last executing test programs: 1m52.097851843s ago: executing program 4 (id=1559): setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00130005"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xbc, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x90, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}, {0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 1m52.024165684s ago: executing program 4 (id=1561): ioctl$KVM_GET_TSC_KHZ_vm(0xffffffffffffffff, 0xaea3) syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000"/51], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000240)={@local, @local, @val={@void}, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x1c, 0x2c, 0xff, @remote, @local, {[@routing={0x0, 0x0, 0x0, 0xe}], {{0x8000, 0x4e1f, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}}}}}}}, 0x0) 1m51.955423878s ago: executing program 4 (id=1563): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ac0)={0x78, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0x400}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @loopback}}}]}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x78}}, 0x20040000) 1m51.86275787s ago: executing program 4 (id=1565): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0xd0c83, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000000c0)=0x11) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000001640), 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001680)={&(0x7f00000004c0)="66c70daf3fb57161cb740a5e987b9aed1c2d71ffa09c2d952041dd919957815e738a1dd3d399ec8cae26b2ac6e954ae36bc053d38b553767f030d86d2f5184bc40b1a3d2aae8d427dfbc99c88823ee0de397f2e14ca23cd90d4ee189e99045a3d99ffc81a73d42e4b2b056dbefc78234abee09cddd2b99dac45c55883f8d662c4177c8b92766c73aa77ebf82729e6c60bde73905584827d99b619046e18669b551f1c2c2b5e86424ef34728c4f938eef0c16f1986343a7786e5ca8ef99620fb723db53dd82673924aa7a5e7a", &(0x7f00000005c0)=""/4096, &(0x7f00000015c0)="a85528d8f94e12a551dc415f96bd2b1eb0ceb2ea05", &(0x7f0000001600)="400c5b7ad545a8e34f7b00a62e9078a5c891e60a4f824b6ed217fd03ce59a059d46195d96d6d9e0275e172f9f8a9ad7a9f0f2b20", 0x0, r1}, 0x38) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f00000001c0)={0xffffffff, 0x3147504d, 0x1, @discrete={0xffffff9f, 0x2}}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) mlockall(0x4) syz_clone(0x2180, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl(r4, 0x400452c8, &(0x7f00000018c0)="000000000000000000000000000000000000000001") r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001900), 0x181403, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r7, 0xc008ae88, &(0x7f0000001940)={0x1, 0x0, [{0x40000000, 0x0, 0x6}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000001980)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000019c0)='./dev\x00', &(0x7f0000001a00)='devtmpfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000001a40)='./dev/rfcomm0\x00', 0x802, 0x0) write(r8, &(0x7f0000001a80)="c7401b1e0741d6201c31a1d182ded8d555d2", 0x12) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000001ac0)={'wlan1\x00'}) quotactl$Q_QUOTAOFF(0xffffffff80000301, &(0x7f0000001b00)=@loop={'/dev/loop', 0x0}, 0xee00, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_clone3(&(0x7f0000001b40)={0x4000011, 0x0, 0x0, 0x0, {0x8000011}, 0x0, 0x0, 0x0, 0x0}, 0x58) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000001) 1m51.498704671s ago: executing program 4 (id=1566): openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x9, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfffa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000880)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'syzkaller0\x00', 0x0}) r5 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r5, &(0x7f0000000900)={&(0x7f0000000940)=@xdp={0x2c, 0x8, r4, 0x109}, 0x80, 0x0}, 0x20000885) 1m49.73448367s ago: executing program 4 (id=1571): setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00130005"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xbc, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x90, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}, {0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 1m49.465661667s ago: executing program 32 (id=1571): setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00130005"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xbc, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x90, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}, {0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 58.666837418s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 47.764829312s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 32.956082238s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 21.335928022s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 12.558274866s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 7.044736564s ago: executing program 1 (id=2147): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="00110200000036"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000240), 0x3, 0x8200) pread64(r1, 0x0, 0x0, 0x5) 5.802920152s ago: executing program 0 (id=2155): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4000008, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) syz_emit_vhci(&(0x7f0000001400)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_rsp={{0x18, 0x1, 0x8}, {0x9, 0xa5a0, 0x6cc0, 0x5}}}}, 0x15) 4.271283538s ago: executing program 0 (id=2161): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0), 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000400)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000940)={'das16m1\x00', [0x140, 0x3, 0xd, 0x2, 0x0, 0x10000, 0x7fff, 0x6, 0x7, 0xc72d, 0x5, 0xf, 0xffffffff, 0x8, 0x4ce, 0x0, 0x101, 0xed, 0x0, 0x8, 0x4, 0x0, 0x7, 0x7, 0xffc, 0x200000, 0xb1, 0xb3, 0x283, 0x8001, 0x4]}) 4.266619403s ago: executing program 5 (id=1573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0xf, 0x101, 0x6, 0xc3ac, 0x80, 0x7ff, 0x5950, 0x4, 0x0, 0x4, 0x2, 0xc, 0x9, 0x7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000540)=@xdp={0x2c, 0xdd8c, r8, 0x3e}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000600)="80", 0x1}], 0x1}, 0x4) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x5, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 3.204622288s ago: executing program 0 (id=2162): r0 = syz_open_dev$vim2m(&(0x7f0000000400), 0x219, 0x2) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x6100, 0x0) ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000440)={0xf0f045}) ppoll(&(0x7f0000000480)=[{r0, 0x2207}], 0x1, 0x0, 0x0, 0xffffffffffffffc8) 3.204397498s ago: executing program 1 (id=2163): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x92fc}}, 0x40) 3.193885009s ago: executing program 3 (id=2165): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000003c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000024c0)='10', 0x2) unshare(0x6000480) 3.041766568s ago: executing program 2 (id=2166): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(0xffffffffffffffff, 0x40405514, &(0x7f0000000140)={0x9, 0x2, 0xfff, 0x5, '\x00', 0x13}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 3.03220664s ago: executing program 1 (id=2167): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001640)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xb49a3df1, 0x0, 0x0, 0x4, 0x2}}) 3.018488969s ago: executing program 3 (id=2168): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x8001}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=@newtclass={0x38, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x8001}, {0x8, 0x8001}, {0x10}}, [@tclass_kind_options=@c_qfq={{0x8}, {0xc, 0x2, [@TCA_QFQ_WEIGHT={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048020}, 0x0) 2.875448307s ago: executing program 0 (id=2169): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0xf, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x4}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000440)=[{0x0, 0x1, 0x9, 0x1}], 0x10, 0xfffffd2b}, 0x94) r1 = syz_open_dev$dvb_frontend(&(0x7f00000005c0), 0x0, 0x0) ioctl$FE_SET_PROPERTY(r1, 0x40086f52, &(0x7f0000000600)={0x2, &(0x7f0000000640)=[{0x29, '\x00', @buffer={"a264091295170000000000000000b700", 0x20}, 0x8000}, {0xb, '\x00', @st={0x4, [{0x6, @svalue=0x2}, {0x1, @svalue=0x81}, {0x3, @uvalue=0x2}, {0x1, @uvalue=0x7}]}, 0x9}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRESDEC=r0], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000040000000000000200000018110000", @ANYRES32=r2, @ANYBLOB="0000000072000000000000004ebae695b7030000000000008500000083000000bf0900000000000055090100000000009500000000050000181100005fa2d9a3aa40b76cfb6e000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000030000008500000082000000850000000e000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000007c0)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000840)=0x0, &(0x7f0000000880)=0x0, &(0x7f00000008c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000900)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fchdir(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040000) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = epoll_create1(0x80000) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r10, &(0x7f0000000dc0)={0xc0000015}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r8, &(0x7f0000000e00)={0xa000001c}) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000940)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000009c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000a00)=0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000f40)={0xffffffffffffffff}) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r14, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001040)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRES16=r15, @ANYBLOB="01002bbd700000100000010000000c00020009000000000000001c0007800c00018008000100", @ANYRES32=r13, @ANYBLOB="0c00018008000100", @ANYRES32=r13, @ANYBLOB], 0x3c}}, 0x400400c) r16 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r16, r12, &(0x7f0000000a40)={0x0, 0xfa7f, 0x100, 0x3, 0x255}, &(0x7f0000000ac0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2a9a, 0x10000, 0xe100, 0x197, 0x0, r16}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c99, 0x400, 0x2, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90a, 0x400, 0x3, 0x3a6, 0x0, r16}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x100, 0x1002, 0x250, 0x0, r3}}], 0x1, &(0x7f0000000d40)={0x2e, 0x4d, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, r11, '\x00', {0xfff9, 0x7d6, 0x0, 0x0}}, 0x0) ioctl$vim2m_VIDIOC_QBUF(r16, 0xc04c560f, &(0x7f0000000ec0)=@multiplanar_userptr={0xffff, 0x2, 0x4, 0x200, 0x800, {0x0, 0xea60}, {0x3, 0x0, 0xa, 0x18, 0x6d, 0x8, "f2429cd8"}, 0xc, 0x2, {&(0x7f0000000e40)=[{0x8, 0x1, {0x0}, 0x9}, {0x1, 0x6, {0x0}, 0x1000}]}, 0x5}) r17 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r17, 0x6, 0xd, &(0x7f0000000780)='cdg', 0x3) pipe(&(0x7f0000000700)={0xffffffffffffffff}) ioctl$PPPIOCSFLAGS1(r18, 0x40047459, &(0x7f0000000740)=0x2000000) 2.743308976s ago: executing program 1 (id=2170): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) io_uring_setup(0x8, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x17b}) 2.516766079s ago: executing program 0 (id=2171): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000080), 0x4) 2.375865461s ago: executing program 3 (id=2172): socket$netlink(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000240)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x44}, @hci_rp_read_local_commands={{0x3}, {0x2, "d1193d49138d7cdd07468b8972dd0e894a3ea4ad03e297e368a68ba8810dece110e805c49a151c3d9cabd1e56f3b4d213a7c30096df9de2001a14988837dc1a5"}}}}, 0x47) socket(0x10, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000c1001000000000001c000000850000000e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 2.354098086s ago: executing program 2 (id=2173): mkdir(&(0x7f00000004c0)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='dir0\x00', &(0x7f0000000640)='tracefs\x00', 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000000)={0x0, 0xb04, 0x4000, 0x2, 0x158}, 0x0, 0x0, 0x0) syz_io_uring_setup(0x34bc, &(0x7f0000000080)={0x0, 0x5410, 0x20000, 0x1, 0x40080}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000440)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$vga_arbiter(r2, &(0x7f0000000200)=ANY=[@ANYBLOB='target '], 0x13) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x30, &(0x7f0000000280)={&(0x7f00000002c0)={0x38, 0x1403, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_hsr\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x850}, 0x20000800) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='hfs\x00', 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000380)=0x2, 0x4) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f00000003c0)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) close(0x3) r6 = syz_open_dev$loop(0x0, 0xa, 0x3) openat$random(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000700)={0x2020}, 0xfdef) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$sock_SIOCINQ(r7, 0x541b, &(0x7f0000002740)) ioctl$BLKDISCARD(r6, 0x1277, &(0x7f0000002780)=0x21a2) write(0xffffffffffffffff, &(0x7f0000002800)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uuid:12345678-1234-1234-1234-123456789abc,traddr=172.20.20.23,trsvcid=4420\x00', 0x80) nanosleep(&(0x7f0000002880)={0x0, 0x10000000}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000028c0)={'lo\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000002900)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000002940)={r8, 0x1, 0x6, @multicast}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000002980)=@assoc_value, &(0x7f00000029c0)=0x8) 1.726596534s ago: executing program 2 (id=2174): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0), 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000400)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000940)={'das16m1\x00', [0x140, 0x3, 0xd, 0x2, 0x0, 0x10000, 0x7fff, 0x6, 0x7, 0xc72d, 0x5, 0xf, 0xffffffff, 0x8, 0x4ce, 0x0, 0x101, 0xed, 0x0, 0x8, 0x4, 0x0, 0x7, 0x7, 0xffc, 0x200000, 0xb1, 0xb3, 0x283, 0x8001, 0x4]}) 1.623325884s ago: executing program 3 (id=2175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="6c0000000206050000000000000000000000fffc120003006269746d61703a69702c6d616300000005000400000000000900020073797a310000000020000780050003001f0000000c00018008000140ffffffff08000840000000e205000500020000"], 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10040047}, 0x4000084) 1.554056292s ago: executing program 1 (id=2176): r0 = syz_ublk_setup_io_uring(0x6901, &(0x7f0000000100)={0x0, 0x0, 0x400}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0) r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000340)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000003c0)=@new_dev={0x1, 0x104}}}, &(0x7f0000000400)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000000440), r4, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000800)={0x0, 0xc808, 0x1000, 0xfffffffe, 0x28d}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xabb8, 0x80, 0x3, 0x1af, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x23c, 0x40, 0x0, 0x330, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8431, 0x8, 0x4, 0x79}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf82, 0x8000, 0x3, 0x2b7}}], 0x4, &(0x7f0000000b00)={0x2e, 0x2, 0x0, r7, 0xc0107523, 0x0, 0x0, 0x0, 0x0, {0x10}, 0x0, r5, '\x00', {0x6, 0xb55, 0x100104, 0x0}}, &(0x7f0000000b80)) 1.534689296s ago: executing program 2 (id=2177): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x92fc}}, 0x40) 1.473071575s ago: executing program 2 (id=2178): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./proc\x00', 0x0, 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000024c0)='10', 0x2) unshare(0x6000480) 1.455182048s ago: executing program 3 (id=2179): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x105000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x3, &(0x7f0000000180)=0x3, 0x7fff) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f00000006c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000196c0)=0x80000000000003) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_open_dev$sndctrl(&(0x7f00000001c0), 0x0, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000200)=0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x20044084) socket(0xa, 0x1, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r4, 0xc0109428, &(0x7f0000019880)={0x3, 0x40}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000198c0)={0x0, 0x0, &(0x7f0000019900)={&(0x7f0000019940)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000028120700080004008100000008001b00000000"], 0x30}}, 0x4004090) 1.327107977s ago: executing program 1 (id=2180): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2}, &(0x7f0000000040)=0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x4, &(0x7f0000000200)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000000c0)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_gettime(r0, &(0x7f0000000100)) timer_settime(r0, 0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) creat(&(0x7f0000000180)='./bus\x00', 0x3db) r1 = fanotify_init(0xf00, 0x2) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000000200), 0x3c}], 0x4c) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x60280, 0x0) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x3, &(0x7f0000000280)={{0x77359400}, {0x77359400}}, 0x0) close(0x3) setxattr$system_posix_acl(&(0x7f00000002c0)='.\x00', &(0x7f0000000300)='system.posix_acl_access\x00', &(0x7f0000000340)={{}, {0x1, 0x1}, [{0x2, 0x5, 0xee01}], {}, [], {}, {0x20, 0x2}}, 0x2c, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000380)='.