x64_sys_futex+0x10/0x10 [ 226.752398][T11358] do_syscall_64+0x123/0x790 [ 226.752428][T11358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.752447][T11358] RIP: 0033:0x7fafc859e1d9 [ 226.752462][T11358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.752479][T11358] RSP: 002b:00007fafc951e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 226.752497][T11358] RAX: ffffffffffffffda RBX: 00007fafc8825fa8 RCX: 00007fafc859e1d9 [ 226.752509][T11358] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fafc8825fac [ 226.752520][T11358] RBP: 00007fafc8825fa0 R08: 0000000000000001 R09: 0000000000000000 [ 226.752530][T11358] R10: 0000000000000064 R11: 0000000000000246 R12: 0000000000000000 [ 226.752541][T11358] R13: 00007fafc8826038 R14: 00007ffec2570cb0 R15: 00007ffec2570d98 [ 226.752575][T11358] [ 227.000668][ T9] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 227.065673][T11369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 227.171585][ T9] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 227.172617][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.185404][ T9] usb 5-1: config 0 descriptor?? [ 227.193112][ T9] cp210x 5-1:0.0: cp210x converter detected [ 227.513850][ T30] audit: type=1400 audit(1791688847.830:3300): avc: denied { write } for pid=11347 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 227.609632][ T9] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 227.616914][ T9] cp210x 5-1:0.0: failed to get vendor val 0x3711 size 2: -71 [ 227.616939][ T9] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 227.633647][ T9] usb 5-1: cp210x converter now attached to ttyUSB0 [ 227.645152][ T9] usb 5-1: USB disconnect, device number 6 [ 227.683349][ T30] audit: type=1400 audit(1791688848.000:3301): avc: denied { write } for pid=11388 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 227.683794][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 227.684246][ T9] cp210x 5-1:0.0: device disconnected [ 228.218977][ T30] audit: type=1400 audit(1791688848.530:3302): avc: denied { write } for pid=11392 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 228.341028][ T30] audit: type=1400 audit(1791688848.660:3303): avc: denied { write } for pid=11414 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 228.896451][T11442] netlink: 256 bytes leftover after parsing attributes in process `syz.6.1814'. [ 228.916001][T11442] unsupported nlmsg_type 40 [ 229.160355][ T9] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 229.326392][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 229.326421][ T9] usb 5-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=60.1b [ 229.328798][ T9] usb 5-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 229.332325][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.332346][ T9] usb 5-1: Product: syz [ 229.332357][ T9] usb 5-1: Manufacturer: syz [ 229.332370][ T9] usb 5-1: SerialNumber: syz [ 229.586169][ T30] audit: type=1400 audit(1791688849.900:3304): avc: denied { write } for pid=11433 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 229.700786][ T30] audit: type=1400 audit(1791688850.020:3305): avc: denied { ioctl } for pid=11461 comm="syz.6.1818" path="/dev/binderfs/binder0" dev="binder" ino=7 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 229.778348][T11466] fuse: fd is not a fuse device [ 229.803533][T11462] binder: 11461:11462 ioctl c0306201 200000000040 returned -14 [ 230.519995][T11495] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1827'. [ 230.694351][T11500] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 230.694420][T11500] syzkaller0: entered promiscuous mode [ 230.694436][T11500] syzkaller0: entered allmulticast mode [ 230.885153][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 230.885187][ T30] audit: type=1400 audit(1791688851.200:3308): avc: denied { write } for pid=11473 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 230.962528][T11504] fuse: fd is