last executing test programs: 3.639203417s ago: executing program 3 (id=141): pipe(&(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000780)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000007c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 3.635014687s ago: executing program 3 (id=142): fsopen(0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000180)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000000480)=""/102392, 0x18ff8) getrandom(&(0x7f0000000280)=""/286, 0xffffff9a, 0x0) 3.473671954s ago: executing program 4 (id=144): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000004200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000004240)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000004280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000042c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000004340), 0x651, 0x0) recvmmsg(r1, &(0x7f0000004380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000043c0)=0x6) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000004380)={&(0x7f0000004580)=@newtaction={0x14, 0x1e, 0x109, 0x0, 0x25dfdbfe}, 0x14}, 0x1, 0x2b1e, 0x0, 0x1}, 0x8d0) 2.91891732s ago: executing program 3 (id=147): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40014) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x5) socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x318, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000500)=0x2) mkdir(&(0x7f0000000540)='./file0\x00', 0x97) mkdir(&(0x7f0000000580)='./file1\x00', 0x13b) mkdir(&(0x7f00000005c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000600)='./bus\x00', &(0x7f0000000640), 0x0, &(0x7f0000000680)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000006c0)='./bus\x00') r3 = open(&(0x7f0000000700)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000740)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x9, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000800), 0x7f03) 2.851385707s ago: executing program 2 (id=150): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x54, 0x12, 0x1, 0x4, 0x0, {0x2, 0x3, 0x0, 0x0, {0xfffc, 0x4e22, [0xda6, 0xffffffff], [0x803, 0x0, 0x38, 0x1], 0x0, [0x1, 0x7fffffff]}}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "0a00102c"}]}, 0x54}}, 0x200040c4) 2.850482758s ago: executing program 2 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000003280)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000032c0)='./nfsd\x00', &(0x7f0000003300)='nfsd\x00', 0x0, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000003340)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000003380)='tcp 2', 0x5) 2.555769568s ago: executing program 4 (id=153): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000070601080000ac00000000000a0000040500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 2.513562422s ago: executing program 4 (id=154): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) pread64(r1, &(0x7f0000000280)=""/194, 0xc2, 0xc) connect$unix(r1, &(0x7f0000000500)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000580), 0x651, 0x0) recvmmsg(r1, &(0x7f00000005c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x50) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x801c0, 0x189) fcntl$setsig(r3, 0xa, 0x21) fcntl$setlease(r3, 0x400, 0x1) close_range(r3, 0xffffffffffffffff, 0x0) 2.355435768s ago: executing program 1 (id=155): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}, @uuid={'CRP-syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f00000000c0)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0xa0011, 0x0, 0x0, @by_dev={r1}, [@raid={0x0, 0x8, 0x0, 0x80, 'raid\x00', {'raid4', 0x20, '1 128', 0x20, 0x3, [{0x20, @none, 0x20, @ram_num={'1:', 0x0}}, {0x20, @none, 0x20, @ram={'/dev/ram', 0x1}}, {0x20, @none, 0x20, @ram={'/dev/ram', 0x1}}]}}]}) 1.94536633s ago: executing program 0 (id=156): unshare(0xe060400) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./dev\x00', &(0x7f00000004c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000540)={0x1, 