\x00', 0xffffffd3) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) sendmsg$NFC_CMD_DISABLE_SE(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)={0x1c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008011}, 0x8) exit(0x3) 280.777491ms ago: executing program 3 (id=2181): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0xf, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x4}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000440)=[{0x0, 0x1, 0x9, 0x1}], 0x10, 0xfffffd2b}, 0x94) r1 = syz_open_dev$dvb_frontend(&(0x7f00000005c0), 0x0, 0x0) ioctl$FE_SET_PROPERTY(r1, 0x40086f52, &(0x7f0000000600)={0x2, &(0x7f0000000640)=[{0x29, '\x00', @buffer={"a264091295170000000000000000b700", 0x20}, 0x8000}, {0xb, '\x00', @st={0x4, [{0x6, @svalue=0x2}, {0x1, @svalue=0x81}, {0x3, @uvalue=0x2}, {0x1, @uvalue=0x7}]}, 0x9}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRESDEC=r0], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000040000000000000200000018110000", @ANYRES32=r2, @ANYBLOB="0000000072000000000000004ebae695b7030000000000008500000083000000bf0900000000000055090100000000009500000000050000181100005fa2d9a3aa40b76cfb6e000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000030000008500000082000000850000000e000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000007c0)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000840)=0x0, &(0x7f0000000880)=0x0, &(0x7f00000008c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000900)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fchdir(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040000) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = epoll_create1(0x80000) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r10, &(0x7f0000000dc0)={0xc0000015}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r8, &(0x7f0000000e00)={0xa000001c}) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000940)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000009c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000a00)=0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000f40)={0xffffffffffffffff}) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r14, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001040)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRES16=r15, @ANYBLOB="01002bbd700000100000010000000c00020009000000000000001c0007800c00018008000100", @ANYRES32=r13, @ANYBLOB="0c00018008000100", @ANYRES32=r13, @ANYBLOB], 0x3c}}, 0x400400c) r16 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r16, r12, &(0x7f0000000a40)={0x0, 0xfa7f, 0x100, 0x3, 0x255}, &(0x7f0000000ac0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2a9a, 0x10000, 0xe100, 0x197, 0x0, r16}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c99, 0x400, 0x2, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90a, 0x400, 0x3, 0x3a6, 0x0, r16}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x100, 0x1002, 0x250, 0x0, r3}}], 0x1, &(0x7f0000000d40)={0x2e, 0x4d, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, r11, '\x00', {0xfff9, 0x7d6, 0x0, 0x0}}, 0x0) ioctl$vim2m_VIDIOC_QBUF(r16, 0xc04c560f, &(0x7f0000000ec0)=@multiplanar_userptr={0xffff, 0x2, 0x4, 0x200, 0x800, {0x0, 0xea60}, {0x3, 0x0, 0xa, 0x18, 0x6d, 0x8, "f2429cd8"}, 0xc, 0x2, {&(0x7f0000000e40)=[{0x8, 0x1, {0x0}, 0x9}, {0x1, 0x6, {0x0}, 0x1000}]}, 0x5}) r17 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r17, 0x6, 0xd, &(0x7f0000000780)='cdg', 0x3) pipe(&(0x7f0000000700)={0xffffffffffffffff}) ioctl$PPPIOCSFLAGS1(r18, 0x40047459, &(0x7f0000000740)=0x2000000) 265.802814ms ago: executing program 0 (id=2182): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="060000000300010000", 0x9) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x80003, 0xff) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) read$FUSE(r2, &(0x7f0000002600)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000004640)={0x10, 0xfffffffffffffffe, r3}, 0x66) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0xffff, 0xe) sched_setattr(0x0, &(0x7f0000004680)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) set_mempolicy(0x4005, &(0x7f00000046c0)=0x2e8d, 0x6) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000004700), 0x88002, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000004740)=0xd) r5 = open(&(0x7f0000004780)='./bus\x00', 0x143142, 0x80) ftruncate(r5, 0x2007ffb) sendfile(r4, r5, 0x0, 0x1000000201002) syz_usb_connect(0x0, 0x2d, &(0x7f00000047c0)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r6, &(0x7f0000004800)=""/220, 0xdc) r7 = creat(&(0x7f0000004900)='./bus\x00', 0xd4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000004940)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000004a80)={0x0, 0x0, &(0x7f0000004ac0)={&(0x7f0000004b00)=ANY=[@ANYBLOB="1c000000020303000000000000000000090000000000000002000000"], 0x1c}}, 0x0) io_submit(0x0, 0x2, &(0x7f0000004b40)=[&(0x7f0000004b80)={0x0, 0x0, 0x0, 0x2, 0x10, r7, 0x0}, &(0x7f0000004bc0)={0x0, 0x0, 0x8, 0x8, 0x0, r7, 0x0}]) write(r0, &(0x7f0000000080)="060000000300000000", 0x9) 0s ago: executing program 2 (id=2183): syz_usb_connect(0x1, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = epoll_create(0x80) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000200)={0x40000004}) kernel console output (not intermixed with test programs): 13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 309.007270][ T31] kauditd_printk_skb: 46 callbacks suppressed [ 309.007287][ T31] audit: type=1400 audit(1793264540.001:1108): avc: denied { write } for pid=11699 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 309.024462][T11733] futex_wake_op: syz.3.1913 tries to shift op by 144; fix this program [ 309.095453][T11742] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 309.095476][T11742] audit: out of memory in audit_log_start [ 309.095565][ T31] audit: type=1400 audit(1793264540.091:1109): avc: denied { read } for pid=11740 comm="syz.0.1917" name="loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 309.110940][ T31] audit: type=1400 audit(1793264540.111:1110): avc: denied { ioctl } for pid=11740 comm="syz.0.1917" path="/dev/loop-control" dev="devtmpfs" ino=644 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 309.318090][ T31] audit: type=1400 audit(1793264540.311:1111): avc: denied { write } for pid=11747 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 309.433504][T11750] syzkaller0: entered promiscuous mode [ 309.433532][T11750] syzkaller0: entered allmulticast mode [ 309.694059][ T31] audit: type=1400 audit(1793264540.631:1112): avc: denied { mount } for pid=11751 comm="syz.0.1918" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 309.694115][ T31] audit: type=1400 audit(1793264540.631:1113): avc: denied { search } for pid=11751 comm="syz.0.1918" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 309.694158][ T31] audit: type=1400 audit(1793264540.641:1114): avc: denied { read write } for pid=11751 comm="syz.0.1918" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 309.694201][ T31] audit: type=1400 audit(1793264540.641:1115): avc: denied { open } for pid=11751 comm="syz.0.1918" path="/422/nfsd/portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 310.039123][ T5622] Bluetooth: hci1: command tx timeout [ 310.894023][T11758] FAULT_INJECTION: forcing a failure. [ 310.894023][T11758] name failslab, interval 1, probability 0, space 0, times 0 [ 310.894062][T11758] CPU: 1 UID: 0 PID: 11758 Comm: syz.0.1919 Not tainted syzkaller #0 PREEMPT(full) [ 310.894115][T11758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 310.894154][T11758] Call Trace: [ 310.894165][T11758] [ 310.894178][T11758] dump_stack_lvl+0x100/0x190 [ 310.894236][T11758] should_fail_ex.cold+0x5/0xa [ 310.894288][T11758] should_failslab+0xc2/0x120 [ 310.894325][T11758] kmem_cache_alloc_noprof+0x92/0x6a0 [ 310.894375][T11758] ? mempool_init_node+0x2f7/0x6f0 [ 310.894409][T11758] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 310.894442][T11758] mempool_init_node+0x2f7/0x6f0 [ 310.894494][T11758] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 310.894528][T11758] ? __pfx_mempool_free_slab+0x10/0x10 [ 310.894569][T11758] mempool_init_noprof+0x3a/0x50 [ 310.894607][T11758] dm_integrity_ctr+0x140c/0x64b0 [ 310.894661][T11758] ? __pfx_dm_integrity_ctr+0x10/0x10 [ 310.894708][T11758] ? dm_split_args+0xc1/0x570 [ 310.894738][T11758] ? rcu_is_watching+0x13/0xc0 [ 310.894773][T11758] ? dm_split_args+0xc1/0x570 [ 310.894801][T11758] ? skip_spaces+0xee/0x130 [ 310.894843][T11758] dm_table_add_target+0x58b/0xee0 [ 310.894877][T11758] ? __pfx_dm_table_add_target+0x10/0x10 [ 310.894913][T11758] ? dm_table_create+0x2d3/0x3d0 [ 310.894951][T11758] table_load+0x3b9/0x7b0 [ 310.895000][T11758] ? __pfx_table_load+0x10/0x10 [ 310.895044][T11758] ? __might_fault+0xc5/0x140 [ 310.895082][T11758] ? __might_fault+0xc5/0x140 [ 310.895128][T11758] ctl_ioctl+0x4d2/0xcc0 [ 310.895162][T11758] ? __pfx_table_load+0x10/0x10 [ 310.895198][T11758] ? __pfx_ctl_ioctl+0x10/0x10 [ 310.895274][T11758] ? selinux_file_ioctl+0x1e0/0x290 [ 310.895319][T11758] dm_ctl_ioctl+0x22/0x30 [ 310.895351][T11758] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 310.895385][T11758] __x64_sys_ioctl+0x18e/0x210 [ 310.895428][T11758] do_syscall_64+0x123/0x790 [ 310.895456][T11758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.895482][T11758] RIP: 0033:0x7f904bd9f559 [ 310.895505][T11758] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.895530][T11758] RSP: 002b:00007f904cbb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 310.895567][T11758] RAX: ffffffffffffffda RBX: 00007f904c025fa0 RCX: 00007f904bd9f559 [ 310.895586][T11758] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 310.895605][T11758] RBP: 00007f904be36b20 R08: 0000000000000000 R09: 0000000000000000 [ 310.895624][T11758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 310.895642][T11758] R13: 00007f904c026038 R14: 00007f904c025fa0 R15: 00007ffe4fb557e8 [ 310.895680][T11758] [ 310.902836][T11758] device-mapper: table: 248:0: integrity: Cannot allocate mempool (-ENOMEM) [ 310.902874][T11758] device-mapper: ioctl: error adding target to table [ 311.125507][T11733] futex_wake_op: syz.3.1913 tries to shift op by 144; fix this program [ 311.288606][T11763] netlink: 'syz.0.1920': attribute type 1 has an invalid length. [ 311.344298][T11769] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1920'. [ 311.402515][T11763] 8021q: adding VLAN 0 to HW filter on device bond5 [ 311.408096][T11765] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1921'. [ 311.437775][T11770] bond5: entered promiscuous mode [ 311.437802][T11770] bond5: entered allmulticast mode [ 311.640022][ C0] net_ratelimit: 33 callbacks suppressed [ 312.008343][T11618] netdevsim netdevsim5 netdevsim0: renamed from eth5 [ 312.119803][ T5622] Bluetooth: hci1: command tx timeout [ 312.131810][T11618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 312.141667][T11618] netdevsim netdevsim5 netdevsim1: renamed from eth6 [ 312.180376][T11618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 312.181317][T11618] netdevsim netdevsim5 netdevsim2: renamed from eth7 [ 312.223029][T11618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 312.227784][T11618] netdevsim netdevsim5 netdevsim3: renamed from eth8 [ 312.274850][T11618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 312.328126][T11798] batman_adv: Routing algorithm '' is not supported [ 312.380331][T11798] Failed to initialize the IGMP autojoin socket (err -2) [ 312.443517][T11797] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 312.648182][T11801] syzkaller0: entered promiscuous mode [ 312.648201][T11801] syzkaller0: entered allmulticast mode [ 312.876125][T11813] futex_wake_op: syz.1.1932 tries to shift op by 144; fix this program [ 312.941182][T11818] netlink: 'syz.0.1934': attribute type 1 has an invalid length. [ 313.024026][T11823] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1934'. [ 313.186468][T11818] 8021q: adding VLAN 0 to HW filter on device bond6 [ 313.240371][T11831] FAULT_INJECTION: forcing a failure. [ 313.240371][T11831] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 313.240428][T11831] CPU: 0 UID: 0 PID: 11831 Comm: syz.3.1936 Not tainted syzkaller #0 PREEMPT(full) [ 313.240460][T11831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 313.240476][T11831] Call Trace: [ 313.240485][T11831] [ 313.240497][T11831] dump_stack_lvl+0x100/0x190 [ 313.240546][T11831] should_fail_ex.cold+0x5/0xa [ 313.240587][T11831] should_fail_alloc_page+0xeb/0x140 [ 313.240618][T11831] prepare_alloc_pages+0x1f0/0x5b0 [ 313.240649][T11831] __alloc_frozen_pages_noprof+0x1b1/0x3280 [ 313.240680][T11813] futex_wake_op: syz.1.1932 tries to shift op by 144; fix this program [ 313.240680][T11831] ? rcu_is_watching+0x13/0xc0 [ 313.240709][T11831] ? __up_read+0x333/0x980 [ 313.240756][T11831] ? __pfx___up_read+0x10/0x10 [ 313.240797][T11831] ? do_user_addr_fault+0x7d7/0x12f0 [ 313.240843][T11831] ? do_user_addr_fault+0x7d7/0x12f0 [ 313.240893][T11831] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 313.240925][T11831] ? irqentry_exit+0x202/0xab0 [ 313.240950][T11831] ? lockdep_hardirqs_on+0x7d/0x110 [ 313.240991][T11831] ? irqentry_exit+0x202/0xab0 [ 313.241036][T11831] ? rep_movs_alternative+0x4a/0xa0 [ 313.241073][T11831] ? _copy_from_iter+0x270/0x16c0 [ 313.241107][T11831] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 313.241150][T11831] ? policy_nodemask+0xed/0x5e0 [ 313.241183][T11831] alloc_pages_mpol+0x201/0x560 [ 313.241215][T11831] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 313.241256][T11831] alloc_pages_noprof+0x1a/0x160 [ 313.241290][T11831] anon_pipe_write+0xe6f/0x1bb0 [ 313.241333][T11831] ? __pfx_anon_pipe_write+0x10/0x10 [ 313.241362][T11831] ? selinux_file_permission+0x30/0x6a0 [ 313.241434][T11831] ? bpf_lsm_file_permission+0x9/0x10 [ 313.241472][T11831] ? security_file_permission+0x76/0x210 [ 313.241518][T11831] ? rw_verify_area+0xce/0x6d0 [ 313.241558][T11831] vfs_write+0x6af/0x1050 [ 313.241583][T11831] ? __pfx_anon_pipe_write+0x10/0x10 [ 313.241613][T11831] ? __pfx_vfs_write+0x10/0x10 [ 313.241647][T11831] ? find_held_lock+0x2b/0x80 [ 313.241690][T11831] ksys_write+0x1f8/0x250 [ 313.241712][T11831] ? __pfx_ksys_write+0x10/0x10 [ 313.241747][T11831] do_syscall_64+0x123/0x790 [ 313.241776][T11831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.241804][T11831] RIP: 0033:0x7f597119f559 [ 313.241827][T11831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.241854][T11831] RSP: 002b:00007f5972029028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 313.241879][T11831] RAX: ffffffffffffffda RBX: 00007f5971425fa0 RCX: 00007f597119f559 [ 313.241898][T11831] RDX: 00000000fffffecc RSI: 0000200000000180 RDI: 0000000000000004 [ 313.241914][T11831] RBP: 00007f5971236b20 R08: 0000000000000000 R09: 0000000000000000 [ 313.241931][T11831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 313.241948][T11831] R13: 00007f5971426038 R14: 00007f5971425fa0 R15: 00007fffc7b01f58 [ 313.241994][T11831] [ 313.243414][T11825] bond6: entered promiscuous mode [ 313.243441][T11825] bond6: entered allmulticast mode [ 313.767565][ T5622] Bluetooth: hci0: unexpected event for opcode 0x1002 [ 313.832373][T11849] netlink: 'syz.1.1941': attribute type 1 has an invalid length. [ 313.850104][ T5743] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 313.909896][T11849] 8021q: adding VLAN 0 to HW filter on device bond6 [ 314.010531][ T5743] usb 1-1: New USB device found: idVendor=1199, idProduct=b000, bcdDevice=0.00 [ 314.011638][ T5743] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 314.011665][ T5743] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 314.011731][ T5743] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.097898][T11856] 8021q: adding VLAN 0 to HW filter on device bond6 [ 314.098974][T11856] bond6: (slave wireguard0): The slave device specified does not support setting the MAC address [ 314.104822][T11856] bond6: (slave wireguard0): Error -95 calling set_mac_address [ 314.202922][ T5622] Bluetooth: hci1: command tx timeout [ 314.328062][ T5013] usb 1-1: USB disconnect, device number 4 [ 314.412211][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 314.412227][ T31] audit: type=1400 audit(1793264545.411:1124): avc: denied { write } for pid=11858 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 314.635505][ T31] audit: type=1400 audit(1793264545.631:1125): avc: denied { write } for pid=11881 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 314.786644][T11891] netlink: 'syz.3.1949': attribute type 1 has an invalid length. [ 314.844941][T11893] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1949'. [ 314.898694][T11891] 8021q: adding VLAN 0 to HW filter on device bond5 [ 314.928917][T11895] bond5: entered promiscuous mode [ 314.928946][T11895] bond5: entered allmulticast mode [ 315.184303][T11618] wireguard: wg0: Could not create IPv4 socket [ 315.192774][T11618] wireguard: wg1: Could not create IPv4 socket [ 315.201045][T11618] wireguard: wg2: Could not create IPv4 socket [ 315.554246][ T31] audit: type=1400 audit(1793264546.551:1126): avc: denied { write } for pid=11894 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.637389][T11904] futex_wake_op: syz.0.1951 tries to shift op by 144; fix this program [ 315.637584][T11904] futex_wake_op: syz.0.1951 tries to shift op by 144; fix this program [ 315.901839][ T31] audit: type=1400 audit(1793264546.901:1127): avc: denied { write } for pid=11926 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.008104][T11929] loop5: detected capacity change from 0 to 7 [ 316.056875][T11929] Dev loop5: unable to read RDB block 7 [ 316.056927][T11929] loop5: unable to read partition table [ 316.057204][T11929] loop5: partition table beyond EOD, truncated [ 316.058667][T11929] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 316.394418][ T4936] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 316.396350][ T4936] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 316.406582][ T4936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 316.423283][ T4936] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 316.425381][ T4936] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 316.757724][ T31] audit: type=1400 audit(1793264547.751:1128): avc: denied { create } for pid=11953 comm="syz.1.1964" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 316.759067][ C0] net_ratelimit: 34 callbacks suppressed [ 317.042176][T11966] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1965'. [ 317.074194][ T31] audit: type=1400 audit(1793264548.071:1129): avc: denied { mount } for pid=11953 comm="syz.1.1964" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 317.086771][ T31] audit: type=1400 audit(1793264548.081:1130): avc: denied { search } for pid=11953 comm="syz.1.1964" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 317.086826][ T31] audit: type=1400 audit(1793264548.081:1131): avc: denied { search } for pid=11953 comm="syz.1.1964" name="usb_gadget" dev="configfs" ino=3693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 317.086867][ T31] audit: type=1400 audit(1793264548.081:1132): avc: denied { write search } for pid=11953 comm="syz.1.1964" name="usb_gadget" dev="configfs" ino=3693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 317.086908][ T31] audit: type=1400 audit(1793264548.081:1133): avc: denied { add_name } for pid=11953 comm="syz.1.1964" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 317.405909][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.405958][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.679528][ T30] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 317.832274][ T30] usb 1-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=7.03 [ 317.834410][ T30] usb 1-1: Dual-Role OTG device on HNP port [ 317.840739][ T30] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.907070][ T30] gspca_main: spca501-2.14.0 probing 0000:0000 [ 317.925332][ T30] gspca_spca501: reg write: error -32 [ 317.925368][ T30] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 317.925449][ T30] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 