not a fuse device [ 230.970458][T11504] overlayfs: failed to clone upperpath [ 231.074776][T11510] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1832'. [ 231.106587][T11510] bond2: peer notification delay (2365) is not a multiple of miimon (80), value rounded to 2320 ms [ 231.131046][T11510] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1832'. [ 231.131075][T11510] bond2: peer notification delay (2365) is not a multiple of miimon (80), value rounded to 2320 ms [ 231.226240][T11516] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1833'. [ 231.266339][T11516] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 231.266356][T11516] IPv6: NLM_F_CREATE should be set when creating new route [ 231.267241][T11516] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1833'. [ 231.346174][ T30] audit: type=1400 audit(1791688851.660:3309): avc: denied { write } for pid=11513 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 231.487997][T11520] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1834'. [ 231.720365][ T5608] Bluetooth: hci2: command 0x0406 tx timeout [ 231.828368][ T9] usb 5-1: USB disconnect, device number 7 [ 232.353971][T11565] netlink: 'syz.4.1845': attribute type 4 has an invalid length. [ 232.446410][ T30] audit: type=1400 audit(1791688852.760:3310): avc: denied { write } for pid=11521 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 232.634015][ T30] audit: type=1400 audit(1791688852.950:3311): avc: denied { setopt } for pid=11582 comm="syz.6.1851" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 232.659933][ T30] audit: type=1400 audit(1791688852.950:3312): avc: denied { write } for pid=11578 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 232.900328][T11591] netlink: 'syz.2.1853': attribute type 1 has an invalid length. [ 232.955880][T11591] bond3: entered promiscuous mode [ 232.957391][T11591] 8021q: adding VLAN 0 to HW filter on device bond3 [ 233.062159][T11591] 8021q: adding VLAN 0 to HW filter on device bond3 [ 233.062466][T11591] bond3: (slave ipip1): The slave device specified does not support setting the MAC address [ 233.062484][T11591] bond3: (slave ipip1): Setting fail_over_mac to active for active-backup mode [ 233.071079][T11591] bond3: (slave ipip1): making interface the new active one [ 233.071100][T11591] ipip1: entered promiscuous mode [ 233.097510][T11591] bond3: (slave ipip1): Enslaving as an active interface with an up link [ 233.140789][T11598] FAULT_INJECTION: forcing a failure. [ 233.140789][T11598] name failslab, interval 1, probability 0, space 0, times 0 [ 233.140823][T11598] CPU: 1 UID: 0 PID: 11598 Comm: syz.6.1855 Tainted: G L syzkaller #0 PREEMPT(full) [ 233.140848][T11598] Tainted: [L]=SOFTLOCKUP [ 233.140855][T11598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 233.140866][T11598] Call Trace: [ 233.140872][T11598] [ 233.140880][T11598] dump_stack_lvl+0x100/0x190 [ 233.140914][T11598] should_fail_ex.cold+0x5/0xa [ 233.140941][T11598] should_failslab+0xc2/0x120 [ 233.140969][T11598] kmem_cache_alloc_noprof+0x92/0x6a0 [ 233.140996][T11598] ? op_alloc+0x2b/0x4e0 [ 233.141028][T11598] op_alloc+0x2b/0x4e0 [ 233.141056][T11598] orangefs_get_tree+0xf9/0x1080 [ 233.141084][T11598] ? __pfx_orangefs_get_tree+0x10/0x10 [ 233.141105][T11598] ? rcu_is_watching+0x13/0xc0 [ 233.141129][T11598] ? cap_capable+0x107/0x430 [ 233.141152][T11598] ? bpf_lsm_capable+0x9/0x10 [ 233.141174][T11598] vfs_get_tree+0x92/0x320 [ 233.141194][T11598] vfs_cmd_create+0xd7/0x2a0 [ 233.141218][T11598] __do_sys_fsconfig+0x55a/0xcb0 [ 233.141241][T11598] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 233.141276][T11598] do_syscall_64+0x123/0x790 [ 233.141306][T11598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.141326][T11598] RIP: 0033:0x7f714399e1d9 [ 233.141342][T11598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.141360][T11598] RSP: 002b:00007f71447b7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 