0x0, 0x98, &(0x7f0000000580)={0x400000, 0x24000, 0xe}}) 1.929095142s ago: executing program 2 (id=157): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000019700)={0x3, &(0x7f0000019740)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x48}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffffff0000000000000800450000"], 0x0) 1.869685558s ago: executing program 1 (id=158): syz_read_part_table(0x105e, &(0x7f0000000400)="$eJzsz7GNwjAYx9F/csnd6XIiFYPQMAErsAQlC0BDTckObMIcDGKURCAmAIr3JNtf8ZMth7eqkk3zGJMuWSRpn5JZ3R233bIdg2F9/U7t38+w91PVrr6T7HPphztKSU5Vk2vyf3+pms7DPGUcyq5en1/2UQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4YLcAAAD//xntC5c=") 1.869594808s ago: executing program 2 (id=159): ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x46) 1.869508938s ago: executing program 3 (id=160): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004e80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004ec0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000004f00)={0x0, 0x0, &(0x7f0000004f40)={&(0x7f0000004f80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r2], 0x24}}, 0x0) 1.85119534s ago: executing program 0 (id=161): prlimit64(0x0, 0xe, &(0x7f0000000780)={0x8, 0x80020100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000007c0)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000880)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000008c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000900)=""/102392, 0x18ff8) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000380), 0x2982, 0x0) 1.84840905s ago: executing program 2 (id=162): prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000980)=0x2) sched_setscheduler(r0, 0x2, &(0x7f00000009c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a40)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000ac0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000b40), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_debugfs\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./my_debugfs/usb/devices\x00', 0x2, 0x0) read(r3, 0x0, 0xfffffc69) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 1.727399393s ago: executing program 3 (id=163): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40014) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x5) socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x318, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000500)=0x2) mkdir(&(0x7f0000000540)='./file0\x00', 0x97) mkdir(&(0x7f0000000580)='./file1\x00', 0x13b) mkdir(&(0x7f00000005c0)='./bus\x00', 0x0) chdir(&(0x7f00000006c0)='./bus\x00') r3 = open(&(0x7f0000000700)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) sendfile(r3, r3, &(0x7f0000000800), 0x7f03) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000040)=0x8) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0xff) close(0x3) 1.36163561s ago: executing program 4 (id=165): bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r3, &(0x7f00000005c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000195c0)=0x7) removexattr(&(0x7f00000001c0)='./file0\x00', 0x0) 1.3612985s ago: executing program 0 (id=166): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$vfat(&(0x7f0000000800), &(0x7f0000000840)='./file0\x00', 0x2000000, &(0x7f0000000880)=ANY=[@ANYBLOB="00e789da34e04a1ffb124b2c2fb684c70b90bbb45efd97899a16f2df4fa2e8f06ac2c5352509e3c51d882eb3ec0dd3b1c96e980163890d2d2d1b8d3d62f6d77b0209e166e2ca4c35483d49316daf522556a16cab12d75a852bc680da7ea837480feb2060a1e20a59b7745235030000004ed0351cb5b416ba1c57217be5a338392f831617ee8c35bb61f0a9eeed3b1226b18c4b455ab222d7ae1b5258d5643d70000000000000000000ae468a387d9e63008000000000000063a454d1ab8760076a893752105f030c49caf2fdfe6bc9743a68593b576e2f2f6ab69e1b974ac90855ac250f8f73e16bc593730b88d7a3346b945e276875915040ce4901262cd8ce8191ee84e3ce5526a0a43b707cc711a3311f840cad641a013c6dd783aa895227b3d50a86e15a57e26666aaa296b7ddc4c8f421cf9d76d344bf6522f5d1138659d3de84ce13b085a2ed9d66c93767378423521cc4ea440e0ac3b953e1ca1675a716a97a5c3106aba648f119eeab4747b9b53000475e0a34514