318.045394][T11938] Failed to initialize the IGMP autojoin socket (err -2) [ 318.516563][T11967] futex_wake_op: syz.0.1969 tries to shift op by 144; fix this program [ 318.516759][T11967] futex_wake_op: syz.0.1969 tries to shift op by 144; fix this program [ 318.619225][ T5622] Bluetooth: hci1: command tx timeout [ 318.720175][T12014] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1975'. [ 319.452558][ T31] kauditd_printk_skb: 40 callbacks suppressed [ 319.452574][ T31] audit: type=1326 audit(1793264550.451:1174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.454358][ T31] audit: type=1326 audit(1793264550.451:1175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.455565][ T31] audit: type=1326 audit(1793264550.451:1176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.457058][ T31] audit: type=1326 audit(1793264550.451:1177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.458113][ T31] audit: type=1326 audit(1793264550.451:1178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.458161][ T31] audit: type=1326 audit(1793264550.451:1179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.458202][ T31] audit: type=1326 audit(1793264550.451:1180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.460755][ T31] audit: type=1326 audit(1793264550.451:1181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.480331][ T31] audit: type=1326 audit(1793264550.461:1182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12039 comm="syz.1.1983" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe94d9f559 code=0x7ffc0000 [ 319.720971][ T5013] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 319.787807][T12048] usb usb2: usbfs: process 12048 (syz.1.1985) did not claim interface 0 before use [ 319.788134][T12048] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 319.793712][ T31] audit: type=1400 audit(1793264550.781:1183): avc: denied { append } for pid=12046 comm="syz.1.1985" name="001" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 319.836671][T12048] FAULT_INJECTION: forcing a failure. [ 319.836671][T12048] name failslab, interval 1, probability 0, space 0, times 0 [ 319.836706][T12048] CPU: 1 UID: 0 PID: 12048 Comm: syz.1.1985 Not tainted syzkaller #0 PREEMPT(full) [ 319.836736][T12048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 319.836752][T12048] Call Trace: [ 319.836763][T12048] [ 319.836774][T12048] dump_stack_lvl+0x100/0x190 [ 319.836823][T12048] should_fail_ex.cold+0x5/0xa [ 319.836859][T12048] should_failslab+0xc2/0x120 [ 319.836884][T12048] __kmalloc_cache_noprof+0x91/0x6d0 [ 319.836917][T12048] ? copy_cgroup_ns+0x3ef/0x970 [ 319.836945][T12048] ? copy_time_ns+0xed/0x780 [ 319.836983][T12048] copy_time_ns+0xed/0x780 [ 319.837024][T12048] create_new_namespaces+0x48a/0xac0 [ 319.837067][T12048] unshare_nsproxy_namespaces+0xf6/0x210 [ 319.837103][T12048] ksys_unshare+0x44f/0x980 [ 319.837148][T12048] ? __pfx_ksys_unshare+0x10/0x10 [ 319.837206][T12048] __x64_sys_unshare+0x31/0x40 [ 319.837237][T12048] do_syscall_64+0x123/0x790 [ 319.837264][T12048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.837289][T12048] RIP: 0033:0x7efe94d9f559 [ 319.837309][T12048] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.837334][T12048] RSP: 002b:00007efe95bae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 319.837361][T12048] RAX: ffffffffffffffda RBX: 00007efe95025fa0 RCX: 00007efe94d9f559 [ 319.837378][T12048] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000006000480 [ 319.837392][T12048] RBP: 00007efe94e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 319.837406][T12048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 319.837419][T12048] R13: 00007efe95026038 R14: 00007efe95025fa0 R15: 00007fffb839aa18 [ 319.837466][T12048] [ 319.880629][ T5013] usb 3-1: Using ep0 maxpacket: 8 [ 319.883951][ T5013] usb 3-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 319.885573][ T5013] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 319.885599][ T5013] usb 3-1: config 0 has no interface number 0 [ 319.885639][ T5013] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 319.885674][ T5013] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 319.885705][ T5013] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 319.885734][ T5013] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 319.885802][ T5013] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.937489][ T5013] usb 3-1: config 0 descriptor?? [ 320.057344][ T5013] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 320.673817][T12053] syzkaller0: entered promiscuous mode [ 320.673859][T12053] syzkaller0: entered allmulticast mode [ 320.682107][T12059] tipc: Enabling of bearer rejected, failed to enable media [ 320.685459][ T5622] Bluetooth: hci1: command tx timeout [ 320.821453][T12073] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.824505][T12073] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.540967][T12062] futex_wake_op: syz.1.1988 tries to shift op by 144; fix this program [ 321.541159][T12062] futex_wake_op: syz.1.1988 tries to shift op by 144; fix this program ** 1 printk messages dropped ** ** 144 printk messages dropped ** ** 29 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 194 printk messages dropped ** ** 24 printk messages dropped ** ** 14 printk messages dropped ** ** 9 printk messages dropped ** ** 49 printk messages dropped ** ** 43 printk messages dropped ** ** 4 printk messages dropped ** ** 194 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 29 printk messages dropped ** ** 4 printk messages dropped ** ** 154 printk messages dropped ** ** 9 printk messages dropped ** ** 35 printk messages dropped ** ** 105 printk messages dropped ** ** 34 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 126 printk messages dropped ** ** 154 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 229 printk messages dropped ** ** 14 printk messages dropped ** ** 200 printk messages dropped ** ** 4 printk messages dropped ** ** 119 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 164 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 34 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 160 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 79 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 48 printk messages dropped ** ** 45 printk messages dropped ** ** 151 printk messages dropped ** ** 344 printk messages dropped ** ** 124 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 169 printk messages dropped ** ** 129 printk messages dropped ** ** 149 printk messages dropped ** ** 44 printk messages dropped ** ** 129 printk messages dropped ** ** 14 printk messages dropped ** ** 180 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 146 printk messages dropped ** ** 49 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 169 printk messages dropped ** ** 24 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 59 printk messages dropped ** ** 114 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 172 printk messages dropped ** ** 89 printk messages dropped ** ** 34 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 144 printk messages dropped ** ** 104 printk messages dropped ** ** 309 printk messages dropped ** ** 19 printk messages dropped ** ** 5 printk messages dropped ** ** 14 printk messages dropped ** ** 10 printk messages dropped ** ** 99 printk messages dropped ** ** 139 printk messages dropped ** ** 86 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 44 printk messages dropped ** ** 139 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 139 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 149 printk messages dropped ** ** 70 printk messages dropped ** ** 34 printk messages dropped ** ** 159 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 200 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 44 printk messages dropped ** ** 139 printk messages dropped ** ** 134 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 49 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 164 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 108 printk messages dropped ** ** 9 printk messages dropped ** ** 34 printk messages dropped ** ** 39 printk messages dropped ** ** 139 printk messages dropped ** ** 4 printk messages dropped ** ** 194 printk messages dropped ** ** 9 printk messages dropped ** ** 24 printk messages dropped ** ** 39 printk messages dropped ** ** 4 printk messages dropped ** ** 279 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 229 printk messages dropped ** ** 19 printk messages dropped ** ** 108 printk messages dropped ** ** 24 printk messages dropped ** ** 24 printk messages dropped ** ** 54 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 139 printk messages dropped ** ** 4 printk messages dropped ** ** 29 printk messages dropped ** ** 14 printk messages dropped ** ** 549 printk messages dropped ** ** 195 printk messages dropped ** ** 14 printk messages dropped ** ** 19 printk messages dropped ** ** 14 printk messages dropped ** ** 9 printk messages dropped ** ** 34 printk messages dropped ** ** 9 printk messages dropped ** ** 144 printk messages dropped ** ** 132 printk messages dropped ** ** 9 printk messages dropped ** ** 29 printk messages dropped ** ** 204 printk messages dropped ** ** 4 printk messages dropped ** ** 24 printk messages dropped ** ** 44 printk messages dropped ** ** 9 printk messages dropped ** ** 154 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 9 printk messages dropped ** ** 9 printk messages dropped ** ** 146 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 164 printk messages dropped ** ** 139 printk messages dropped ** ** 94 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 334 printk messages dropped ** ** 199 printk messages dropped ** ** 14 printk messages dropped ** ** 14 printk messages dropped ** ** 114 printk messages dropped ** ** 379 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 34 printk messages dropped ** ** 19 printk messages dropped ** ** 279 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 9 printk messages dropped ** ** 19 printk messages dropped ** ** 19 printk messages dropped ** ** 104 printk messages dropped ** ** 208 printk messages dropped ** ** 4 printk messages dropped ** ** 173 printk messages dropped ** ** 34 printk messages dropped ** ** 358 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 159 printk messages dropped ** ** 19 printk messages dropped ** ** 154 printk messages dropped ** ** 8 printk messages dropped ** ** 9 printk messages dropped ** ** 19 printk messages dropped ** ** 109 printk messages dropped ** ** 4 printk messages dropped ** ** 164 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 89 printk messages dropped ** ** 81 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 34 printk messages dropped ** ** 59 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 5 printk messages dropped ** ** 9 printk messages dropped ** ** 12 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 6 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 34 printk messages dropped ** ** 4 printk messages dropped ** ** 10 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 6 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 5 printk messages dropped ** ** 6 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 14 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 14 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 5 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 22 printk messages dropped ** ** 15 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 19 printk messages dropped ** ** 41 printk messages dropped ** ** 4 printk messages dropped ** ** 4 printk messages dropped ** ** 9 printk messages dropped ** ** 2 printk messages dropped ** [ 324.756328][ T61] usb 3-1: USB disconnect, device number 5 [ 324.770451][ T61] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 324.849591][ T5622] Bluetooth: hci1: command tx timeout [ 325.015994][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 325.016020][ T31] audit: type=1400 audit(1793264556.011:1186): avc: denied { setopt } for pid=12093 comm="syz.1.1996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 325.072866][ T31] audit: type=1400 audit(1793264556.071:1187): avc: denied { write } for pid=12075 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 325.183708][ T31] audit: type=1400 audit(1793264556.181:1188): avc: denied { create } for pid=12093 comm="syz.1.1996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 325.204517][T12094] FAULT_INJECTION: forcing a failure. [ 325.204517][T12094] name failslab, interval 1, probability 0, space 0, times 0 [ 325.204552][T12094] CPU: 0 UID: 0 PID: 12094 Comm: syz.1.1996 Not tainted syzkaller #0 PREEMPT(full) [ 325.204582][T12094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 325.204598][T12094] Call Trace: [ 325.204606][T12094] [ 325.204617][T12094] dump_stack_lvl+0x100/0x190 [ 325.204662][T12094] should_fail_ex.cold+0x5/0xa [ 325.204701][T12094] should_failslab+0xc2/0x120 [ 325.204728][T12094] kmem_cache_alloc_noprof+0x92/0x6a0 [ 325.204766][T12094] ? mempool_init_node+0x2f7/0x6f0 [ 325.204795][T12094] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 325.204822][T12094] mempool_init_node+0x2f7/0x6f0 [ 325.204854][T12094] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 325.204878][T12094] ? __pfx_mempool_free_slab+0x10/0x10 [ 325.204904][T12094] mempool_init_noprof+0x3a/0x50 [ 325.204934][T12094] dm_integrity_ctr+0x140c/0x64b0 [ 325.204976][T12094] ? __pfx_dm_integrity_ctr+0x10/0x10 [ 325.205011][T12094] ? dm_split_args+0xc1/0x570 [ 325.205035][T12094] ? rcu_is_watching+0x13/0xc0 [ 325.205063][T12094] ? dm_split_args+0xc1/0x570 [ 325.205091][T12094] ? skip_spaces+0xee/0x130 [ 325.205132][T12094] dm_table_add_target+0x58b/0xee0 [ 325.205163][T12094] ? __pfx_dm_table_add_target+0x10/0x10 [ 325.205194][T12094] ? dm_table_create+0x2d3/0x3d0 [ 325.205222][T12094] table_load+0x3b9/0x7b0 [ 325.205265][T12094] ? __pfx_table_load+0x10/0x10 [ 325.205298][T12094] ? __might_fault+0xc5/0x140 [ 325.205335][T12094] ? __might_fault+0xc5/0x140 [ 325.205377][T12094] ctl_ioctl+0x4d2/0xcc0 [ 325.205412][T12094] ? __pfx_table_load+0x10/0x10 [ 325.205450][T12094] ? __pfx_ctl_ioctl+0x10/0x10 [ 325.205522][T12094] ? selinux_file_ioctl+0x1e0/0x290 [ 325.205566][T12094] dm_ctl_ioctl+0x22/0x30 [ 325.205596][T12094] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 325.205628][T12094] __x64_sys_ioctl+0x18e/0x210 [ 325.205670][T12094] do_syscall_64+0x123/0x790 [ 325.205698][T12094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.205724][T12094] RIP: 0033:0x7efe94d9f559 [ 325.205746][T12094] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.205770][T12094] RSP: 002b:00007efe95bae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 325.205804][T12094] RAX: ffffffffffffffda RBX: 00007efe95025fa0 RCX: 00007efe94d9f559 [ 325.205822][T12094] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000005 [ 325.205839][T12094] RBP: 00007efe94e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 325.205856][T12094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 325.205873][T12094] R13: 00007efe95026038 R14: 00007efe95025fa0 R15: 00007fffb839aa18 [ 325.205910][T12094] [ 325.207597][T12094] device-mapper: table: 248:2: integrity: Cannot allocate mempool (-ENOMEM) [ 325.207621][T12094] device-mapper: ioctl: error adding target to table [ 325.213178][ T31] audit: type=1400 audit(1793264556.211:1189): avc: denied { create } for pid=12103 comm="syz.2.1997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 325.216147][ T31] audit: type=1400 audit(1793264556.211:1190): avc: denied { bind } for pid=12103 comm="syz.2.1997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 325.218102][ T31] audit: type=1400 audit(1793264556.211:1191): avc: denied { listen } for pid=12103 comm="syz.2.1997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 325.228093][T12109] FAULT_INJECTION: forcing a failure. [ 325.228093][T12109] name failslab, interval 1, probability 0, space 0, times 0 [ 325.228120][T12109] CPU: 0 UID: 0 PID: 12109 Comm: syz.0.1998 Not tainted syzkaller #0 PREEMPT(full) [ 325.228144][T12109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 325.228160][T12109] Call Trace: [ 325.228168][T12109] [ 325.228178][T12109] dump_stack_lvl+0x100/0x190 [ 325.228225][T12109] should_fail_ex.cold+0x5/0xa [ 325.228264][T12109] should_failslab+0xc2/0x120 [ 325.228290][T12109] __kmalloc_cache_noprof+0x91/0x6d0 [ 325.228330][T12109] ? copy_cgroup_ns+0x1ed/0x970 [ 325.228364][T12109] copy_cgroup_ns+0x1ed/0x970 [ 325.228395][T12109] create_new_namespaces+0x34a/0xac0 [ 325.228436][T12109] unshare_nsproxy_namespaces+0xf6/0x210 [ 325.228472][T12109] ksys_unshare+0x44f/0x980 [ 325.228504][T12109] ? __pfx_ksys_unshare+0x10/0x10 [ 325.228550][T12109] __x64_sys_unshare+0x31/0x40 [ 325.228582][T12109] do_syscall_64+0x123/0x790 [ 325.228609][T12109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.228635][T12109] RIP: 0033:0x7f904bd9f559 [ 325.228655][T12109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.228679][T12109] RSP: 002b:00007f904cbb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 325.228702][T12109] RAX: ffffffffffffffda RBX: 00007f904c025fa0 RCX: 00007f904bd9f559 [ 325.228719][T12109] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000006000480 [ 325.228733][T12109] RBP: 00007f904be36b20 R08: 0000000000000000 R09: 0000000000000000 [ 325.228748][T12109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 325.228763][T12109] R13: 00007f904c026038 R14: 00007f904c025fa0 R15: 00007ffe4fb557e8 [ 325.228798][T12109] [ 325.413258][T11938] netdevsim netdevsim5 netdevsim0: renamed from eth5 [ 325.478933][T11938] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 325.497250][T11938] netdevsim netdevsim5 netdevsim1: renamed from eth6 [ 325.537621][T11938] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 325.543014][T11938] netdevsim netdevsim5 netdevsim2: renamed from eth7 [ 325.544766][ T31] audit: type=1400 audit(1793264556.541:1192): avc: denied { write } for pid=12108 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 325.608948][T11938] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 325.617564][T11938] netdevsim netdevsim5 netdevsim3: renamed from eth8 [ 325.672811][T11938] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 326.003444][T12122] syzkaller0: entered promiscuous mode [ 326.003462][T12122] syzkaller0: entered allmulticast mode [ 326.053607][T12122] tipc: Enabling of bearer rejected, failed to enable media [ 326.449528][ T31] audit: type=1400 audit(1793264557.451:1193): avc: denied { create } for pid=12144 comm="syz.3.2006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 326.508691][T12147] gadgetfs: bound to dummy_udc driver [ 326.619455][ T31] audit: type=1400 audit(1793264557.611:1194): avc: denied { listen } for pid=12144 comm="syz.3.2006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 