233.141380][T11598] RAX: ffffffffffffffda RBX: 00007f7143c25fa0 RCX: 00007f714399e1d9 [ 233.141394][T11598] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 233.141405][T11598] RBP: 00007f7143a35888 R08: 0000000000000000 R09: 0000000000000000 [ 233.141417][T11598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 233.141428][T11598] R13: 00007f7143c26038 R14: 00007f7143c25fa0 R15: 00007fff8ec558a8 [ 233.141455][T11598] [ 233.141463][T11598] op_alloc: kmem_cache_zalloc failed! [ 233.569780][ T30] audit: type=1807 audit(1791688853.880:3313): action=measure uid>1 res=1 [ 233.594627][T11609] ima: policy update completed [ 233.594777][ T30] audit: type=1802 audit(1791688853.910:3314): pid=11609 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=completed comm="syz.6.1858" res=1 errno=0 [ 234.470132][ T5334] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 234.620182][ T5334] usb 10-1: Using ep0 maxpacket: 8 [ 234.620679][ T5334] usb 10-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.00 [ 234.621553][ T5334] usb 10-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 234.621582][ T5334] usb 10-1: config 0 interface 0 has no altsetting 0 [ 234.621609][ T5334] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.625049][ T5334] usb 10-1: config 0 descriptor?? [ 234.707831][T11652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1873'. [ 234.865364][T11664] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 234.865427][T11664] syzkaller0: entered promiscuous mode [ 234.865443][T11664] syzkaller0: entered allmulticast mode [ 234.978796][ T5334] usbhid 10-1:0.0: can't add hid device: -71 [ 234.978879][ T5334] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 234.998246][ T5334] usb 10-1: USB disconnect, device number 15 [ 235.268091][ T30] audit: type=1400 audit(1791688855.580:3315): avc: denied { bind } for pid=11671 comm="syz.4.1880" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 235.290700][ T30] audit: type=1400 audit(1791688855.610:3316): avc: denied { read } for pid=11671 comm="syz.4.1880" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 236.207602][T11691] syz_tun: entered allmulticast mode [ 236.222786][T11690] syz_tun: left allmulticast mode [ 237.080222][ T30] audit: type=1400 audit(1791688857.390:3317): avc: denied { write } for pid=11701 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 237.262135][ T30] audit: type=1400 audit(1791688857.580:3318): avc: denied { write } for pid=11712 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 237.386126][T11718] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1895'. [ 237.386813][T11718] veth0_macvtap: Caught tx_queue_len zero misconfig [ 237.492539][T11724] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1891'. [ 237.606156][T11733] ./dev: Can't lookup blockdev [ 237.805941][T11735] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 237.806004][T11735] syzkaller0: entered promiscuous mode [ 237.806019][T11735] syzkaller0: entered allmulticast mode [ 238.046479][T11752] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 238.063127][T11752] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 238.200927][T11756] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1909'. [ 238.256642][T11759] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1909'. [ 238.288173][T11759] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 238.477772][T11769] FAULT_INJECTION: forcing a failure. [ 238.477772][T11769] name failslab, interval 1, probability 0, space 0, times 0 [ 238.477807][T11769] CPU: 1 UID: 0 PID: 11769 Comm: syz.9.1912 Tainted: G L syzkaller #0 PREEMPT(full) [ 238.477833][T11769] Tainted: [L]=SOFTLOCKUP [ 238.477839][T11769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 238.477851][T11769] Call Trace: [ 238.477858][T11769] [ 238.477866][T11769] dump_stack_lvl+0x100/0x190 [ 238.477897][T11769] should_fail_ex.cold+0x5/0xa [ 238.477924][T11769] should_failslab+0xc2/0x120 [ 