ccf397ea6f170e018122a98f135beac48d2ed195e20fdd226c7f5a20000ad1fcfbee59924e161280a8b78fe34b2fa3efa7c1d4268bf090000ecb4ece3234c232659fee3ff9e6d21e008a570bb490a65b84ea8b6d6507355cb1112fae6e3456bf8da53e1df20458e59456822dbb8dbd7ce0f928d5fbd6414fe8ab5277f3fd5ce6be044993f93e697a69484cc0e65ec742443c84e21a440998c8d69c12c2db7aee2872c6e0671d639e8f6bece219dcd0f69b9867dfc3187c882c035809c81832d7416f90c734be30c2faf0c22bfc8d95dfc7b9bac96b838c98ae5a75b9dc9e967ef5edf311bbebd7ca803cea8f5b9ec5b3edd6c44d633b71bde97a3c10a468432ff3d4e63ce3ecfa640d44b70b68744d26e72389e6c61767725d2c692443bc949c28b1a374e541bd352ca2f3bf64d883862dc24d8e27d86b6e38bc269f110c3d563f8e4ec9a98016b6b58157deeefa8fa022514bdc75f794094700cb8fa2b61310cbf9058bce5f2399055929e0fc732e0d5db92e0246fe1b09a2993ff038d8099c229bda0801f8b81719d73b4abac97f704a0942051bae38b00b69d7fa69d738f99f73b19082ec0c99442d97ddbf68a4822aa2a2673478f81f14f67beee619b9d9882f7eabfb500000000000000000096117c84449647684239c9b9475b389a6a76d36c31f39539d928d2c58f188b4bf713d0915df4cc7de48a930935dbb01c9422d604467d209fd1421c7fc503cabde4bb193ff3654377c6e4fb72dcfc835f760bae7447068c2e43433e3d77c6805b559a04f3ebb741a9bbf57274b1da7800000000000000000000000000000000000000001c4f225672f3465b2638e921d80d58dca4ee4592d8cc0c06b2e390b7b1c713a46bc8ece9be25f055a59032576bc00a844c32b46040a607eaeb886ec0cb8e90c5a4075caa8a358ab81e78ad794a20f772b73466a43cd696401521793e54b1c4aa58d506b661f393e7233337473f36c2dbb15ae673afe82ebe45cc6f776162e43b74d9b9ca6f68d6bc8261600b27431e0f6f4f1e0947f69d2d812ebc9d2a8869b14a84dbdcdc5055b97a241e2f707740bb966b6c58408aceb9f6a943f61405a5093c60c0dfb511b02f191ef6fa6e5a1a389f7a44ec6098439a2ef55a4ba07e2b0f62ae86e1458f63f6b8b2d2b9990495f17b6d1052b19472a97d41204a8be48e380be2e6885c7de0807f2c154ad4f25b16027bc4aeb85dc798e7eef25631bfd79c8e0aff725dcd4b91c61bf8d72f74e4dbae59bddcea722c5135791af1f0ab1d70de8b01881f52fb93a1bd27bd1124184cc3e2dada2b12aaf6fb1e48a5ddc0dceaf1b738b13c2a21dfc74b316af57487ac0119c0c3dca97fa737"], 0x1, 0x11fa, &(0x7f0000001600)="$eJzs3M+LG2UYB/Cn29bWrftDrdUWpC960cvQ3YMXBVlkC9KA0naFVhCm7kRDxiRkwkJEjJ68+neIR2+CeNNLL/4N3vbisQdxxMTapsRDadkp4fO55CHv+w3PS0LgHeadw7e+/azbrrJ2PoqVY2/HyiAi3UmRYiXu+ipef/OXX1++duPmlZ1Wa/dqSpd3rm+9kVJav/jTh198/8rPozMf/LD+46m4vfnR4R/bv0/O3T5/+Nf1TztV6lSp1x+lPN3q90f5rbJI+52qm6X0flnkVZE6vaoYzo23y/5gME55b39tdTAsqirlvXHqFuM06qfRcJzyT/JOL2VZltZWg0ex992duq4j6vpkPBV1XddPx2qciWdiLdZjIzbj2Xguno+z8UKcixfjpTg/ndV03wAAAAAAAAAAAAAAAAAAALBcHun8/8WGmwcAAAAAAAAAAAAAAAAAAIAlce3GzSs7rdbu1ZROR5TfHOwd7M1eZ+M77ehEGUVcio34M6an/2dm9eV3W7uX0tRmfF1O/s1PDvaOz+e3po8TWJjfmuXTfP5UrN6f346NOLs4v70wfzpee/W+fBYb8dvH0Y8y9uOf7L38l1spvfNe64H8hek8AAAAWAZZ+s/C/XuW/d/4LP8Q1wce2F+fiAsnml07EdX4825elsWw8eJuR7N3JhHxhDS2xMXJJ6ONx1scn/shNd/PERfHIuJxfE5z/0kcnXtfetOdAAAAAAAAAAAA8DCO4rbEptcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA3O3AsAAAAACDM3zqNjg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICvAgAA//8Dzctd") r0 = openat(0xffffffffffffff9c, &(0x7f0000002800)='./file1\x00', 0x42, 0x0) fadvise64(r0, 0x0, 0x1, 0x4) 868.231721ms ago: executing program 2 (id=167): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpid() sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0xa, 0x1234, 0x0, @remote}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000840)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000008c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000900), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000940)=0x6) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff, 0x6}) 868.034631ms ago: executing program 4 (id=168): bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xb, 0x6, &(0x7f0000000680)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x11, 0x38}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f00000006c0)='GPL\x00', 0x5, 0x29e, &(0x7f0000000700)=""/195, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) 571.465851ms ago: executing program 1 (id=169): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000005c0)=0x800, 0x4) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000640)={0x2, 0x4e24, @loopback}, 