326.643366][ T31] audit: type=1400 audit(1793264557.641:1195): avc: denied { accept } for pid=12144 comm="syz.3.2006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 326.902130][T12166] FAULT_INJECTION: forcing a failure. [ 326.902130][T12166] name failslab, interval 1, probability 0, space 0, times 0 [ 326.902163][T12166] CPU: 1 UID: 0 PID: 12166 Comm: syz.2.2011 Not tainted syzkaller #0 PREEMPT(full) [ 326.902193][T12166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 326.902206][T12166] Call Trace: [ 326.902216][T12166] [ 326.902228][T12166] dump_stack_lvl+0x100/0x190 [ 326.902276][T12166] should_fail_ex.cold+0x5/0xa [ 326.902316][T12166] should_failslab+0xc2/0x120 [ 326.902344][T12166] __kmalloc_cache_noprof+0x91/0x6d0 [ 326.902377][T12166] ? copy_cgroup_ns+0x3ef/0x970 [ 326.902404][T12166] ? copy_time_ns+0xed/0x780 [ 326.902447][T12166] copy_time_ns+0xed/0x780 [ 326.902486][T12166] create_new_namespaces+0x48a/0xac0 [ 326.902529][T12166] unshare_nsproxy_namespaces+0xf6/0x210 [ 326.902567][T12166] ksys_unshare+0x44f/0x980 [ 326.902600][T12166] ? __pfx_ksys_unshare+0x10/0x10 [ 326.902644][T12166] __x64_sys_unshare+0x31/0x40 [ 326.902674][T12166] do_syscall_64+0x123/0x790 [ 326.902719][T12166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.902746][T12166] RIP: 0033:0x7fde0ad9f559 [ 326.902768][T12166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 326.902793][T12166] RSP: 002b:00007fde0bc5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 326.902818][T12166] RAX: ffffffffffffffda RBX: 00007fde0b025fa0 RCX: 00007fde0ad9f559 [ 326.902834][T12166] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000006000480 [ 326.902848][T12166] RBP: 00007fde0ae36b20 R08: 0000000000000000 R09: 0000000000000000 [ 326.902862][T12166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 326.902877][T12166] R13: 00007fde0b026038 R14: 00007fde0b025fa0 R15: 00007ffe1fd1c8a8 [ 326.902910][T12166] [ 326.917899][T12136] futex_wake_op: syz.1.2004 tries to shift op by 144; fix this program [ 326.918071][T12136] futex_wake_op: syz.1.2004 tries to shift op by 144; fix this program [ 327.119977][T12171] jffs2: notice: (12171) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 327.479359][ C0] net_ratelimit: 22 callbacks suppressed [ 327.577002][T12189] syzkaller0: entered promiscuous mode [ 327.577021][T12189] syzkaller0: entered allmulticast mode [ 327.957134][T12193] overlayfs: statfs failed on './file0' [ 328.436565][T12216] FAULT_INJECTION: forcing a failure. [ 328.436565][T12216] name failslab, interval 1, probability 0, space 0, times 0 [ 328.436598][T12216] CPU: 1 UID: 0 PID: 12216 Comm: syz.3.2023 Not tainted syzkaller #0 PREEMPT(full) [ 328.436624][T12216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 328.436637][T12216] Call Trace: [ 328.436645][T12216] [ 328.436657][T12216] dump_stack_lvl+0x100/0x190 [ 328.436702][T12216] should_fail_ex.cold+0x5/0xa [ 328.436740][T12216] should_failslab+0xc2/0x120 [ 328.436773][T12216] __kmalloc_cache_noprof+0x91/0x6d0 [ 328.436808][T12216] ? copy_cgroup_ns+0x3ef/0x970 [ 328.436835][T12216] ? copy_time_ns+0xed/0x780 [ 328.436889][T12216] copy_time_ns+0xed/0x780 [ 328.436927][T12216] create_new_namespaces+0x48a/0xac0 [ 328.436968][T12216] unshare_nsproxy_namespaces+0xf6/0x210 [ 328.437007][T12216] ksys_unshare+0x44f/0x980 [ 328.437041][T12216] ? __pfx_ksys_unshare+0x10/0x10 [ 328.437086][T12216] __x64_sys_unshare+0x31/0x40 [ 328.437115][T12216] do_syscall_64+0x123/0x790 [ 328.437141][T12216] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.437167][T12216] RIP: 0033:0x7f597119f559 [ 328.437189][T12216] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.437214][T12216] RSP: 002b:00007f5972029028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 328.437240][T12216] RAX: ffffffffffffffda RBX: 00007f5971425fa0 RCX: 00007f597119f559 [ 328.437258][T12216] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000006000480 [ 328.437274][T12216] RBP: 00007f5971236b20 R08: 0000000000000000 R09: 0000000000000000 [ 328.437288][T12216] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.437302][T12216] R13: 00007f5971426038 R14: 00007f5971425fa0 R15: 00007fffc7b01f58 [ 328.437335][T12216] [ 329.733716][T11938] wireguard: wg0: Could not create IPv4 socket [ 329.756288][T11938] wireguard: wg1: Could not create IPv4 socket [ 329.785763][T11938] wireguard: wg2: Could not create IPv4 socket [ 329.823332][T12225] futex_wake_op: syz.3.2024 tries to shift op by 144; fix this program [ 329.823526][T12225] futex_wake_op: syz.3.2024 tries to shift op by 144; fix this program [ 330.042882][ T31] kauditd_printk_skb: 28 callbacks suppressed [ 330.042897][ T31] audit: type=1400 audit(1793264561.041:1224): avc: denied { write } for pid=12245 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 330.169248][T12248] syzkaller0: entered promiscuous mode [ 330.169269][T12248] syzkaller0: entered allmulticast mode [ 330.297098][ T31] audit: type=1400 audit(1793264561.291:1225): avc: denied { ioctl } for pid=12260 comm="syz.3.2035" path="/dev/uinput" dev="devtmpfs" ino=914 ioctlcmd=0x405c5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 330.434211][T12264] input: syz0 as /devices/virtual/input/input5 [ 330.880701][ T31] audit: type=1400 audit(1793264561.881:1226): avc: denied { write } for pid=12267 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 330.946329][T12284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.958900][T12284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.182934][ T31] audit: type=1400 audit(1793264562.181:1227): avc: denied { write } for pid=12286 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 331.855594][ T5628] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 331.861116][ T5628] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 331.877925][ T5628] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 331.904379][ T5628] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 331.907286][ T5628] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 332.386638][ T31] audit: type=1400 audit(1793264563.381:1228): avc: denied { write } for pid=12289 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 332.526805][ T13] Bluetooth: hci6: Frame reassembly failed (-84) [ 332.670469][ T31] audit: type=1400 audit(1793264563.671:1229): avc: denied { write } for pid=12320 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 332.764193][T10604] net_ratelimit: 34 callbacks suppressed [ 332.839174][ T5628] Bluetooth: hci0: command 0x0406 tx timeout [ 332.839333][ T5622] Bluetooth: hci0: Opcode 0x0c3a failed: -110 [ 332.876934][T12298] Failed to initialize the IGMP autojoin socket (err -2) [ 332.919194][ T5622] Bluetooth: hci1: command 0x1003 tx timeout [ 332.919326][ T4936] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 333.959279][ T4936] Bluetooth: hci5: command tx timeout [ 334.067284][ T31] audit: type=1400 audit(1793264565.061:1230): avc: denied { write } for pid=12328 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 334.201958][ T31] audit: type=1400 audit(1793264565.201:1231): avc: denied { write } for pid=12343 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 334.332591][T12331] futex_wake_op: syz.3.2045 tries to shift op by 144; fix this program [ 334.333333][T12331] futex_wake_op: syz.3.2045 tries to shift op by 144; fix this program [ 334.599632][ T5621] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 334.753304][ T31] audit: type=1400 audit(1793264565.751:1232): avc: denied { allowed } for pid=12352 comm="syz.2.2048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 334.897762][T12358] ubi0: attaching mtd0 [ 334.962233][T12358] ubi0: scanning is finished [ 334.962316][T12358] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 335.051981][ T5013] usb 1-1: USB disconnect, device number 5 [ 335.282125][T12298] netdevsim netdevsim5 netdevsim0: renamed from eth5 [ 335.307571][T12298] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 335.316342][T12298] netdevsim netdevsim5 netdevsim1: renamed from eth6 [ 335.363003][T12358] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 335.394011][ T31] audit: type=1400 audit(1793264566.391:1233): avc: denied { write } for pid=12349 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.407745][T12298] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 335.408717][T12298] netdevsim netdevsim5 netdevsim2: renamed from eth7 [ 335.463025][T12298] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 335.473487][T12298] netdevsim netdevsim5 netdevsim3: renamed from eth8 [ 335.507255][T12298] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 335.710073][ T31] audit: type=1400 audit(1793264566.701:1234): avc: denied { write } for pid=12375 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.039737][ T5621] Bluetooth: hci5: command tx timeout [ 336.863385][T12409] futex_wake_op: syz.0.2059 tries to shift op by 144; fix this program [ 336.863574][T12409] futex_wake_op: syz.0.2059 tries to shift op by 144; fix this program [ 337.074118][ T31] audit: type=1400 audit(1793264568.071:1235): avc: denied { write } for pid=12391 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 337.307198][ T31] audit: type=1400 audit(1793264568.301:1236): avc: denied { setopt } for pid=12371 comm="syz.2.2053" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 337.353135][T12385] 9pnet_virtio: no channels available for device syz [ 337.882842][ C0] net_ratelimit: 32 callbacks suppressed [ 338.119154][ T5621] Bluetooth: hci5: command tx timeout [ 338.999249][ T31] audit: type=1400 audit(1793264570.001:1237): avc: denied { write } for pid=12424 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 339.677780][T12450] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2067'. [ 339.971351][T12298] wireguard: wg0: Could not create IPv4 socket [ 339.982601][T12298] wireguard: wg1: Could not create IPv4 socket [ 339.994488][T12298] wireguard: wg2: Could not create IPv4 socket [ 340.100091][ T31] audit: type=1400 audit(1793264571.091:1238): avc: denied { write } for pid=12434 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 340.201661][ T5621] Bluetooth: hci5: command tx timeout [ 340.225184][T12457] FAULT_INJECTION: forcing a failure. [ 340.225184][T12457] name failslab, interval 1, probability 0, space 0, times 0 [ 340.225221][T12457] CPU: 1 UID: 0 PID: 12457 Comm: syz.0.2069 Not tainted syzkaller #0 PREEMPT(full) [ 340.225251][T12457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 340.225266][T12457] Call Trace: [ 340.225275][T12457] [ 340.225285][T12457] dump_stack_lvl+0x100/0x190 [ 340.225333][T12457] should_fail_ex.cold+0x5/0xa [ 340.225371][T12457] should_failslab+0xc2/0x120 [ 340.225396][T12457] kmem_cache_alloc_noprof+0x92/0x6a0 [ 340.225429][T12457] ? alloc_empty_file+0x5b/0x1c0 [ 340.225461][T12457] alloc_empty_file+0x5b/0x1c0 [ 340.225493][T12457] path_openat+0xd6/0x23f0 [ 340.225528][T12457] ? __pfx_path_openat+0x10/0x10 [ 340.225566][T12457] do_file_open+0x20e/0x430 [ 340.225598][T12457] ? __pfx_do_file_open+0x10/0x10 [ 340.225733][T12457] ? _raw_spin_unlock+0x28/0x50 [ 340.225776][T12457] ? alloc_fd+0x471/0x7a0 [ 340.225816][T12457] do_sys_openat2+0x163/0x1d0 [ 340.225851][T12457] ? __pfx_do_sys_openat2+0x10/0x10 [ 340.225886][T12457] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 340.225922][T12457] __x64_sys_openat+0x12d/0x210 [ 340.225956][T12457] ? __pfx___x64_sys_openat+0x10/0x10 [ 340.225995][T12457] do_syscall_64+0x123/0x790 [ 340.226020][T12457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.226046][T12457] RIP: 0033:0x7f904bd9f559 [ 340.226068][T12457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 340.226094][T12457] RSP: 002b:00007f904cbb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 340.226118][T12457] RAX: ffffffffffffffda RBX: 00007f904c025fa0 RCX: 00007f904bd9f559 [ 340.226138][T12457] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: ffffffffffffff9c [ 340.226156][T12457] RBP: 00007f904be36b20 R08: 0000000000000000 R09: 0000000000000000 [ 340.226173][T12457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 340.226188][T12457] R13: 00007f904c026038 R14: 00007f904c025fa0 R15: 00007ffe4fb557e8 [ 340.226225][T12457] [ 340.346632][ T31] audit: type=1400 audit(1793264571.341:1239): avc: denied { write } for pid=12468 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 340.955949][T12471] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 340.955983][T12471] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 340.958134][T12471] vhci_hcd vhci_hcd.0: Device attached [ 341.366820][T12474] vhci_hcd: connection closed [ 341.450233][ T1016] vhci_hcd vhci_hcd.1: stop threads [ 341.450347][ T1016] vhci_hcd vhci_hcd.1: release socket [ 341.452630][ T30] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 341.497958][ T1016] vhci_hcd vhci_hcd.1: disconnect device [ 342.217635][T12490] futex_wake_op: syz.0.2072 tries to shift op by 144; fix this program [ 342.217813][T12490] futex_wake_op: syz.0.2072 tries to shift op by 144; fix this program [ 342.576462][ T31] audit: type=1400 audit(1793264573.571:1240): avc: denied { write } for pid=12480 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 342.711527][ T31] audit: type=1400 audit(1793264573.711:1241): avc: denied { write } for pid=12505 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.057451][ T31] audit: type=1400 audit(1793264574.051:1242): avc: denied { write } for pid=12509 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.091226][ T1016] net_ratelimit: 57 callbacks suppressed [ 343.145957][ T31] audit: type=1400 audit(1793264574.141:1243): avc: denied { write } for pid=12520 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.284186][T12524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2080'. [ 343.284213][T12524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2080'. [ 343.342794][ T4936] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 343.344548][ T4936] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 343.346615][ T4936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 343.352562][ T4936] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 343.367005][ T4936] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 344.150944][ T31] audit: type=1400 audit(1793264575.151:1244): avc: denied { write } for pid=12535 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 344.311142][ T31] audit: type=1400 audit(1793264575.311:1245): avc: denied { write } for pid=12570 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 344.352467][T12530] Failed to initialize the IGMP autojoin socket (err -2) [ 344.941275][ T31] audit: type=1400 audit(1793264575.941:1246): avc: denied { write } for pid=12576 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 345.024947][T12597] futex_wake_op: syz.3.2089 tries to shift op by 144; fix this program [ 345.025106][T12597] futex_wake_op: syz.3.2089 tries to shift op by 144; fix this program [ 345.242871][ T31] audit: type=1400 audit(1793264576.241:1247): avc: denied { write } for pid=12599 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 345.411915][ T31] audit: type=1400 audit(1793264576.401:1248): avc: denied { map } for pid=12600 comm="syz.0.2091" path="/dev/ublkc2" dev="devtmpfs" ino=2872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 345.489897][ T5621] Bluetooth: hci1: command tx timeout [ 345.567417][T12612] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2094'. [ 345.746666][T12609] overlayfs: statfs failed on './file0' [ 346.239945][T12530] netdevsim netdevsim5 netdevsim0: renamed from eth5 [ 346.274589][T12530] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 346.275561][T12530] netdevsim netdevsim5 netdevsim1: renamed from eth6 [ 346.298702][ T31] audit: type=1400 audit(1793264577.301:1249): avc: denied { write } for pid=12616 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 346.339985][T12530] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 346.341039][T12530] netdevsim netdevsim5 netdevsim2: renamed from eth7 [ 346.373274][T12530] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 346.375335][T12530] netdevsim netdevsim5 netdevsim3: renamed from eth8 [ 346.406436][T12530] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 346.772652][T12647] syzkaller0: entered promiscuous mode [ 346.772674][T12647] syzkaller0: entered allmulticast mode [ 347.570187][ T5621] Bluetooth: hci1: command tx timeout [ 347.752983][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 347.753006][ T31] audit: type=1400 audit(1793264578.751:1253): avc: denied { write } for pid=12684 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 348.092497][ T31] audit: type=1400 audit(1793264579.061:1254): avc: denied { create } for pid=12686 comm="syz.0.2109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 348.092602][ T31] audit: type=1400 audit(1793264579.081:1255): avc: denied { bind } for pid=12686 comm="syz.0.2109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 348.092779][ T31] audit: type=1400 audit(1793264579.081:1256): avc: denied { write } for pid=12686 comm="syz.0.2109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 348.137032][T10604] net_ratelimit: 29 callbacks suppressed [ 348.228092][ T31] audit: type=1400 audit(1793264579.221:1257): avc: denied { setopt } for pid=12686 comm="syz.0.2109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 348.903224][T12698] netlink: 'syz.2.2111': attribute type 1 has an invalid length. [ 348.903268][T12698] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2111'. [ 349.106347][ T31] audit: type=1400 audit(1793264580.101:1258): avc: denied { read write } for pid=12705 comm="syz.0.2113" name="ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 349.111640][ T31] audit: type=1400 audit(1793264580.101:1259): avc: denied { open } for pid=12705 comm="syz.0.2113" path="/dev/ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 349.661574][ T5621] Bluetooth: hci1: command tx timeout [ 350.273067][T12723] kvm: user requested TSC rate below hardware speed [ 350.355564][ T31] audit: type=1400 audit(1793264581.351:1260): avc: denied { write } for pid=12694 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.438972][T12530] wireguard: wg0: Could not create IPv4 socket [ 350.455119][T12530] wireguard: wg1: Could not create IPv4 socket [ 350.466368][T12530] wireguard: wg2: Could not create IPv4 socket [ 350.518247][ T31] audit: type=1400 audit(1793264581.511:1261): avc: denied { write } for pid=12728 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 351.120078][ T31] audit: type=1400 audit(1793264582.121:1262): avc: denied { read } for pid=12748 comm="syz.0.2123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 352.118358][T12785] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2125'. [ 352.167338][T12780] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 352.167594][T12780] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 