238.477951][T11769] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 238.477979][T11769] ? nfs_get_tree+0x76c/0x1450 [ 238.478003][T11769] kmemdup_nul+0x49/0xd0 [ 238.478032][T11769] nfs_get_tree+0x76c/0x1450 [ 238.478059][T11769] vfs_get_tree+0x92/0x320 [ 238.478080][T11769] vfs_cmd_create+0xd7/0x2a0 [ 238.478103][T11769] __do_sys_fsconfig+0x55a/0xcb0 [ 238.478129][T11769] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 238.478166][T11769] do_syscall_64+0x123/0x790 [ 238.478196][T11769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.478216][T11769] RIP: 0033:0x7fafc859e1d9 [ 238.478232][T11769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.478250][T11769] RSP: 002b:00007fafc951e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 238.478269][T11769] RAX: ffffffffffffffda RBX: 00007fafc8825fa0 RCX: 00007fafc859e1d9 [ 238.478281][T11769] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 238.478292][T11769] RBP: 00007fafc8635888 R08: 0000000000000000 R09: 0000000000000000 [ 238.478303][T11769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 238.478313][T11769] R13: 00007fafc8826038 R14: 00007fafc8825fa0 R15: 00007ffec2570d98 [ 238.478340][T11769] [ 238.618058][ T30] audit: type=1400 audit(1791688858.920:3319): avc: denied { getopt } for pid=11774 comm="syz.4.1915" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 239.152902][ T189] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 239.289965][T11797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1924'. [ 239.289984][T11797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1924'. [ 239.320642][ T189] usb 10-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 239.322874][ T189] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 239.322902][ T189] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 239.326917][ T189] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.326939][ T189] usb 10-1: Product: syz [ 239.326952][ T189] usb 10-1: Manufacturer: syz [ 239.326965][ T189] usb 10-1: SerialNumber: syz [ 239.330909][T11788] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 239.331016][T11788] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 239.332416][ T189] usbserial_generic 10-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 239.332432][ T189] usbserial_generic 10-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 239.332460][ T189] usbserial_generic 10-1:1.0: generic converter detected [ 239.412279][ T189] usb 10-1: generic converter now attached to ttyUSB0 [ 239.586172][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 239.647660][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 239.647727][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 239.666563][ T189] usb 10-1: USB disconnect, device number 16 [ 239.689751][ T189] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 239.695448][ T189] usbserial_generic 10-1:1.0: device disconnected [ 240.330325][T11824] FAULT_INJECTION: forcing a failure. [ 240.330325][T11824] name fail_futex, interval 1, probability 0, space 0, times 0 [ 240.330358][T11824] CPU: 0 UID: 0 PID: 11824 Comm: syz.9.1933 Tainted: G L syzkaller #0 PREEMPT(full) [ 240.330385][T11824] Tainted: [L]=SOFTLOCKUP [ 240.330392][T11824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 240.330403][T11824] Call Trace: [ 240.330410][T11824] [ 240.330417][T11824] dump_stack_lvl+0x100/0x190 [ 240.330448][T11824] should_fail_ex.cold+0x5/0xa [ 240.330473][T11824] get_futex_key+0x1d0/0x14f0 [ 240.330509][T11824] ? __pfx_get_futex_key+0x10/0x10 [ 240.330542][T11824] futex_wait_setup+0x91/0x540 [ 240.330569][T11824] __futex_wait+0x19f/0x300 [ 240.330591][T11824] ? __pfx___futex_wait+0x10/0x10 [ 240.330609][T11824] ? __pfx_try_to_wake_up+0x10/0x10 [ 240.330630][T11824] ? futex_hash+0x311/0x400 [ 240.330656][T11824] ? __pfx_futex_wake_mark+0x10/0x10 [ 240.330680][T11824] ? find_held_lock+0x2b/0x80 [ 240.330707][T11824] ? futex_wake+0x4ea/0x5e0 [ 