352.222391][T12780] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 352.222584][T12780] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 352.314541][T12792] FAULT_INJECTION: forcing a failure. [ 352.314541][T12792] name failslab, interval 1, probability 0, space 0, times 0 [ 352.314582][T12792] CPU: 0 UID: 0 PID: 12792 Comm: syz.3.2126 Not tainted syzkaller #0 PREEMPT(full) [ 352.314615][T12792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 352.314633][T12792] Call Trace: [ 352.314642][T12792] [ 352.314653][T12792] dump_stack_lvl+0x100/0x190 [ 352.314704][T12792] should_fail_ex.cold+0x5/0xa [ 352.314745][T12792] should_failslab+0xc2/0x120 [ 352.314775][T12792] kmem_cache_alloc_noprof+0x92/0x6a0 [ 352.314816][T12792] ? __pfx_map_id_range_down+0x10/0x10 [ 352.314860][T12792] ? rcu_is_watching+0x13/0xc0 [ 352.314891][T12792] ? security_inode_alloc+0x3b/0x2c0 [ 352.314935][T12792] security_inode_alloc+0x3b/0x2c0 [ 352.314973][T12792] inode_init_always_gfp+0xc6f/0xfb0 [ 352.315012][T12792] alloc_inode+0x8e/0x250 [ 352.315051][T12792] new_inode+0x22/0x1c0 [ 352.315094][T12792] bpf_get_inode+0x7b/0xf0 [ 352.315125][T12792] bpf_mkobj_ops+0xa0/0x2a0 [ 352.315158][T12792] bpf_fill_super+0x5e1/0x960 [ 352.315190][T12792] ? __pfx_bpf_fill_super+0x10/0x10 [ 352.315216][T12792] ? hook_capable+0x1bc/0x500 [ 352.315257][T12792] ? rcu_is_watching+0x13/0xc0 [ 352.315285][T12792] ? cap_capable+0x107/0x430 [ 352.315323][T12792] ? __pfx_bpf_fill_super+0x10/0x10 [ 352.315350][T12792] get_tree_nodev+0xdd/0x190 [ 352.315380][T12792] vfs_get_tree+0x92/0x320 [ 352.315418][T12792] vfs_cmd_create+0xd7/0x2a0 [ 352.315446][T12792] __do_sys_fsconfig+0x55a/0xcb0 [ 352.315484][T12792] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 352.315530][T12792] do_syscall_64+0x123/0x790 [ 352.315563][T12792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.315593][T12792] RIP: 0033:0x7f597119f559 [ 352.315617][T12792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 352.315644][T12792] RSP: 002b:00007f5971fe7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 352.315673][T12792] RAX: ffffffffffffffda RBX: 00007f5971426180 RCX: 00007f597119f559 [ 352.315692][T12792] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 000000000000000a [ 352.315709][T12792] RBP: 00007f5971236b20 R08: 0000000000000000 R09: 0000000000000000 [ 352.315727][T12792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 352.315743][T12792] R13: 00007f5971426218 R14: 00007f5971426180 R15: 00007fffc7b01f58 [ 352.315782][T12792] [ 352.377555][T12780] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 352.377748][T12780] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 352.532410][ T4936] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 352.562038][ T4936] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 352.841091][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 352.841128][ T31] audit: type=1400 audit(1793264583.751:1271): avc: denied { kexec_image_load } for pid=12790 comm="syz.2.2127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 352.868878][ T4936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 352.972728][ T4936] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 353.037062][ T4936] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 353.159310][ T147] net_ratelimit: 66 callbacks suppressed [ 353.249474][ T31] audit: type=1400 audit(1793264584.241:1272): avc: denied { write } for pid=12776 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 353.445853][T12818] ubi0: attaching mtd0 [ 353.448143][ T31] audit: type=1400 audit(1793264584.441:1273): avc: denied { write } for pid=12815 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 353.482400][T12818] ubi0: scanning is finished [ 353.482477][T12818] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 353.627767][T12818] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 353.641210][ T30] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 353.749510][ T31] audit: type=1400 audit(1793264584.751:1274): avc: denied { watch } for pid=12828 comm="syz.0.2133" path="/486" dev="tmpfs" ino=2501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 353.791786][ T30] usb 3-1: device descriptor read/64, error -71 [ 353.932635][T12834] FAULT_INJECTION: forcing a failure. [ 353.932635][T12834] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 353.932683][T12834] CPU: 1 UID: 0 PID: 12834 Comm: syz.0.2134 Not tainted syzkaller #0 PREEMPT(full) [ 353.932716][T12834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 353.932732][T12834] Call Trace: [ 353.932741][T12834] [ 353.932751][T12834] dump_stack_lvl+0x100/0x190 [ 353.932801][T12834] should_fail_ex.cold+0x5/0xa [ 353.932840][T12834] should_fail_alloc_page+0xeb/0x140 [ 353.932870][T12834] prepare_alloc_pages+0x1f0/0x5b0 [ 353.932910][T12834] __alloc_frozen_pages_noprof+0x1b1/0x3280 [ 353.932945][T12834] ? __pfx_get_page_from_freelist+0x10/0x10 [ 353.932982][T12834] ? rcu_is_watching+0x13/0xc0 [ 353.933010][T12834] ? trace_mm_page_alloc+0x164/0x1c0 [ 353.933051][T12834] ? __alloc_frozen_pages_noprof+0x306/0x3280 [ 353.933085][T12834] ? is_bpf_text_address+0x8a/0x1a0 [ 353.933111][T12834] ? lock_release+0x24d/0x310 [ 353.933141][T12834] ? bpf_ksym_find+0x128/0x1c0 [ 353.933172][T12834] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 353.933206][T12834] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 353.933240][T12834] ? is_bpf_text_address+0x94/0x1a0 [ 353.933270][T12834] ? kernel_text_address+0x8d/0x100 [ 353.933297][T12834] ? mark_held_locks+0x40/0x70 [ 353.933329][T12834] ? __kernel_text_address+0xd/0x30 [ 353.933358][T12834] ? unwind_get_return_address+0x59/0xa0 [ 353.933386][T12834] ? arch_stack_walk+0xa6/0xf0 [ 353.933423][T12834] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 353.933467][T12834] ? stack_trace_save+0x8e/0xc0 [ 353.933501][T12834] ? __pfx_stack_trace_save+0x10/0x10 [ 353.933551][T12834] alloc_pages_bulk_noprof+0x5f0/0x1480 [ 353.933594][T12834] ? policy_nodemask+0xed/0x5e0 [ 353.933626][T12834] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 353.933680][T12834] __kasan_populate_vmalloc+0xf0/0x210 [ 353.933722][T12834] alloc_vmap_area+0x963/0x2bc0 [ 353.933768][T12834] ? kasan_save_track+0x14/0x30 [ 353.933790][T12834] ? __kasan_kmalloc+0xaa/0xb0 [ 353.933827][T12834] ? __pfx_alloc_vmap_area+0x10/0x10 [ 353.933871][T12834] ? __get_vm_area_node+0x124/0x350 [ 353.933919][T12834] __get_vm_area_node+0x1ed/0x350 [ 353.933978][T12834] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 353.934006][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 353.934046][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 353.934083][T12834] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 353.934115][T12834] ? rcu_is_watching+0x13/0xc0 [ 353.934153][T12834] __kvmalloc_node_noprof+0x3da/0x9b0 [ 353.934191][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 353.934220][T12834] ? __kmalloc_noprof+0x350/0x840 [ 353.934256][T12834] ? __find_set_type_get+0x78/0x440 [ 353.934286][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 353.934320][T12834] hash_ipmac_create+0x40b/0x1280 [ 353.934352][T12834] ? __pfx_hash_ipmac_create+0x10/0x10 [ 353.934382][T12834] ip_set_create+0x6c4/0x1510 [ 353.934423][T12834] ? __pfx_ip_set_create+0x10/0x10 [ 353.934452][T12834] ? nfnetlink_rcv_msg+0x8ad/0x11e0 [ 353.934509][T12834] ? find_held_lock+0x2b/0x80 [ 353.934542][T12834] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 353.934587][T12834] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 353.934627][T12834] ? __lock_acquire+0x5c0/0x1f40 [ 353.934688][T12834] ? avc_has_perm_noaudit+0x145/0x470 [ 353.934727][T12834] netlink_rcv_skb+0x159/0x420 [ 353.934756][T12834] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 353.934793][T12834] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 353.934840][T12834] ? ns_capable+0xcd/0xf0 [ 353.934878][T12834] nfnetlink_rcv+0x1b3/0x440 [ 353.934922][T12834] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 353.934960][T12834] ? netlink_deliver_tap+0x1ae/0xb50 [ 353.934995][T12834] netlink_unicast+0x668/0x950 [ 353.935031][T12834] ? __pfx_netlink_unicast+0x10/0x10 [ 353.935070][T12834] netlink_sendmsg+0x9ac/0x10c0 [ 353.935107][T12834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 353.935145][T12834] ? selinux_socket_sendmsg+0x198/0x2f0 [ 353.935196][T12834] ? ____sys_sendmsg+0xa99/0xc30 [ 353.935231][T12834] ____sys_sendmsg+0xa99/0xc30 [ 353.935265][T12834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 353.935299][T12834] ? __pfx_____sys_sendmsg+0x10/0x10 [ 353.935350][T12834] ___sys_sendmsg+0x190/0x1e0 [ 353.935387][T12834] ? __pfx____sys_sendmsg+0x10/0x10 [ 353.935438][T12834] ? futex_wait+0x11e/0x370 [ 353.935487][T12834] ? find_held_lock+0x2b/0x80 [ 353.935534][T12834] __sys_sendmsg+0x160/0x210 [ 353.935561][T12834] ? __pfx___sys_sendmsg+0x10/0x10 [ 353.935605][T12834] do_syscall_64+0x123/0x790 [ 353.935632][T12834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.935659][T12834] RIP: 0033:0x7f904bd9f559 [ 353.935682][T12834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.935710][T12834] RSP: 002b:00007f904cbb5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 353.935736][T12834] RAX: ffffffffffffffda RBX: 00007f904c025fa0 RCX: 00007f904bd9f559 [ 353.935754][T12834] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 353.935769][T12834] RBP: 00007f904be36b20 R08: 0000000000000000 R09: 0000000000000000 [ 353.935785][T12834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 353.935798][T12834] R13: 00007f904c026038 R14: 00007f904c025fa0 R15: 00007ffe4fb557e8 [ 353.935830][T12834] [ 353.985876][T12794] Failed to initialize the IGMP autojoin socket (err -2) [ 354.018019][T12834] syz.0.2134: vmalloc error: size 4194344, align 0x200000, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=syz0 [ 354.033259][T12834] ,mems_allowed=0-1 [ 354.033314][T12834] CPU: 1 UID: 0 PID: 12834 Comm: syz.0.2134 Not tainted syzkaller #0 PREEMPT(full) [ 354.033346][T12834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 354.033363][T12834] Call Trace: [ 354.033372][T12834] [ 354.033383][T12834] dump_stack_lvl+0x100/0x190 [ 354.033430][T12834] warn_alloc.cold+0x9e/0xb2 [ 354.033467][T12834] ? __pfx_warn_alloc+0x10/0x10 [ 354.033501][T12834] ? lockdep_hardirqs_on+0x7d/0x110 [ 354.033545][T12834] ? __get_vm_area_node+0x2f0/0x350 [ 354.033593][T12834] ? __get_vm_area_node+0x22b/0x350 [ 354.033642][T12834] __vmalloc_node_range_noprof+0xdc6/0x1440 [ 354.033682][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 354.033730][T12834] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 354.033853][T12834] ? rcu_is_watching+0x13/0xc0 [ 354.033894][T12834] __kvmalloc_node_noprof+0x3da/0x9b0 [ 354.033947][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 354.033979][T12834] ? __kmalloc_noprof+0x350/0x840 [ 354.034015][T12834] ? __find_set_type_get+0x78/0x440 [ 354.034047][T12834] ? hash_ipmac_create+0x40b/0x1280 [ 354.034083][T12834] hash_ipmac_create+0x40b/0x1280 [ 354.034116][T12834] ? __pfx_hash_ipmac_create+0x10/0x10 [ 354.034170][T12834] ip_set_create+0x6c4/0x1510 [ 354.034212][T12834] ? __pfx_ip_set_create+0x10/0x10 [ 354.034242][T12834] ? nfnetlink_rcv_msg+0x8ad/0x11e0 [ 354.034302][T12834] ? find_held_lock+0x2b/0x80 [ 354.034341][T12834] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 354.034477][T12834] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 354.034521][T12834] ? __lock_acquire+0x5c0/0x1f40 [ 354.034587][T12834] ? avc_has_perm_noaudit+0x145/0x470 [ 354.034626][T12834] netlink_rcv_skb+0x159/0x420 [ 354.034657][T12834] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 354.034698][T12834] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 354.034741][T12834] ? ns_capable+0xcd/0xf0 [ 354.034770][T12834] nfnetlink_rcv+0x1b3/0x440 [ 354.034803][T12834] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 354.034834][T12834] ? netlink_deliver_tap+0x1ae/0xb50 [ 354.034865][T12834] netlink_unicast+0x668/0x950 [ 354.034899][T12834] ? __pfx_netlink_unicast+0x10/0x10 [ 354.034934][T12834] netlink_sendmsg+0x9ac/0x10c0 [ 354.034965][T12834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.035002][T12834] ? selinux_socket_sendmsg+0x198/0x2f0 [ 354.035043][T12834] ? ____sys_sendmsg+0xa99/0xc30 [ 354.035074][T12834] ____sys_sendmsg+0xa99/0xc30 [ 354.035107][T12834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.035141][T12834] ? __pfx_____sys_sendmsg+0x10/0x10 [ 354.035191][T12834] ___sys_sendmsg+0x190/0x1e0 [ 354.035229][T12834] ? __pfx____sys_sendmsg+0x10/0x10 [ 354.035288][T12834] ? futex_wait+0x11e/0x370 [ 354.035332][T12834] ? find_held_lock+0x2b/0x80 [ 354.035378][T12834] __sys_sendmsg+0x160/0x210 [ 354.035410][T12834] ? __pfx___sys_sendmsg+0x10/0x10 [ 354.035458][T12834] do_syscall_64+0x123/0x790 [ 354.035488][T12834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.035519][T12834] RIP: 0033:0x7f904bd9f559 [ 354.035542][T12834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 354.035568][T12834] RSP: 002b:00007f904cbb5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 354.035607][T12834] RAX: ffffffffffffffda RBX: 00007f904c025fa0 RCX: 00007f904bd9f559 [ 354.035626][T12834] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 354.035643][T12834] RBP: 00007f904be36b20 R08: 0000000000000000 R09: 0000000000000000 [ 354.035660][T12834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 354.035677][T12834] R13: 00007f904c026038 R14: 00007f904c025fa0 R15: 00007ffe4fb557e8 [ 354.035713][T12834] [ 354.053049][ T30] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 354.097985][T12834] Mem-Info: [ 354.098004][T12834] active_anon:10094 inactive_anon:0 isolated_anon:0 [ 354.098004][T12834] active_file:0 inactive_file:57809 isolated_file:0 [ 354.098004][T12834] unevictable:0 dirty:347 writeback:0 [ 354.098004][T12834] slab_reclaimable:12810 slab_unreclaimable:104616 [ 354.098004][T12834] mapped:30247 shmem:1677 pagetables:1327 [ 354.098004][T12834] sec_pagetables:0 bounce:0 [ 354.098004][T12834] kernel_misc_reclaimable:0 [ 354.098004][T12834] free:1292870 free_pcp:8114 free_cma:0 [ 354.098073][T12834] Node 0 active_anon:40376kB inactive_anon:0kB active_file:0kB inactive_file:231048kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:120988kB dirty:1388kB writeback:0kB shmem:6708kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12800kB pagetables:5160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 354.098140][T12834] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:188kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 354.098201][T12834] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 354.098270][T12834] lowmem_reserve[]: 0 2447 2449 2449 2449 [ 354.098309][T12834] Node 0 DMA32 free:1214876kB boost:0kB min:33784kB low:42228kB high:50672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:40376kB inactive_anon:0kB active_file:0kB inactive_file:231048kB unevictable:0kB writepending:1388kB zspages:0kB present:3129332kB managed:2506512kB mlocked:0kB bounce:0kB free_pcp:30548kB local_pcp:15720kB free_cma:0kB [ 354.098402][T12834] lowmem_reserve[]: 0 0 1 1 1 [ 354.098444][T12834] Node 0 Normal free:24kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1764kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:4kB free_cma:0kB [ 354.098514][T12834] lowmem_reserve[]: 0 0 0 0 0 [ 354.098555][T12834] Node 1 Normal free:3941220kB boost:0kB min:56088kB low:70108kB high:84128kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:188kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:1900kB local_pcp:1180kB free_cma:0kB [ 354.098616][T12834] lowmem_reserve[]: 0 0 0 0 0 [ 354.098655][T12834] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 354.098826][T12834] Node 0 DMA32: 2250*4kB (UM) 994*8kB (UME) 646*16kB (UME) 829*32kB (UME) 582*64kB (UM) 229*128kB (UM) 93*256kB (UME) 23*512kB (UME) 0*1024kB 1*2048kB (M) 258*4096kB (UM) = 1214776kB [ 354.099074][T12834] Node 0 Normal: 2*4kB (U) 2*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 354.099203][T12834] Node 1 Normal: 2*4kB (UM) 1*8kB (U) 0*16kB 1*32kB (U) 2*64kB (U) 3*128kB (U) 5*256kB (UM) 4*512kB (UM) 1*1024kB (M) 0*2048kB 961*4096kB (UM) = 3941168kB [ 354.099371][T12834] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 354.099391][T12834] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 354.099410][T12834] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 354.099429][T12834] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 354.108054][T12834] 59482 total pagecache pages [ 354.108067][T12834] 0 pages in swap cache [ 354.108076][T12834] Free swap = 124996kB [ 354.108086][T12834] Total swap = 124996kB [ 354.108097][T12834] 2097051 pages RAM [ 354.108106][T12834] 0 pages HighMem/MovableOnly [ 354.108115][T12834] 438366 pages reserved [ 354.108139][T12834] 0 pages cma reserved [ 354.189652][ T30] usb 3-1: device descriptor read/64, error -71 [ 354.207592][ T5621] Bluetooth: hci3: command 0x0406 tx timeout [ 354.300534][ T30] usb usb3-port1: attempt power cycle [ 354.445861][ T5621] Bluetooth: hci4: command 0x0406 tx timeout [ 354.445924][ T5621] Bluetooth: hci2: command 0x0406 tx timeout [ 354.713988][ T31] audit: type=1400 audit(1793264585.711:1275): avc: denied { write } for pid=12825 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 354.716302][ T30] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 354.763627][ T30] usb 3-1: device descriptor read/8, error -71 [ 354.934877][T12853] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2137'. [ 355.273901][ T4936] Bluetooth: hci1: command tx timeout [ 355.435898][ T30] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 355.503498][ T30] usb 3-1: device descriptor read/8, error -71 [ 355.507712][ T4936] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 355.528018][ T31] audit: type=1400 audit(1793264586.521:1276): avc: denied { write } for pid=12854 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 355.731382][ T30] usb usb3-port1: unable to enumerate USB device [ 355.815353][ T31] audit: type=1400 audit(1793264586.811:1277): avc: denied { append } for pid=12863 comm="syz.1.2140" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 356.075156][T12881] ubi0: attaching mtd0 [ 356.088154][T12881] ubi0: scanning is finished [ 356.088221][T12881] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 356.269597][T12886] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) ! [ 356.270528][T12886] syzkaller0: entered promiscuous mode [ 356.270548][T12886] syzkaller0: entered allmulticast mode [ 356.276069][T12886] tipc: Enabled bearer , priority 0 [ 356.292513][ T4936] Bluetooth: hci3: command 0x0406 tx timeout [ 356.312592][T12886] tipc: Resetting bearer [ 356.316067][T12885] tipc: Resetting bearer [ 356.363817][T12885] tipc: Disabling bearer [ 356.405462][T12881] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 356.519740][ T4936] Bluetooth: hci2: command 0x0406 tx timeout [ 