240.330732][T11824] futex_wait+0xe6/0x370 [ 240.330752][T11824] ? __pfx_futex_wait+0x10/0x10 [ 240.330777][T11824] ? putname+0xb1/0x110 [ 240.330792][T11824] ? kmem_cache_free+0x127/0x6c0 [ 240.330817][T11824] do_futex+0x265/0x440 [ 240.330843][T11824] ? __pfx_do_futex+0x10/0x10 [ 240.330868][T11824] ? __pfx_do_sys_openat2+0x10/0x10 [ 240.330892][T11824] __x64_sys_futex+0x34f/0x4d0 [ 240.330919][T11824] ? __x64_sys_openat+0x12d/0x210 [ 240.330937][T11824] ? __pfx___x64_sys_futex+0x10/0x10 [ 240.330975][T11824] do_syscall_64+0x123/0x790 [ 240.331003][T11824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.331023][T11824] RIP: 0033:0x7fafc859e1d9 [ 240.331039][T11824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.331057][T11824] RSP: 002b:00007fafc951e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 240.331077][T11824] RAX: ffffffffffffffda RBX: 00007fafc8825fa8 RCX: 00007fafc859e1d9 [ 240.331089][T11824] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fafc8825fa8 [ 240.331100][T11824] RBP: 00007fafc8825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 240.331111][T11824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.331122][T11824] R13: 00007fafc8826038 R14: 00007ffec2570cb0 R15: 00007ffec2570d98 [ 240.331149][T11824] [ 240.610123][ T9] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 240.810724][ T9] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 240.811340][ T9] usb 7-1: config 0 has no interfaces? [ 240.812491][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 240.812512][ T9] usb 7-1: SerialNumber: syz [ 240.819012][ T9] usb 7-1: config 0 descriptor?? [ 240.888331][ T30] audit: type=1400 audit(1791688861.200:3320): avc: denied { write } for pid=11837 comm="syz.4.1938" name="usb_gadget" dev="configfs" ino=3376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 240.913769][ T30] audit: type=1400 audit(1791688861.210:3321): avc: denied { write } for pid=11837 comm="syz.4.1938" name="functions" dev="configfs" ino=35708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 241.041922][ T9] usb 7-1: USB disconnect, device number 9 [ 241.167725][T11854] jffs2: notice: (11854) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 2 orphan) and 2 of xref (0 dead, 2 orphan) found. [ 241.365827][T11867] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1947'. [ 241.792376][T11882] netlink: 'syz.2.1953': attribute type 2 has an invalid length. [ 241.792396][T11882] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1953'. [ 241.851231][T11882] : entered promiscuous mode [ 241.903696][T11882] netlink: 'syz.2.1953': attribute type 2 has an invalid length. [ 241.903717][T11882] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1953'. [ 242.015496][T11887] lo speed is unknown, defaulting to 1000 [ 243.415614][ T30] audit: type=1400 audit(1791688863.730:3322): avc: denied { read } for pid=11927 comm="syz.4.1964" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 243.701260][ T1214] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 243.713929][T11934] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1966'. [ 243.729128][ T31] INFO: task syz.1.452:7025 blocked for more than 143 seconds. [ 243.729150][ T31] Tainted: G L syzkaller #0 [ 243.729161][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 243.729169][ T31] task:syz.1.452 state:D stack:27944 pid:7025 tgid:7017 ppid:5600 task_flags:0x400040 flags:0x00080002 [ 243.729229][ T31] Call Trace: [ 243.729235][ T31] [ 243.729246][ T31] __schedule+0x1259/0x6920 [ 243.729273][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 243.729302][ T31] ? do_raw_spin_lock+0x128/0x260 [ 243.729332][ T31] ? lock_acquire+0x1d1/0x380 [ 243.729354][ T31] ? __pfx___schedule+0x10/0x10 [ 243.729376][ T31] ? find_held_lock+0x2b/0x80 [ 243.729404][ T31] ? schedule+0x225/0x2c0 [ 243.729431][ T31] schedule+0xdd/0x2c0 [ 243.729453][ T31] schedule_preempt_disable ** replaying previous printk message ** [ 243.729453][ T31] schedule_preempt_disabled+0x13/0x30 [ 243.729477][ T31] __mutex_lock+0xccb/0x1bd0 [ 243.729504][ T31] ? write_versions+0x9d/0xba0 [ 243.729528][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 243.729560][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 243.729585][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 243.729613][ T31] ? write_versions+0x9d/0xba0 [ 243.729630][ T31] write_versions+0x9d/0xba0 [ 243.729648][ T31] ? find_held_lock+0x2b/0x80 [ 243.729677][ T31] ? __pfx_write_versions+0x10/0x10 [ 243.729698][ T31] ? __pfx_write_versions+0x10/0x10 [ 243.729718][ T31] ? _copy_from_user+0x59/0xd0 [ 243.729747][ T31] ? __pfx_write_versions+0x10/0x10 [ 243.729764][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 243.729811][ T31] vfs_write+0x2aa/0x1050 [ 243.729836][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 243.729864][ T31] ? lock_acquire+0x1d1/0x380 [ 243.729884][ T31] ? __fget_files+0x34/0x3d0 [ 243.729910][ T31] ? __pfx_vfs_write+0x10/0x10 [ 243.729931][ T31] ? find_held_lock+0x2b/0x80 [ 243.729963][ T31] ? __fget_files+0x215/0x3d0 [ 243.729994][ T31] ? __fget_files+0x21f/0x3d0 [ 243.766904][ T31] ksys_write+0x12a/0x250 [ 243.766938][ T31] ? __pfx_ksys_write+0x10/0x10 [ 243.766975][ T31] do_syscall_64+0x123/0x790 [ 243.767004][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.767020][ T31] RIP: 0033:0x7f82ee79e1d9 [ 243.767033][ T31] RSP: 002b:00007f82ec9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 243.767048][ T31] RAX: ffffffffffffffda RBX: 00007f82eea26090 RCX: 00007f82ee79e1d9 [ 243.767058][ T31] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 0000000000000004 [ 243.767067][ T31] RBP: 00007f82ee835888 R08: 0000000000000000 R09: 0000000000000000 [ 243.767076][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 243.767085][ T31] R13: 00007f82eea26128 R14: 00007f82eea26090 R15: 00007ffcca681948 [ 243.767107][ T31] [ 243.767160][ T31] [ 243.767160][ T31] Showing all locks held in the system: [ 243.767168][ T31] locks held by pr/ttyS0/16: 1, last CPU#1: [ 243.767179][ T31] #0: ffffffff8fdd88b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 [ 243.767224][ T31] locks held by khungtaskd/31: 1, last CPU#1: [ 243.767234][ T31] #0: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 243.800544][ T31] locks held by kworker/1:2/1214: 6, on CPU#1: [ 243.800557][ T31] #0: ffff888024ee8140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 243.800603][ T31] #1: ffffc9000558fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 243.800647][ T31] #2: ffff88802ca5d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 243.800695][ T31] #3: ffff88802ca99568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 243.800732][ T31] #4: ffff88802c9fc460 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 243.800769][ T31] #5: ffffffff91284388 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 243.800824][ T31] locks held by getty/5360: 2, on CPU#0: [ 243.800834][ T31] #0: ffff8880398030a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 243.800876][ T31] #1: ffffc9000323b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 243.800922][ T31] locks held by kworker/u8:10/6644: 7, last CPU#0: [ 243.800933][ T31] #0: ffff88801e2e0940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 243.800976][ T31] #1: ffffc900036cfd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 243.801019][ T31] #2: ffffffff91cbcf88 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 [ 243.801057][ T31] #3: ffff88801e2c72a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 [ 243.801100][ T31] #4: ffff88801e2c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 [ 243.801140][ T31] #5: ffff88801e2c7210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: __kernfs_remove+0x3fe/0xb80 [ 243.801177][ T31] #6: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: kernfs_root+0x23/0x2a0 [ 243.801215][ T31] locks held by syz.1.452/7019: 3, on CPU#0: [ 243.801225][ T31] #0: ffff8880310190b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 243.801260][ T31] #1: ffff88807a62c460 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 243.801303][ T31] #2: ffffffff90289ca0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 243.801338][ T31] locks held by syz.1.452/7025: 3, on CPU#1: [ 243.801348][ T31] #0: ffff888035b215f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 243.801382][ T31] #1: ffff88807a62c460 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 243.801424][ T31] #2: ffffffff90289ca0 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x9d/0xba0 [ 243.801467][ T31] locks held by syz-executor/8706: 4, last CPU#0: [ 243.801478][ T31] #0: ffffffff8ff3de10 (dup_mmap_sem){++++}-{0:0}, at: copy_process+0x4816/0x8380 [ 243.801516][ T31] #1: ffff888068672800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 [ 243.801558][ T31] #2: ffff888054228340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 [ 243.801604][ T31] #3: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 243.801653][ T31] locks held by syz.2.1958/11912: 3, last CPU#0: [ 243.801663][ T31] #0: ffff8880566b8460 (sb_writers#6){.+.+}-{0:0}, at: get_signal+0x1f2a/0x21e0 [ 243.801705][ T31] #1: ffff888034f68340 (&mm->mmap_lock){++++}-{4:4}, at: dump_user_range+0x151/0xad0 [ 243.801745][ T31] #2: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: mt_find+0x136/0x9b0 [ 243.801788][ T31] locks held by syz.6.1960/11919: 2, last CPU#0: [ 243.801799][ T31] #0: ffff888033690340 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 243.801840][ T31] #1: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 243.801879][ T31] locks held by syz.0.1962/11926: 3, last CPU#1: [ 243.801890][ T31] #0: ffff88807a4d8460 (sb_writers#6){.+.+}-{0:0}, at: get_signal+0x1f2a/0x21e0 [ 243.801930][ T31] #1: ffff888033694080 (&mm->mmap_lock){++++}-{4:4}, at: dump_user_range+0x151/0xad0 [ 243.801969][ T31] #2: ffffffff8fdec5a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 243.802009][ T31] locks held by syz.0.1966/11933: 2, on CPU#0: [ 243.802019][ T31] #0: ffff888057eea4c0 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 [ 243.809704][ T31] #1: ffffffff8fdf84a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 243.809746][ T31] [ 243.809749][ T31] ============================================= [ 243.809749][ T31] [ 243.809756][ T31] NMI backtrace for cpu 0 [ 243.809768][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 243.809800][ T31] Tainted: [L]=SOFTLOCKUP [ 243.809805][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 243.809814][ T31] Call Trace: [ 243.809819][ T31] [ 243.809825][ T31] dump_stack_lvl+0x100/0x190 [ 243.809849][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 243.809874][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 243.809892][ T31] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 243.809914][ T31] sys_info+0x141/0x190 [ 243.809929][ T31] watchdog+0xcb1/0x1030 [ 243.809954][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 243.809974][ T31] ? __pfx_watchdog+0x10/0x10 [ 243.809993][ T31] ? __kthread_parkme+0x18f/0x230 [ 243.810018][ T31] ? kthread+0x13a/0x450 [ 243.810038][ T31] ? __pfx_watchdog+0x10/0x10 [ 243.810055][ T31] kthread+0x373/0x450 [ 243.810076][ T31] ? __pfx_kthread+0x10/0x10 [ 243.810098][ T31] ret_from_fork+0x730/0xd60 [ 243.810117][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 243.810136][ T31] ? __switch_to+0x800/0x10f0 [ 243.810158][ T31] ? __pfx_kthread+0x10/0x10 [ 243.810180][ T31] ret_from_fork_asm+0x1a/0x30 [ 243.810208][ T31] [ 243.810409][ T31] Sending NMI from CPU 0 to CPUs 1: [ 243.810430][ C1] NMI backtrace for cpu 1 [ 243.810442][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 243.810461][ C1] Tainted: [L]=SOFTLOCKUP [ 243.810466][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 243.810474][ C1] RIP: 0010:check_preemption_disabled+0x2/0xe0 [ 243.810496][ C1] Code: 0f 65 8b 