356.519781][ T4936] Bluetooth: hci4: command 0x0406 tx timeout [ 356.627723][T12794] netdevsim netdevsim5 netdevsim0: renamed from eth5 [ 356.639721][ T61] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 356.653338][T12794] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 356.654250][T12794] netdevsim netdevsim5 netdevsim1: renamed from eth6 [ 356.684576][T12794] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 356.687633][T12794] netdevsim netdevsim5 netdevsim2: renamed from eth7 [ 356.713279][T12794] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 356.717761][T12794] netdevsim netdevsim5 netdevsim3: renamed from eth8 [ 356.738039][T12794] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 356.756647][ T31] audit: type=1400 audit(1793264587.751:1278): avc: denied { write } for pid=12869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 356.790794][ T61] usb 4-1: New USB device found: idVendor=0711, idProduct=0900, bcdDevice=1.00 [ 356.792581][ T61] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 356.792612][ T61] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 356.796152][ T61] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.796177][ T61] usb 4-1: Product: syz [ 356.796196][ T61] usb 4-1: Manufacturer: syz [ 356.796214][ T61] usb 4-1: SerialNumber: syz [ 357.024085][T12904] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2149'. [ 357.062012][ T61] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 357.101601][ T31] audit: type=1400 audit(1793264588.091:1279): avc: denied { write } for pid=12901 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 357.205768][T12906] overlayfs: statfs failed on './file0' [ 357.283991][ T31] audit: type=1400 audit(1793264588.281:1280): avc: denied { read write } for pid=12887 comm="syz.3.2145" name="lp0" dev="devtmpfs" ino=2884 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 357.329309][ T5621] Bluetooth: hci1: command tx timeout [ 357.528289][T12921] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 357.551291][ T61] usb 4-1: USB disconnect, device number 3 [ 357.586134][ T61] usblp0: removed [ 357.973559][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 357.973579][ T31] audit: type=1400 audit(1793264588.971:1283): avc: denied { write } for pid=12944 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 358.280435][ T1016] net_ratelimit: 24 callbacks suppressed [ 358.483877][T12794] wireguard: wg0: Could not create IPv4 socket [ 358.496669][T12794] wireguard: wg1: Could not create IPv4 socket [ 358.506539][ T5621] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 358.524814][T12794] wireguard: wg2: Could not create IPv4 socket [ 358.676728][T12969] gadgetfs: bound to dummy_udc driver [ 358.743082][ T31] audit: type=1400 audit(1793264589.741:1284): avc: denied { write } for pid=12951 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 358.858904][ T31] audit: type=1400 audit(1793264589.851:1285): avc: denied { write } for pid=12972 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 359.300397][T12982] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2160'. [ 359.622380][ T31] audit: type=1400 audit(1793264590.621:1286): avc: denied { write } for pid=12977 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 359.692764][ T31] audit: type=1400 audit(1793264590.691:1287): avc: denied { write } for pid=12994 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 359.948181][ T31] audit: type=1400 audit(1793264590.941:1288): avc: denied { write } for pid=12997 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 360.024180][ T31] audit: type=1400 audit(1793264591.021:1289): avc: denied { write } for pid=13008 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 360.282822][ T31] audit: type=1400 audit(1793264591.281:1290): avc: denied { write } for pid=13011 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 360.341687][ T31] audit: type=1400 audit(1793264591.341:1291): avc: denied { write } for pid=13022 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 360.597749][ T4936] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 360.617586][ T4936] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 360.619743][ T4936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 360.636711][ T4936] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 360.637815][ T4936] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 360.973912][ T31] audit: type=1400 audit(1793264591.971:1292): avc: denied { sqpoll } for pid=13053 comm="syz.1.2170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 361.345289][ T4936] Bluetooth: hci3: unexpected event for opcode 0x1002 [ 361.507355][T13035] Failed to initialize the IGMP autojoin socket (err -2) [ 362.012389][T13128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2175'. [ 363.306131][ T4936] Bluetooth: hci1: command tx timeout [ 363.331428][ T87] net_ratelimit: 32 callbacks suppressed [ 363.729387][ T30] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 363.891091][ T30] usb 1-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 363.891132][ T30] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 363.896035][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.896094][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.896125][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.903301][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.903347][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.903385][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.905130][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.905174][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.905206][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.916936][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.916982][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.917014][ ** replaying previous printk message ** [ 363.917014][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.918865][T13147] sending frame ffff88807dc44000, count=4096 [ 363.918884][T13147] frame ffff88807dc44000 completed [ 363.918923][T13147] n_hdlc_tty_write() called count=32768 [ 363.918938][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 363.920013][T13147] sending frame ffff88807dc40000, count=4096 [ 363.920032][T13147] frame ffff88807dc40000 completed [ 363.920054][T13147] n_hdlc_tty_write() called count=28672 [ 363.920085][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 363.920107][T13147] sending frame ffff888037980000, count=4096 [ 363.921601][T13147] frame ffff888037980000 completed [ 363.921642][T13147] n_hdlc_tty_write() called count=24576 [ 363.921657][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 363.921678][T13147] sending frame ffff88807dc44000, count=4096 [ 363.921694][T13147] frame ffff88807dc44000 completed [ 363.923770][T13147] n_hdlc_tty_write() called count=20480 [ 363.923788][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 363.923811][T13147] sending frame ffff88807dc40000, count=4096 [ 363.923844][T13147] frame ffff88807dc40000 completed [ 363.923862][T13147] n_hdlc_tty_write() called count=16384 [ 363.924833][T13147] n_hdlc_tty_write: truncating user packet from 16384 to 4096 [ 363.924857][T13147] sending frame ffff888037980000, count=4096 [ 363.924873][T13147] frame ffff888037980000 completed [ 363.924891][T13147] n_hdlc_tty_write() called count=12288 [ 363.924905][T13147] n_hdlc_tty_write: truncating user packet from 12288 to 4096 [ 363.925967][T13147] sending frame ffff88807dc44000, count=4096 [ 363.925985][T13147] frame ffff88807dc44000 completed [ 363.926012][T13147] n_hdlc_tty_write() called count=8192 [ 363.926026][T13147] n_hdlc_tty_write: truncating user packet from 8192 to 4096 [ 363.926096][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.926126][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 262144, area = ffffc900022e2000 [ 363.926165][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 524288, area = ffffc90005c2a000 [ 363.926192][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.927233][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.927257][ C1] kcov: kcov_start: t = ffff88807f028000, size = 262144, area = ffffc900022e2000 [ 363.927293][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 29 [ 363.927400][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.927445][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.927476][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.931790][T13147] sending frame ffff88807dc40000, count=4096 [ 363.931810][T13147] frame ffff88807dc40000 completed [ 363.931829][T13147] n_hdlc_tty_write() called count=4096 [ 363.931864][T13147] sending frame ffff888037980000, count=4096 [ 363.931879][T13147] frame ffff888037980000 completed [ 363.933617][T13147] n_hdlc_tty_write() called count=65536 [ 363.933633][T13147] n_hdlc_tty_write: truncating user packet from 65536 to 4096 [ 363.934295][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.934319][ C1] kcov: kcov_start: t = ffff888029950000, size = 262144, area = ffffc900022e2000 [ 363.934356][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 29 [ 363.934514][T13147] sending frame ffff88807dc44000, count=4096 [ 363.934540][T13147] frame ffff88807dc44000 completed [ 363.934567][T13147] n_hdlc_tty_write() called count=61440 [ 363.934581][T13147] n_hdlc_tty_write: truncating user packet from 61440 to 4096 [ 363.934602][T13147] sending frame ffff88807dc40000, count=4096 [ 363.935311][T13147] frame ffff88807dc40000 completed [ 363.935338][T13147] n_hdlc_tty_write() called count=57344 [ 363.935353][T13147] n_hdlc_tty_write: truncating user packet from 57344 to 4096 [ 363.935382][T13147] sending frame ffff888037980000, count=4096 [ 363.935399][T13147] frame ffff888037980000 completed [ 363.935657][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.935680][ C1] kcov: kcov_start: t = ffff88807f028000, size = 262144, area = ffffc900022e2000 [ 363.935715][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 29 [ 363.935786][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.935831][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.935861][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.936650][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.936673][ C1] kcov: kcov_start: t = ffff888029950000, size = 262144, area = ffffc900022e2000 [ 363.936717][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 29 [ 363.936997][T13147] n_hdlc_tty_write() called count=53248 [ 363.937013][T13147] n_hdlc_tty_write: truncating user packet from 53248 to 4096 [ 363.939806][T13147] sending frame ffff88807dc44000, count=4096 [ 363.939829][T13147] frame ffff88807dc44000 completed [ 363.939854][T13147] n_hdlc_tty_write() called count=49152 [ 363.939869][T13147] n_hdlc_tty_write: truncating user packet from 49152 to 4096 [ 363.940786][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.940811][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 262144, area = ffffc900022e2000 [ 363.940851][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 524288, area = ffffc90005c2a000 [ 363.940878][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.941616][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.941663][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.941695][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.944217][T13147] sending frame ffff88807dc40000, count=4096 [ 363.944238][T13147] frame ffff88807dc40000 completed [ 363.944263][T13147] n_hdlc_tty_write() called count=45056 [ 363.944278][T13147] n_hdlc_tty_write: truncating user packet from 45056 to 4096 [ 363.944346][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.944369][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 262144, area = ffffc900022e2000 [ 363.944407][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 524288, area = ffffc90005c2a000 [ 363.944433][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.945308][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.945332][ C1] kcov: kcov_start: t = ffff8880283a4b00, size = 262144, area = ffffc900022e2000 [ 363.945368][ C1] kcov: kcov_start: t = ffff8880283a4b00, size = 524288, area = ffffc90005829000 [ 363.945394][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.945476][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.945521][ T30] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 363.945551][ T30] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.945967][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.945991][ C1] kcov: kcov_start: t = ffff8880283a4b00, size = 262144, area = ffffc900022e2000 [ 363.946025][ C1] kcov: kcov_start: t = ffff8880283a4b00, size = 524288, area = ffffc90005829000 [ 363.946051][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.946123][ T30] usb 1-1: default language 0x0409 [ 363.948534][T13147] sending frame ffff888037980000, count=4096 [ 363.948555][T13147] frame ffff888037980000 completed [ 363.948595][T13147] n_hdlc_tty_write() called count=40960 [ 363.948610][T13147] n_hdlc_tty_write: truncating user packet from 40960 to 4096 [ 363.948633][T13147] sending frame ffff88807dc44000, count=4096 [ 363.948905][T13147] frame ffff88807dc44000 completed [ 363.948928][T13147] n_hdlc_tty_write() called count=36864 [ 363.948941][T13147] n_hdlc_tty_write: truncating user packet from 36864 to 4096 [ 363.948963][T13147] sending frame ffff88807dc40000, count=4096 [ 363.948979][T13147] frame ffff88807dc40000 completed [ 363.949110][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.949132][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 262144, area = ffffc900022e2000 [ 363.949171][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 524288, area = ffffc90005c2a000 [ 363.949197][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.949797][ T988] raw-gadget.1 gadget.2: gadget resumed [ 363.949850][ T988] dummy_hcd dummy_hcd.2: port status 0x00100303 has changes [ 363.949966][ C1] kcov: kcov_remote_start: handle = 100000000000003, context: softirq [ 363.949989][ C1] kcov: kcov_start: t = ffff88801feccb00, size = 262144, area = ffffc900022e2000 [ 363.950054][ C1] kcov: kcov_move_area: ffffc900187b0000 1048576 <= ffffc900022e2000 209 [ 363.950290][ C1] kcov: kcov_remote_start: handle = 100000000000003, context: softirq [ 363.950314][ C1] kcov: kcov_start: t = ffff88801feccb00, size = 262144, area = ffffc900022e2000 [ 363.950343][ C1] kcov: kcov_move_area: ffffc900187b0000 1048576 <= ffffc900022e2000 4 [ 363.950526][ C1] kcov: kcov_remote_start: handle = 100000000000003, context: softirq [ 363.950548][ C1] kcov: kcov_start: t = ffff88801feccb00, size = 262144, area = ffffc900022e2000 [ 363.950577][ C1] kcov: kcov_move_area: ffffc900187b0000 1048576 <= ffffc900022e2000 4 [ 363.951897][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.951921][ C1] kcov: kcov_start: t = ffff88807f028000, size = 262144, area = ffffc900022e2000 [ 363.951956][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 29 [ 363.952753][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.952776][ C1] kcov: kcov_start: t = ffff888034d6cb00, size = 262144, area = ffffc900022e2000 [ 363.952810][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 37 [ 363.952899][ T30] usb 1-1: udev 6, busnum 1, minor = 5 [ 363.952923][ T30] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 363.952948][ T30] usb 1-1: Product: syz [ 363.952964][ T30] usb 1-1: Manufacturer: syz [ 363.952980][ T30] usb 1-1: SerialNumber: syz [ 363.953012][ T30] device: '1-1': device_add [ 363.953030][ T30] kobject: '1-1' (ffff88807e3a90b0): kobject_add_internal: parent: 'usb1', set: 'devices' [ 363.953114][ T30] usb 1-1: ACPI companion not found [ 363.953979][ T30] bus: 'usb': add device 1-1 [ 363.954207][ T30] PM: Adding info for usb:1-1 [ 363.955539][T13147] n_hdlc_tty_write() called count=32768 [ 363.955556][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 363.955579][T13147] sending frame ffff888037980000, count=4096 [ 363.955595][T13147] frame ffff888037980000 completed [ 363.955614][T13147] n_hdlc_tty_write() called count=28672 [ 363.955628][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 363.957409][T13147] sending frame ffff88807dc44000, count=4096 [ 363.957428][T13147] frame ffff88807dc44000 completed [ 363.957448][T13147] n_hdlc_tty_write() called count=24576 [ 363.957467][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 363.957489][T13147] sending frame ffff88807dc40000, count=4096 [ 363.957504][T13147] frame ffff88807dc40000 completed [ 363.957543][T13147] n_hdlc_tty_write() called count=20480 [ 363.957558][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 363.957580][T13147] sending frame ffff888037980000, count=4096 [ 363.957595][T13147] frame ffff888037980000 completed [ 363.957613][T13147] n_hdlc_tty_write() called count=16384 [ 363.957627][T13147] n_hdlc_tty_write: truncating user packet from 16384 to 4096 [ 363.958028][T13147] sending frame ffff88807dc44000, count=4096 [ 363.958045][T13147] frame ffff88807dc44000 completed [ 363.958063][T13147] n_hdlc_tty_write() called count=12288 [ 363.958077][T13147] n_hdlc_tty_write: truncating user packet from 12288 to 4096 [ 363.958098][T13147] sending frame ffff88807dc40000, count=4096 [ 363.958114][T13147] frame ffff88807dc40000 completed [ 363.959432][T13147] n_hdlc_tty_write() called count=8192 [ 363.959449][T13147] n_hdlc_tty_write: truncating user packet from 8192 to 4096 [ 363.959477][T13147] sending frame ffff888037980000, count=4096 [ 363.959494][T13147] frame ffff888037980000 completed [ 363.959510][T13147] n_hdlc_tty_write() called count=4096 [ 363.959528][T13147] sending frame ffff88807dc44000, count=4096 [ 363.959566][T13147] frame ffff88807dc44000 completed [ 363.959642][T13147] n_hdlc_tty_write() called count=65536 [ 363.959656][T13147] n_hdlc_tty_write: truncating user packet from 65536 to 4096 [ 363.959698][T13147] sending frame ffff88807dc40000, count=4096 [ 363.959714][T13147] frame ffff88807dc40000 completed [ 363.959736][T13147] n_hdlc_tty_write() called count=61440 [ 363.959750][T13147] n_hdlc_tty_write: truncating user packet from 61440 to 4096 [ 363.959771][T13147] sending frame ffff888037980000, count=4096 [ 363.959787][T13147] frame ffff888037980000 completed [ 363.959830][T13147] n_hdlc_tty_write() called count=57344 [ 363.959844][T13147] n_hdlc_tty_write: truncating user packet from 57344 to 4096 [ 363.959866][T13147] sending frame ffff88807dc44000, count=4096 [ 363.959881][T13147] frame ffff88807dc44000 completed [ 363.959902][T13147] n_hdlc_tty_write() called count=53248 [ 363.959916][T13147] n_hdlc_tty_write: truncating user packet from 53248 to 4096 [ 363.959956][T13147] sending frame ffff88807dc40000, count=4096 [ 363.959971][T13147] frame ffff88807dc40000 completed [ 363.959992][T13147] n_hdlc_tty_write() called count=49152 [ 363.960006][T13147] n_hdlc_tty_write: truncating user packet from 49152 to 4096 [ 363.960027][T13147] sending frame ffff888037980000, count=4096 [ 363.960043][T13147] frame ffff888037980000 completed [ 363.961164][T13147] n_hdlc_tty_write() called count=45056 [ 363.961181][T13147] n_hdlc_tty_write: truncating user packet from 45056 to 4096 [ 363.961205][T13147] sending frame ffff88807dc44000, count=4096 [ 363.961222][T13147] frame ffff88807dc44000 completed [ 363.961241][T13147] n_hdlc_tty_write() called count=40960 [ 363.961272][T13147] n_hdlc_tty_write: truncating user packet from 40960 to 4096 [ 363.961516][ T30] kobject: '1-1' (ffff88807e3a90b0): kobject_uevent_env [ 363.961561][ T30] kobject: '1-1' (ffff88807e3a90b0): fill_kobj_path: path = '/devices/platform/dummy_hcd.0/usb1/1-1' [ 363.963003][T13147] sending frame ffff88807dc40000, count=4096 [ 363.963023][T13147] frame ffff88807dc40000 completed [ 363.963047][T13147] n_hdlc_tty_write() called count=36864 [ 363.963061][T13147] n_hdlc_tty_write: truncating user packet from 36864 to 4096 [ 363.963083][T13147] sending frame ffff888037980000, count=4096 [ 363.963098][T13147] frame ffff888037980000 completed [ 363.963568][ T30] usb 1-1: bus: 'usb': __driver_probe_device: matched device with driver usb [ 363.963602][ T30] usb 1-1: bus: 'usb': really_probe: probing driver usb with device [ 363.963724][ T30] usb 1-1: usb_probe_device [ 363.963746][ T30] usb 1-1: configuration #0 chosen from 8 choices [ 363.963769][ T30] usb 1-1: config 0 descriptor?? [ 363.965280][T13147] n_hdlc_tty_write() called count=32768 [ 363.965298][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 363.965320][T13147] sending frame ffff88807dc44000, count=4096 [ 363.965336][T13147] frame ffff88807dc44000 completed [ 363.965356][T13147] n_hdlc_tty_write() called count=28672 [ 363.965370][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 363.967255][T13147] sending frame ffff88807dc40000, count=4096 [ 363.967274][T13147] frame ffff88807dc40000 completed [ 363.967296][T13147] n_hdlc_tty_write() called count=24576 [ 363.967311][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 363.967332][T13147] sending frame ffff888037980000, count=4096 [ 363.969526][T13150] dummy_udc dummy_udc.0: enabled ep-bin (ep13in-intr) maxpacket 134 stream disabled [ 363.969669][T13147] frame ffff888037980000 completed [ 363.969693][T13147] n_hdlc_tty_write() called count=20480 [ 363.969708][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 363.969730][T13147] sending frame ffff88807dc44000, count=4096 [ 363.969746][T13147] frame ffff88807dc44000 completed [ 363.969764][T13147] n_hdlc_tty_write() called count=16384 [ 363.969840][ C1] kcov: kcov_remote_start: handle = 100000000000001, context: softirq [ 363.969864][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 262144, area = ffffc900022e2000 [ 363.969899][ C1] kcov: kcov_start: t = ffff888053ce0000, size = 524288, area = ffffc90005c2a000 [ 363.969928][ C1] kcov: kcov_move_area: ffffc90019bb3000 1048576 <= ffffc900022e2000 25 [ 363.970880][T13035] IPv6: walker ffffc90003a4f148 adjusted by delroute [ 363.970898][T13035] IPv6: fixing tree: plen=128 iter=0 [ 363.970914][T13035] IPv6: W ffffc90003a4f148 adjusted by delnode 1, s=4/2 [ 363.970933][T13035] IPv6: fixing tree: plen=68 iter=1 [ 363.970946][T13035] IPv6: W ffffc90003a4f148 adjusted by delnode 2, s=2 [ 363.970962][T13035] IPv6: fixing tree: plen=67 iter=2 [ 363.971344][T13035] IPv6: walker ffffc90003a4f148 adjusted by delroute [ 363.974954][T13147] n_hdlc_tty_write: truncating user packet from 16384 to 4096 [ 363.974983][T13147] sending frame ffff88807dc40000, count=4096 [ 363.974999][T13147] frame ffff88807dc40000 completed [ 363.975019][T13147] n_hdlc_tty_write() called count=12288 [ 363.975033][T13147] n_hdlc_tty_write: truncating user packet from 12288 to 4096 [ 363.975055][T13147] sending frame ffff888037980000, count=4096 [ 363.977839][T13147] frame ffff888037980000 completed [ 363.977865][T13147] n_hdlc_tty_write() called count=8192 [ 363.977881][T13147] n_hdlc_tty_write: truncating user packet from 8192 to 4096 [ 363.977904][T13147] sending frame ffff88807dc44000, count=4096 [ 363.977920][T13147] frame ffff88807dc44000 completed [ 363.977937][T13147] n_hdlc_tty_write() called count=4096 [ 363.977977][T13147] sending frame ffff88807dc40000, count=4096 [ 363.977994][T13147] frame ffff88807dc40000 completed [ 363.978177][T13147] n_hdlc_tty_write() called count=65536 [ 363.978192][T13147] n_hdlc_tty_write: truncating user packet from 65536 to 4096 [ 363.978214][T13147] sending frame ffff888037980000, count=4096 [ 363.978229][T13147] frame ffff888037980000 completed [ 363.978251][T13147] n_hdlc_tty_write() called count=61440 [ 363.978265][T13147] n_hdlc_tty_write: truncating user packet from 61440 to 4096 [ 363.980485][T13147] sending frame ffff88807dc44000, count=4096 [ 363.980505][T13147] frame ffff88807dc44000 completed [ 363.980533][T13147] n_hdlc_tty_write() called count=57344 [ 363.980547][T13147] n_hdlc_tty_write: truncating user packet from 57344 to 4096 [ 363.980569][T13147] sending frame ffff88807dc40000, count=4096 [ 363.980606][T13147] frame ffff88807dc40000 completed [ 363.980628][T13147] n_hdlc_tty_write() called count=53248 [ 363.980642][T13147] n_hdlc_tty_write: truncating user packet from 53248 to 4096 [ 363.980663][T13147] sending frame ffff888037980000, count=4096 [ 363.980679][T13147] frame ffff888037980000 completed [ 363.980700][T13147] n_hdlc_tty_write() called count=49152 [ 363.982317][T13147] n_hdlc_tty_write: truncating user packet from 49152 to 4096 [ 363.982344][T13147] sending frame ffff88807dc44000, count=4096 [ 363.982361][T13147] frame ffff88807dc44000 completed [ 363.982385][T13147] n_hdlc_tty_write() called count=45056 [ 363.982399][T13147] n_hdlc_tty_write: truncating user packet from 45056 to 4096 [ 363.982443][T13147] sending frame ffff88807dc40000, count=4096 [ 363.982464][T13147] frame ffff88807dc40000 completed [ 363.982485][T13147] n_hdlc_tty_write() called count=40960 [ 363.982499][T13147] n_hdlc_tty_write: truncating user packet from 40960 to 4096 [ 363.982521][T13147] sending frame ffff888037980000, count=4096 [ 363.982536][T13147] frame ffff888037980000 completed [ 363.984818][T13147] n_hdlc_tty_write() called count=36864 [ 363.984836][T13147] n_hdlc_tty_write: truncating user packet from 36864 to 4096 [ 363.984859][T13147] sending frame ffff88807dc44000, count=4096 [ 363.984876][T13147] frame ffff88807dc44000 completed [ 363.984896][T13147] n_hdlc_tty_write() called count=32768 [ 363.985215][T13035] netdevsim netdevsim5 netdevsim1: bond_netdev_event received NETDEV_DOWN [ 363.985255][T13035] net netdevsim1: siw: event 2 [ 363.988041][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 363.988071][T13147] sending frame ffff88807dc40000, count=4096 [ 363.988088][T13147] frame ffff88807dc40000 completed [ 363.988111][T13147] n_hdlc_tty_write() called count=28672 [ 363.988124][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 363.988169][T13147] sending frame ffff888037980000, count=4096 [ 363.988186][T13147] frame ffff888037980000 completed [ 363.988204][T13147] n_hdlc_tty_write() called count=24576 [ 363.988218][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 363.988240][T13147] sending frame ffff88807dc44000, count=4096 [ 363.988255][T13147] frame ffff88807dc44000 completed [ 363.988351][T13147] n_hdlc_tty_write() called count=20480 [ 363.988365][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 363.988387][T13147] sending frame ffff88807dc40000, count=4096 [ 363.988403][T13147] frame ffff88807dc40000 completed [ 363.988421][T13147] n_hdlc_tty_write() called count=16384 [ 363.988434][T13147] n_hdlc_tty_write: truncating user packet from 16384 to 4096 [ 363.990075][T13147] sending frame ffff888037980000, count=4096 [ 363.990094][T13147] frame ffff888037980000 completed [ 363.990113][T13147] n_hdlc_tty_write() called count=12288 [ 363.990128][T13147] n_hdlc_tty_write: truncating user packet from 12288 to 4096 [ 363.990149][T13147] sending frame ffff88807dc44000, count=4096 [ 363.990165][T13147] frame ffff88807dc44000 completed [ 363.990582][T13147] n_hdlc_tty_write() called count=8192 [ 363.990598][T13147] n_hdlc_tty_write: truncating user packet from 8192 to 4096 [ 363.990620][T13147] sending frame ffff88807dc40000, count=4096 [ 363.990636][T13147] frame ffff88807dc40000 completed [ 363.990652][T13147] n_hdlc_tty_write() called count=4096 [ 363.990670][T13147] sending frame ffff888037980000, count=4096 [ 363.990808][T13147] frame ffff888037980000 completed [ 363.990885][T13147] n_hdlc_tty_write() called count=65536 [ 363.990900][T13147] n_hdlc_tty_write: truncating user packet from 65536 to 4096 [ 363.991310][T13147] sending frame ffff88807dc44000, count=4096 [ 363.991327][T13147] frame ffff88807dc44000 completed [ 363.991351][T13147] n_hdlc_tty_write() called count=61440 [ 363.991365][T13147] n_hdlc_tty_write: truncating user packet from 61440 to 4096 [ 363.991387][T13147] sending frame ffff88807dc40000, count=4096 [ 363.991403][T13147] frame ffff88807dc40000 completed [ 363.993009][T13147] n_hdlc_tty_write() called count=57344 [ 363.993025][T13147] n_hdlc_tty_write: truncating user packet from 57344 to 4096 [ 363.993049][T13147] sending frame ffff888037980000, count=4096 [ 363.993065][T13147] frame ffff888037980000 completed [ 363.993087][T13147] n_hdlc_tty_write() called count=53248 [ 363.993125][T13147] n_hdlc_tty_write: truncating user packet from 53248 to 4096 [ 363.993147][T13147] sending frame ffff88807dc44000, count=4096 [ 363.993162][T13147] frame ffff88807dc44000 completed [ 363.993184][T13147] n_hdlc_tty_write() called count=49152 [ 363.993197][T13147] n_hdlc_tty_write: truncating user packet from 49152 to 4096 [ 363.993219][T13147] sending frame ffff88807dc40000, count=4096 [ 363.994302][T13147] frame ffff88807dc40000 completed [ 363.994327][T13147] n_hdlc_tty_write() called count=45056 [ 363.994341][T13147] n_hdlc_tty_write: truncating user packet from 45056 to 4096 [ 363.994363][T13147] sending frame ffff888037980000, count=4096 [ 363.994379][T13147] frame ffff888037980000 completed [ 363.994400][T13147] n_hdlc_tty_write() called count=40960 [ 363.995546][T13147] n_hdlc_tty_write: truncating user packet from 40960 to 4096 [ 363.995572][T13147] sending frame ffff88807dc44000, count=4096 [ 363.995588][T13147] frame ffff88807dc44000 completed [ 363.995612][T13147] n_hdlc_tty_write() called count=36864 [ 363.995626][T13147] n_hdlc_tty_write: truncating user packet from 36864 to 4096 [ 363.997580][T13147] sending frame ffff88807dc40000, count=4096 [ 363.997600][T13147] frame ffff88807dc40000 completed [ 363.997621][T13147] n_hdlc_tty_write() called count=32768 [ 363.997635][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 363.997657][T13147] sending frame ffff888037980000, count=4096 [ 363.997695][T13147] frame ffff888037980000 completed [ 363.997715][T13147] n_hdlc_tty_write() called count=28672 [ 363.997728][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 363.997749][T13147] sending frame ffff88807dc44000, count=4096 [ 363.997765][T13147] frame ffff88807dc44000 completed [ 363.997784][T13147] n_hdlc_tty_write() called count=24576 [ 363.998290][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 363.998314][T13147] sending frame ffff88807dc40000, count=4096 [ 363.998330][T13147] frame ffff88807dc40000 completed [ 363.998349][T13147] n_hdlc_tty_write() called count=20480 [ 363.998363][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 363.998941][ T30] usb 1-1: adding 1-1:0.0 (config #0, interface 0) [ 363.998981][ T30] device: '1-1:0.0': device_add [ 363.999719][T13147] sending frame ffff888037980000, count=4096 [ 363.999737][T13147] frame ffff888037980000 completed [ 363.999756][T13147] n_hdlc_tty_write() called count=16384 [ 363.999771][T13147] n_hdlc_tty_write: truncating user packet from 16384 to 4096 [ 363.999792][T13147] sending frame ffff88807dc44000, count=4096 [ 363.999839][ T30] kobject: '1-1:0.0' (ffff88807c148078): kobject_add_internal: parent: '1-1', set: 'devices' [ 364.000236][ T30] bus: 'usb': add device 1-1:0.0 [ 364.000370][ T30] PM: Adding info for usb:1-1:0.0 [ 364.000394][ T30] kobject: '1-1:0.0' (ffff88807c148078): kobject_uevent_env [ 364.000447][ T30] kobject: '1-1:0.0' (ffff88807c148078): fill_kobj_path: path = '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0' [ 364.000621][T13147] frame ffff88807dc44000 completed [ 364.000641][T13147] n_hdlc_tty_write() called count=12288 [ 364.000655][T13147] n_hdlc_tty_write: truncating user packet from 12288 to 4096 [ 364.000677][T13147] sending frame ffff88807dc40000, count=4096 [ 364.000693][T13147] frame ffff88807dc40000 completed [ 364.000710][T13147] n_hdlc_tty_write() called count=8192 [ 364.001868][T13147] n_hdlc_tty_write: truncating user packet from 8192 to 4096 [ 364.001895][T13147] sending frame ffff888037980000, count=4096 [ 364.001912][T13147] frame ffff888037980000 completed [ 364.001930][T13147] n_hdlc_tty_write() called count=4096 [ 364.001949][T13147] sending frame ffff88807dc44000, count=4096 [ 364.001965][T13147] frame ffff88807dc44000 completed [ 364.004288][T13147] n_hdlc_tty_write() called count=65536 [ 364.004306][T13147] n_hdlc_tty_write: truncating user packet from 65536 to 4096 [ 364.004354][T13147] sending frame ffff88807dc40000, count=4096 [ 364.004369][T13147] frame ffff88807dc40000 completed [ 364.004389][T13147] n_hdlc_tty_write() called count=61440 [ 364.004401][T13147] n_hdlc_tty_write: truncating user packet from 61440 to 4096 [ 364.004420][T13147] sending frame ffff888037980000, count=4096 [ 364.004435][T13147] frame ffff888037980000 completed [ 364.005194][T13147] n_hdlc_tty_write() called count=57344 [ 364.005210][T13147] n_hdlc_tty_write: truncating user packet from 57344 to 4096 [ 364.005233][T13147] sending frame ffff88807dc44000, count=4096 [ 364.005250][T13147] frame ffff88807dc44000 completed [ 364.005271][T13147] n_hdlc_tty_write() called count=53248 [ 364.005649][T13147] n_hdlc_tty_write: truncating user packet from 53248 to 4096 [ 364.005672][T13147] sending frame ffff88807dc40000, count=4096 [ 364.005688][T13147] frame ffff88807dc40000 completed [ 364.005709][T13147] n_hdlc_tty_write() called count=49152 [ 364.005724][T13147] n_hdlc_tty_write: truncating user packet from 49152 to 4096 [ 364.005745][T13147] sending frame ffff888037980000, count=4096 [ 364.007007][T13147] frame ffff888037980000 completed [ 364.007030][T13147] n_hdlc_tty_write() called count=45056 [ 364.007044][T13147] n_hdlc_tty_write: truncating user packet from 45056 to 4096 [ 364.007066][T13147] sending frame ffff88807dc44000, count=4096 [ 364.007082][T13147] frame ffff88807dc44000 completed [ 364.007102][T13147] n_hdlc_tty_write() called count=40960 [ 364.007163][T13147] n_hdlc_tty_write: truncating user packet from 40960 to 4096 [ 364.007186][T13147] sending frame ffff88807dc40000, count=4096 [ 364.007201][T13147] frame ffff88807dc40000 completed [ 364.007221][T13147] n_hdlc_tty_write() called count=36864 [ 364.007234][T13147] n_hdlc_tty_write: truncating user packet from 36864 to 4096 [ 364.007256][T13147] sending frame ffff888037980000, count=4096 [ 364.009180][T13147] frame ffff888037980000 completed [ 364.009205][T13147] n_hdlc_tty_write() called count=32768 [ 364.009219][T13147] n_hdlc_tty_write: truncating user packet from 32768 to 4096 [ 364.009241][T13147] sending frame ffff88807dc44000, count=4096 [ 364.009257][T13147] frame ffff88807dc44000 completed [ 364.009275][T13147] n_hdlc_tty_write() called count=28672 [ 364.009360][T13147] n_hdlc_tty_write: truncating user packet from 28672 to 4096 [ 364.009382][T13147] sending frame ffff88807dc40000, count=4096 [ 364.009398][T13147] frame ffff88807dc40000 completed [ 364.009417][T13147] n_hdlc_tty_write() called count=24576 [ 364.009431][T13147] n_hdlc_tty_write: truncating user packet from 24576 to 4096 [ 364.009458][T13147] sending frame ffff888037980000, count=4096 [ 364.009494][T13147] frame ffff888037980000 completed [ 364.009512][T13147] n_hdlc_tty_write() called count=20480 [ 364.009526][T13147] n_hdlc_tty_write: truncating user packet from 20480 to 4096 [ 364.009547][T13147] sending frame ffff88807dc44000, count=4096 [ 364.009562][T13147] frame ffff88807dc44000 completed [ 364.009579][T13147] n_hdlc_tty_write() called count=16384 [ 364.010161][ T30] usb 1-1:0.0: bus: 'usb': __driver_probe_device: matched device with driver usbtest [ 364.010196][ T30] usb 1-1:0.0: bus: 'usb': really_probe: probing driver usbtest with device [ 364.010342][ T30] usbtest 1-1:0.0: usb_probe_interface [ 364.010364][ T30] usbtest 1-1:0.0: usb_probe_interface - got id [ 364.010393][ T30] usbtest 1-1:0.0: probe with driver usbtest rejects match -19 [ 364.010420][ T30] kernfs 1-1:0.0: removing [ 364.010491][ T30] kernfs driver: removing [ 364.010563][ T30] usb 1-1:0.0: bus: 'usb': __driver_probe_device: matched device with driver yurex [ 364.010590][ T30] usb 1-1:0.0: bus: 'usb': really_probe: probing driver yurex with device [ 364.010708][ T30] yurex 1-1:0.0: usb_probe_interface [ 364.010728][ T30] yurex 1-1:0.0: usb_probe_interface - got id [ 364.010933][ T30] yurex 1-1:0.0: looking for a minor, starting at 0 [ 364.011029][ T30] device: 'yurex0': device_add [ 364.011070][ C1] ================================================================== [ 364.011087][ C1] BUG: KASAN: slab-use-after-free in find_endpoint+0x2a3/0x2c0 [ 364.011133][ C1] Read of size 1 at addr ffff88802de870e8 by task kworker/1:1/30 [ 364.011155][ C1] [ 364.011167][ C1] CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 364.011200][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 364.011222][ C1] Workqueue: usb_hub_wq hub_event [ 364.011255][ C1] Call Trace: [ 364.011264][ C1] [ 364.011275][ C1] dump_stack_lvl+0x100/0x190 [ 364.011321][ C1] print_report+0x13d/0x4b0 [ 364.011363][ C1] ? __virt_addr_valid+0x239/0x430 [ 364.011401][ C1] ? find_endpoint+0x2a3/0x2c0 [ 364.011436][ C1] kasan_report+0xdf/0x1c0 [ 364.011473][ C1] ? find_endpoint+0x2a3/0x2c0 [ 364.011513][ C1] find_endpoint+0x2a3/0x2c0 [ 364.011550][ C1] dummy_timer+0x506/0x3840 [ 364.011593][ C1] ? do_raw_spin_lock+0x128/0x260 [ 364.011621][ C1] ? find_held_lock+0x2b/0x80 [ 364.011650][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 364.011690][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 364.011732][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 364.011776][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 364.011815][ C1] ? __pfx_debug_object_deactivate+0x10/0x10 [ 364.011857][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 364.011897][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 364.011937][ C1] ? mark_held_locks+0x40/0x70 [ 364.011974][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 364.012015][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 364.012056][ C1] __hrtimer_run_queues+0x448/0x9a0 [ 364.012097][ C1] hrtimer_run_softirq+0x1ca/0x360 [ 364.012134][ C1] handle_softirqs+0x216/0xa20 [ 364.012170][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 364.012203][ C1] ? _raw_spin_unlock+0x28/0x50 [ 364.012242][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 364.012281][ C1] __irq_exit_rcu+0x178/0x220 [ 364.012312][ C1] irq_exit_rcu+0x9/0x30 [ 364.012342][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 364.012386][ C1] [ 364.012395][ C1] [ 364.012406][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 364.012437][ C1] RIP: 0010:class_to_subsys+0xcf/0x150 [ 364.012482][ C1] Code: 85 8e 00 00 00 48 8b 43 08 48 8d 58 f8 48 39 c5 74 6b e8 74 0a 91 fb 48 8d bb f8 02 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <75> 60 4c 39 ab f8 02 00 00 75 b5 e8 51 0a 91 fb 4c 8d 63 b0 e8 48 [ 364.012510][ C1] RSP: 0018:ffffc90000a66b88 EFLAGS: 00000246 [ 364.012532][ C1] RAX: 1ffff11004ad9669 RBX: ffff8880256cb050 RCX: ffffc9001abb5000 [ 364.012553][ C1] RDX: 0000000000100000 RSI: ffffffff867d486c RDI: ffff8880256cb348 [ 364.012572][ C1] RBP: ffff888020a91000 R08: 0000000000000001 R09: fffff5200014cd63 [ 364.012591][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000 [ 364.012609][ C1] R13: ffffffff8ce99980 R14: ffff88807c148078 R15: ffff8880554df048 [ 364.012634][ C1] ? class_to_subsys+0xbc/0x150 [ 364.012674][ C1] ? class_to_subsys+0xbc/0x150 [ 364.012712][ C1] get_device_parent+0x43/0x4c0 [ 364.012747][ C1] device_add+0x1ad/0x1970 [ 364.012784][ C1] ? __pfx_device_add+0x10/0x10 [ 364.012819][ C1] ? kfree_const+0x5a/0x70 [ 364.012846][ C1] ? kfree+0x1e5/0x6d0 [ 364.012883][ C1] device_create_groups_vargs+0x1f8/0x270 [ 364.012924][ C1] device_create+0xed/0x130 [ 364.012960][ C1] ? __pfx_device_create+0x10/0x10 [ 364.013000][ C1] ? down_write+0x141/0x1f0 [ 364.013028][ C1] ? __pfx_down_write+0x10/0x10 [ 364.013060][ C1] usb_register_dev+0x2f0/0x570 [ 364.013101][ C1] ? __pfx_usb_register_dev+0x10/0x10 [ 364.013147][ C1] yurex_probe+0xb03/0xfb0 [ 364.013182][ C1] ? _raw_spin_lock_irqsave+0x52/0x60 [ 364.013220][ C1] ? __pfx_yurex_probe+0x10/0x10 [ 364.013256][ C1] ? mark_held_locks+0x40/0x70 [ 364.013294][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 364.013329][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 364.013370][ C1] ? __pm_runtime_set_status+0x13c/0x970 [ 364.013410][ C1] usb_probe_interface+0x386/0x980 [ 364.013448][ C1] ? __pfx_usb_probe_interface+0x10/0x10 [ 364.013489][ C1] ? kernfs_put+0x3f/0x60 [ 364.013530][ C1] ? sysfs_create_link+0x68/0xc0 [ 364.013567][ C1] ? __pfx_usb_probe_interface+0x10/0x10 [ 364.013605][ C1] really_probe+0x241/0xa60 [ 364.013638][ C1] __driver_probe_device+0x210/0x460 [ 364.013669][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 364.013712][ C1] driver_probe_device+0x4a/0x140 [ 364.013745][ C1] __device_attach_driver+0x1df/0x320 [ 364.013779][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 364.013812][ C1] bus_for_each_drv+0x159/0x1e0 [ 364.013854][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 364.013898][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 364.013940][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 364.013983][ C1] __device_attach+0x1e4/0x4c0 [ 364.014015][ C1] ? __pfx___device_attach+0x10/0x10 [ 364.014048][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 364.014078][ C1] device_initial_probe+0xaf/0xf0 [ 364.014111][ C1] __bus_probe_device+0x60/0x160 [ 364.014155][ C1] device_add+0x121d/0x1970 [ 364.014191][ C1] ? __pfx_device_add+0x10/0x10 [ 364.014227][ C1] ? mark_held_locks+0x40/0x70 [ 364.014269][ C1] usb_set_configuration+0xd97/0x1dc0 [ 364.014311][ C1] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 364.014355][ C1] usb_generic_driver_probe+0xa1/0xe0 [ 364.014399][ C1] usb_probe_device+0xef/0x400 [ 364.014430][ C1] ? __pfx_usb_probe_device+0x10/0x10 [ 364.014469][ C1] really_probe+0x241/0xa60 [ 364.014518][ C1] __driver_probe_device+0x210/0x460 [ 364.014549][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 364.014591][ C1] driver_probe_device+0x4a/0x140 [ 364.014624][ C1] __device_attach_driver+0x1df/0x320 [ 364.014658][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 364.014691][ C1] bus_for_each_drv+0x159/0x1e0 [ 364.014733][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 364.014776][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 364.014818][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 364.014861][ C1] __device_attach+0x1e4/0x4c0 [ 364.014894][ C1] ? __pfx___device_attach+0x10/0x10 [ 364.014927][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 364.014955][ C1] device_initial_probe+0xaf/0xf0 [ 364.014989][ C1] __bus_probe_device+0x60/0x160 [ 364.015033][ C1] device_add+0x121d/0x1970 [ 364.015070][ C1] ? __pfx_device_add+0x10/0x10 [ 364.015105][ C1] ? add_device_randomness+0xc9/0x110 [ 364.015146][ C1] usb_new_device.part.0+0xcc2/0x1686 [ 364.015179][ C1] ? do_raw_spin_lock+0x128/0x260 [ 364.015205][ C1] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 364.015237][ C1] ? mark_held_locks+0x40/0x70 [ 364.015276][ C1] hub_event.cold+0x1e3/0xe90 [ 364.015320][ C1] ? __pfx_hub_event+0x10/0x10 [ 364.015351][ C1] ? lockdep_register_key+0x230/0x250 [ 364.015388][ C1] ? lock_acquire+0x1d1/0x380 [ 364.015424][ C1] ? process_one_work+0xa2c/0x1b10 [ 364.015462][ C1] ? process_one_work+0x906/0x1b10 [ 364.015492][ C1] ? process_one_work+0x906/0x1b10 [ 364.015525][ C1] process_one_work+0xac7/0x1b10 [ 364.015562][ C1] ? __pfx_process_one_work+0x10/0x10 [ 364.015594][ C1] ? lock_acquire+0x1d1/0x380 [ 364.015635][ C1] ? __pfx_hub_event+0x10/0x10 [ 364.015667][ C1] worker_thread+0x5ef/0xe50 [ 364.015703][ C1] ? kthread+0x13a/0x450 [ 364.015728][ C1] ? __pfx_worker_thread+0x10/0x10 [ 364.015758][ C1] kthread+0x373/0x450 [ 364.015783][ C1] ? __pfx_kthread+0x10/0x10 [ 364.015810][ C1] ret_from_fork+0x730/0xd60 [ 364.015847][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 364.015884][ C1] ? __switch_to+0x800/0x10e0 [ 364.015909][ C1] ? __pfx_kthread+0x10/0x10 [ 364.015936][ C1] ret_from_fork_asm+0x1a/0x30 [ 364.015978][ C1] [ 364.015987][ C1] [ 364.015994][ C1] Allocated by task 12929: [ 364.016009][ C1] kasan_save_stack+0x30/0x50 [ 364.016044][ C1] kasan_save_track+0x14/0x30 [ 364.016070][ C0] virtqueue callback for ffff888028320600 (ffffffff86fd6730) [ 364.016064][ C1] __kasan_kmalloc+0xaa/0xb0 [ 364.016102][ C1] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 364.016129][ C1] rfcomm_dlc_alloc+0x96/0x2b0 [ 364.016149][ C0] No more buffers in queue [ 364.016159][ C1] rfcomm_sock_alloc.constprop.0+0x22/0x2a0 [ 364.016186][ C0] Receiving skb proto 0x0800 len 244 type 0 [ 364.016194][ C1] rfcomm_sock_create+0xf1/0x180 [ 364.016216][ C0] No more buffers in queue [ 364.016230][ C1] bt_sock_create+0x185/0x350 [ 364.016261][ C1] __sock_create+0x339/0x860 [ 364.016297][ C1] __sys_socket+0x14d/0x260 [ 364.016330][ C1] __x64_sys_socket+0x72/0xb0 [ 364.016362][ C1] do_syscall_64+0x123/0x790 [ 364.016382][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.016406][ C1] [ 364.016412][ C1] Freed by task 12937: [ 364.016424][ C1] kasan_save_stack+0x30/0x50 [ 364.016468][ C1] kasan_save_track+0x14/0x30 [ 364.016491][ C1] kasan_save_free_info+0x3b/0x70 [ 364.016526][ C1] __kasan_slab_free+0x5f/0x80 [ 364.016549][ C1] kfree+0x22b/0x6d0 [ 364.016573][ C1] rfcomm_sock_destruct+0x12b/0x1e0 [ 364.016609][ C1] __sk_destruct+0x85/0xb70 [ 364.016631][ C1] sk_destruct+0xc8/0xf0 [ 364.016634][ C0] eth0: xmit ffff888031293140 42:01:0a:80:00:01 [ 364.016656][ C1] __sk_free+0xf4/0x3e0 [ 364.016669][ C0] Added buffer head 27 to ffff888028320400 [ 364.016678][ C1] sk_free+0x61/0x90 [ 364.016695][ C0] virtqueue callback for ffff888028320400 (ffffffff86fdf6c0) [ 364.016702][ C1] rfcomm_sock_kill+0x12b/0x230 [ 364.016726][ C0] Sent skb ffff888031293140 [ 364.016740][ C1] rfcomm_sock_release+0x119/0x1a0 [ 364.016770][ C0] No more buffers in queue [ 364.016778][ C1] __sock_release+0xb3/0x260 [ 364.016787][ C0] No more buffers in queue [ 364.016805][ C1] sock_close+0x1c/0x30 [ 364.016828][ C1] __fput+0x3fb/0xb50 [ 364.016855][ C1] fput_close_sync+0x118/0x250 [ 364.016885][ C1] filp_close_sync+0x75/0xa0 [ 364.016918][ C1] put_files_struct+0x1f7/0x390 [ 364.016951][ C1] exit_files+0x85/0xb0 [ 364.016981][ C1] do_exit+0x896/0x2a00 [ 364.017014][ C1] __x64_sys_exit+0x42/0x50 [ 364.017049][ C1] x64_sys_call+0x156c/0x1570 [ 364.017081][ C1] do_syscall_64+0x123/0x790 [ 364.017104][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.017131][ C1] [ 364.017137][ C1] The buggy address belongs to the object at ffff88802de87000 [ 364.017137][ C1] which belongs to the cache kmalloc-512 of size 512 [ 364.017159][ C1] The buggy address is located 232 bytes inside of [ 364.017159][ C1] freed 512-byte region [ffff88802de87000, ffff88802de87200) [ 364.017187][ C1] [ 364.017194][ C1] The buggy address belongs to the physical page: [ 364.017206][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2de84 [ 364.017230][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 364.017252][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 364.017275][ C1] page_type: f5(slab) [ 364.017299][ C1] raw: 00fff00000000040 ffff88813ff0cc80 dead000000000100 dead000000000122 [ 364.017324][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 364.017350][ C1] head: 00fff00000000040 ffff88813ff0cc80 dead000000000100 dead000000000122 [ 364.017375][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 364.017402][ C1] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 364.017426][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 364.017442][ C1] page dumped because: kasan: bad access detected [ 364.017470][ C1] page_owner tracks the page as allocated [ 364.017479][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11799136960 [ 364.017523][ C1] post_alloc_hook+0xfd/0x120 [ 364.017554][ C1] get_page_from_freelist+0x1113/0x35e0 [ 364.017588][ C1] __alloc_frozen_pages_noprof+0x2bd/0x3280 [ 364.017623][ C1] new_slab+0xb1/0x6d0 [ 364.017654][ C1] refill_objects+0xe3/0x410 [ 364.017686][ C1] __pcs_replace_empty_main+0x35e/0x650 [ 364.017718][ C1] __kmalloc_cache_noprof+0x4ef/0x6d0 [ 364.017751][ C1] device_add+0xd3f/0x1970 [ 364.017783][ C1] usb_hub_create_port_device+0x3c6/0xe60 [ 364.017815][ C1] hub_probe.cold+0x2974/0x2ed9 [ 364.017843][ C1] usb_probe_interface+0x386/0x980 [ 364.017876][ C1] really_probe+0x241/0xa60 [ 364.017904][ C1] __driver_probe_device+0x210/0x460 [ 364.017933][ C1] driver_probe_device+0x4a/0x140 [ 364.017961][ C1] __device_attach_driver+0x1df/0x320 [ 364.017992][ C1] bus_for_each_drv+0x159/0x1e0 [ 364.018031][ C1] page_owner free stack trace missing [ 364.018040][ C1] [ 364.018045][ C1] Memory state around the buggy address: [ 364.018059][ C1] ffff88802de86f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 364.018078][ C1] ffff88802de87000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 364.018098][ C1] >ffff88802de87080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 364.018114][ C1] ^ [ 364.018129][ C1] ffff88802de87100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 364.018148][ C1] ffff88802de87180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 364.018163][ C1] ================================================================== [ 364.018183][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 368.271752][ C1] CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 368.280948][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 368.291018][ C1] Workqueue: usb_hub_wq hub_event [ 368.296050][ C1] Call Trace: [ 368.299392][ C1] [ 368.302242][ C1] dump_stack_lvl+0x100/0x190 [ 368.306950][ C1] vpanic+0x2dc/0x6f8 [ 368.310942][ C1] panic+0xd1/0xe0 [ 368.314747][ C1] ? __pfx_panic+0x10/0x10 [ 368.319165][ C1] ? end_report.part.0+0x23/0x90 [ 368.324113][ C1] ? rcu_is_watching+0x13/0xc0 [ 368.329056][ C1] ? end_report.part.0+0x23/0x90 [ 368.334018][ C1] check_panic_on_warn.cold+0x19/0x34 [ 368.339478][ C1] end_report.part.0+0x3a/0x90 [ 368.344427][ C1] kasan_report.cold+0xe/0x18 [ 368.349198][ C1] ? find_endpoint+0x2a3/0x2c0 [ 368.353978][ C1] find_endpoint+0x2a3/0x2c0 [ 368.358570][ C1] dummy_timer+0x506/0x3840 [ 368.363174][ C1] ? do_raw_spin_lock+0x128/0x260 [ 368.368282][ C1] ? find_held_lock+0x2b/0x80 [ 368.373045][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 368.378783][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 368.384855][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 368.390675][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 368.396414][ C1] ? __pfx_debug_object_deactivate+0x10/0x10 [ 368.402412][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 368.407902][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 368.412935][ C1] ? mark_held_locks+0x40/0x70 [ 368.417706][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 368.423522][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 368.428477][ C1] __hrtimer_run_queues+0x448/0x9a0 [ 368.433681][ C1] hrtimer_run_softirq+0x1ca/0x360 [ 368.438796][ C1] handle_softirqs+0x216/0xa20 [ 368.443567][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 368.448851][ C1] ? _raw_spin_unlock+0x28/0x50 [ 368.453706][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 368.459354][ C1] __irq_exit_rcu+0x178/0x220 [ 368.464122][ C1] irq_exit_rcu+0x9/0x30 [ 368.468364][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 368.474005][ C1] [ 368.476929][ C1] [ 368.479853][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 368.485860][ C1] RIP: 0010:class_to_subsys+0xcf/0x150 [ 368.491323][ C1] Code: 85 8e 00 00 00 48 8b 43 08 48 8d 58 f8 48 39 c5 74 6b e8 74 0a 91 fb 48 8d bb f8 02 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <75> 60 4c 39 ab f8 02 00 00 75 b5 e8 51 0a 91 fb 4c 8d 63 b0 e8 48 [ 368.511026][ C1] RSP: 0018:ffffc90000a66b88 EFLAGS: 00000246 [ 368.517283][ C1] RAX: 1ffff11004ad9669 RBX: ffff8880256cb050 RCX: ffffc9001abb5000 [ 368.525253][ C1] RDX: 0000000000100000 RSI: ffffffff867d486c RDI: ffff8880256cb348 [ 368.533765][ C1] RBP: ffff888020a91000 R08: 0000000000000001 R09: fffff5200014cd63 [ 368.541919][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000 [ 368.549882][ C1] R13: ffffffff8ce99980 R14: ffff88807c148078 R15: ffff8880554df048 [ 368.558127][ C1] ? class_to_subsys+0xbc/0x150 [ 368.562990][ C1] ? class_to_subsys+0xbc/0x150 [ 368.567937][ C1] get_device_parent+0x43/0x4c0 [ 368.572973][ C1] device_add+0x1ad/0x1970 [ 368.577413][ C1] ? __pfx_device_add+0x10/0x10 [ 368.582276][ C1] ? kfree_const+0x5a/0x70 [ 368.587298][ C1] ? kfree+0x1e5/0x6d0 [ 368.591517][ C1] device_create_groups_vargs+0x1f8/0x270 [ 368.597244][ C1] device_create+0xed/0x130 [ 368.602034][ C1] ? __pfx_device_create+0x10/0x10 [ 368.607167][ C1] ? down_write+0x141/0x1f0 [ 368.611843][ C1] ? __pfx_down_write+0x10/0x10 [ 368.617044][ C1] usb_register_dev+0x2f0/0x570 [ 368.621904][ C1] ? __pfx_usb_register_dev+0x10/0x10 [ 368.627294][ C1] yurex_probe+0xb03/0xfb0 [ 368.632062][ C1] ? _raw_spin_lock_irqsave+0x52/0x60 [ 368.637438][ C1] ? __pfx_yurex_probe+0x10/0x10 [ 368.642395][ C1] ? mark_held_locks+0x40/0x70 [ 368.647870][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 368.653958][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 368.659782][ C1] ? __pm_runtime_set_status+0x13c/0x970 [ 368.665425][ C1] usb_probe_interface+0x386/0x980 [ 368.670547][ C1] ? __pfx_usb_probe_interface+0x10/0x10 [ 368.676270][ C1] ? kernfs_put+0x3f/0x60 [ 368.680707][ C1] ? sysfs_create_link+0x68/0xc0 [ 368.685733][ C1] ? __pfx_usb_probe_interface+0x10/0x10 [ 368.691458][ C1] really_probe+0x241/0xa60 [ 368.695974][ C1] __driver_probe_device+0x210/0x460 [ 368.701270][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 368.707087][ C1] driver_probe_device+0x4a/0x140 [ 368.712109][ C1] __device_attach_driver+0x1df/0x320 [ 368.717483][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 368.723472][ C1] bus_for_each_drv+0x159/0x1e0 [ 368.728341][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 368.733720][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 368.738925][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 368.744735][ C1] __device_attach+0x1e4/0x4c0 [ 368.749506][ C1] ? __pfx___device_attach+0x10/0x10 [ 368.754789][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 368.760030][ C1] device_initial_probe+0xaf/0xf0 [ 368.765090][ C1] __bus_probe_device+0x60/0x160 [ 368.770133][ C1] device_add+0x121d/0x1970 [ 368.774644][ C1] ? __pfx_device_add+0x10/0x10 [ 368.779496][ C1] ? mark_held_locks+0x40/0x70 [ 368.784272][ C1] usb_set_configuration+0xd97/0x1dc0 [ 368.789652][ C1] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 368.795811][ C1] usb_generic_driver_probe+0xa1/0xe0 [ 368.801203][ C1] usb_probe_device+0xef/0x400 [ 368.806064][ C1] ? __pfx_usb_probe_device+0x10/0x10 [ 368.811449][ C1] really_probe+0x241/0xa60 [ 368.816126][ C1] __driver_probe_device+0x210/0x460 [ 368.821500][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 368.827312][ C1] driver_probe_device+0x4a/0x140 [ 368.832428][ C1] __device_attach_driver+0x1df/0x320 [ 368.837797][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 368.843771][ C1] bus_for_each_drv+0x159/0x1e0 [ 368.848627][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 368.854094][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 368.859485][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 368.865311][ C1] __device_attach+0x1e4/0x4c0 [ 368.870072][ C1] ? __pfx___device_attach+0x10/0x10 [ 368.875368][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 368.880670][ C1] device_initial_probe+0xaf/0xf0 [ 368.885704][ C1] __bus_probe_device+0x60/0x160 [ 368.890653][ C1] device_add+0x121d/0x1970 [ 368.895157][ C1] ? __pfx_device_add+0x10/0x10 [ 368.900008][ C1] ? add_device_randomness+0xc9/0x110 [ 368.905485][ C1] usb_new_device.part.0+0xcc2/0x1686 [ 368.910858][ C1] ? do_raw_spin_lock+0x128/0x260 [ 368.915970][ C1] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 368.921869][ C1] ? mark_held_locks+0x40/0x70 [ 368.926709][ C1] hub_event.cold+0x1e3/0xe90 [ 368.931395][ C1] ? __pfx_hub_event+0x10/0x10 [ 368.936242][ C1] ? lockdep_register_key+0x230/0x250 [ 368.941630][ C1] ? lock_acquire+0x1d1/0x380 [ 368.946415][ C1] ? process_one_work+0xa2c/0x1b10 [ 368.951532][ C1] ? process_one_work+0x906/0x1b10 [ 368.956645][ C1] ? process_one_work+0x906/0x1b10 [ 368.961931][ C1] process_one_work+0xac7/0x1b10 [ 368.966890][ C1] ? __pfx_process_one_work+0x10/0x10 [ 368.972297][ C1] ? lock_acquire+0x1d1/0x380 [ 368.977009][ C1] ? __pfx_hub_event+0x10/0x10 [ 368.981871][ C1] worker_thread+0x5ef/0xe50 [ 368.986533][ C1] ? kthread+0x13a/0x450 [ 368.990777][ C1] ? __pfx_worker_thread+0x10/0x10 [ 368.995896][ C1] kthread+0x373/0x450 [ 368.999964][ C1] ? __pfx_kthread+0x10/0x10 [ 369.004578][ C1] ret_from_fork+0x730/0xd60 [ 369.009179][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 369.014469][ C1] ? __switch_to+0x800/0x10e0 [ 369.019138][ C1] ? __pfx_kthread+0x10/0x10 [ 369.023738][ C1] ret_from_fork_asm+0x1a/0x30 [ 369.028509][ C1] [ 369.031747][ C1] Kernel Offset: disabled [ 369.036074][ C1] Rebooting in 86400 seconds..