05 a4 68 b9 09 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 54 <55> 53 48 83 ec 08 65 8b 15 69 26 b9 09 65 8b 2d 72 26 b9 09 85 d2 [ 243.810509][ C1] RSP: 0018:ffffc90000157940 EFLAGS: 00000002 [ 243.810521][ C1] RAX: 0000000000000002 RBX: 000000a3cacd000f RCX: 0000000000000000 [ 243.810529][ C1] RDX: 0000000000000002 RSI: ffffffff8c625500 RDI: ffffffff8c625540 [ 243.810538][ C1] RBP: 000000a3caccfc93 R08: 0000000000000005 R09: 0000000000000000 [ 243.810547][ C1] R10: 0000000000000792 R11: 205d313354202020 R12: 0000000000000001 [ 243.810556][ C1] R13: 0000000000000af1 R14: fffffbfff398fd21 R15: dffffc0000000000 [ 243.810566][ C1] FS: 0000000000000000(0000) GS:ffff888122a46000(0000) knlGS:0000000000000000 [ 243.810580][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 243.810589][ C1] CR2: 00007fafc87ef158 CR3: 000000007c261000 CR4: 00000000003526f0 [ 243.810598][ C1] Call Trace: [ 243.810602][ C1] [ 243.810607][ C1] delay_tsc+0x41/0xc0 [ 243.810623][ C1] wait_for_lsr+0xf3/0x210 [ 243.810645][ C1] serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 [ 243.810660][ C1] __serial8250_console_fifo_write+0xa5/0x290 [ 243.810673][ C1] ? __pfx_io_serial_out+0x10/0x10 [ 243.810693][ C1] serial8250_console_write+0x1108/0x14f0 [ 243.810711][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 243.810726][ C1] ? __nbcon_context_update_unsafe+0x1b6/0x220 [ 243.810743][ C1] ? __pfx___nbcon_context_update_unsafe+0x10/0x10 [ 243.810761][ C1] nbcon_emit_next_record+0x8f7/0xa70 [ 243.810777][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 243.810791][ C1] ? nbcon_context_try_acquire+0x3a6/0xc60 [ 243.810805][ C1] ? do_raw_spin_lock+0xf0/0x260 [ 243.810825][ C1] ? __pfx___cant_migrate+0x10/0x10 [ 243.810843][ C1] ? _raw_spin_lock_irqsave+0x42/0x60 [ 243.810860][ C1] nbcon_emit_one+0x1a8/0x2b0 [ 243.810874][ C1] ? __pfx_nbcon_emit_one+0x10/0x10 [ 243.810890][ C1] nbcon_kthread_func+0x613/0x7d0 [ 243.810906][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 243.810923][ C1] ? __kthread_parkme+0x18f/0x230 [ 243.810939][ C1] ? kthread+0x13a/0x450 [ 243.810961][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 243.810974][ C1] kthread+0x373/0x450 [ 243.810991][ C1] ? __pfx_kthread+0x10/0x10 [ 243.811009][ C1] ret_from_fork+0x730/0xd60 [ 243.811024][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 243.811039][ C1] ? __switch_to+0x800/0x10f0 [ 243.811057][ C1] ? __pfx_kthread+0x10/0x10 [ 243.811075][ C1] ret_from_fork_asm+0x1a/0x30 [ 243.811095][ C1] [ 243.816305][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 244.868845][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 244.879513][ T31] Tainted: [L]=SOFTLOCKUP [ 244.883832][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 244.893882][ T31] Call Trace: [ 244.897152][ T31] [ 244.900077][ T31] dump_stack_lvl+0x100/0x190 [ 244.904769][ T31] vpanic+0x553/0x970 [ 244.908750][ T31] ? __pfx_vpanic+0x10/0x10 [ 244.913253][ T31] panic+0xd1/0xe0 [ 244.916972][ T31] ? __pfx_panic+0x10/0x10 [ 244.921386][ T31] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 244.927541][ T31] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 244.933691][ T31] ? watchdog.cold+0x1ec/0x234 [ 244.938456][ T31] watchdog.cold+0x1fd/0x234 [ 244.943050][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 244.948856][ T31] ? __pfx_watchdog+0x10/0x10 [ 244.953538][ T31] ? __kthread_parkme+0x18f/0x230 [ 244.958570][ T31] ? kthread+0x13a/0x450 [ 244.962814][ T31] ? __pfx_watchdog+0x10/0x10 [ 244.967489][ T31] kthread+0x373/0x450 [ 244.971560][ T31] ? __pfx_kthread+0x10/0x10 [ 244.976156][ T31] ret_from_fork+0x730/0xd60 [ 244.980746][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 244.985855][ T31] ? __switch_to+0x800/0x10f0 [ 244.990535][ T31] ? __pfx_kthread+0x10/0x10 [ 244.995129][ T31] ret_from_fork_asm+0x1a/0x30 [ 244.999905][ T31] [ 245.003108][ T31] Kernel Offset: disabled [ 245.007413][ T31] Rebooting in 86400 seconds..