0x10) close(0x3) r2 = socket(0x28, 0x6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0) connect$inet6(r2, 0x0, 0x0) r3 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000840), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000880)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000008c0), 0x4) setsockopt$inet_tcp_TLS_RX(r3, 0x11a, 0x2, &(0x7f0000000900)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) sendto$inet(r1, &(0x7f0000000980)='\x00', 0x4000, 0x40, 0x0, 0x0) recvfrom$inet(r3, &(0x7f00000009c0), 0x4000, 0x0, 0x0, 0x0) 564.202052ms ago: executing program 1 (id=170): syz_mount_image$fuse(0x0, &(0x7f00000006c0)='./proc\x00', 0x20480c0, 0x0, 0xfe, 0x0, 0x0) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r0, &(0x7f0000000880)='6', 0x32) bpf$MAP_CREATE(0x0, 0x0, 0x0) fsopen(&(0x7f00000008c0)='bpf\x00', 0x0) 434.699625ms ago: executing program 0 (id=171): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x13, &(0x7f0000001f00)=ANY=[@ANYBLOB="18000000030000000000000003000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000004000000850000007500000095"], &(0x7f0000001fc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000002000)={r0}, 0xc) 231.445166ms ago: executing program 3 (id=172): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) time(&(0x7f00000000c0)) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x800002) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4098884, 0x0, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3b}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@private=0xa010101, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 208.254058ms ago: executing program 0 (id=173): ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x46) 137.310236ms ago: executing program 1 (id=174): connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20000023896) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$inet(0x2, 0x2, 0x20000006) r0 = socket(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x1, 0x0, 0x6, r2, 0x1}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x1, 0x4b, r2, 0x2}, 0xc) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x0) 27.561987ms ago: executing program 1 (id=175): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x4) 22.961487ms ago: executing program 0 (id=176): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000b40), 0x0, 0x81) ioctl$HIDIOCSFEATURE(r1, 0xc0404806, &(0x7f0000000b80)) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000640)={0x1, &(0x7f0000000680)=[{0x6, 0x2, 0x17, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=177): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001240)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b7000000010000009500"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000440)={@map=r5, r6, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r5, &(0x7f00000004c0), &(0x7f0000000500)=@tcp=r3}, 0x20) sendto(r4, &(0x7f0000000540)="01020304", 0x4, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 12.294033][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 12.294045][ T30] audit: type=1400 audit(1793849549.614:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.300140][ T30] audit: type=1400 audit(1793849549.614:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.304122][ T30] audit: type=1400 audit(1793849549.614:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14563]" dev="pipefs" ino=14563 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.309005][ T30] audit: type=1400 audit(1793849549.614:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.314229][ T30] audit: type=1400 audit(1793849549.614:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.127' (ED25519) to the list of known hosts. [ 18.847593][ T30] audit: type=1400 audit(1793849556.164:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.848800][ T277] cgroup: Unknown subsys name 'net' [ 18.870387][ T30] audit: type=1400 audit(1793849556.164:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.897540][ T30] audit: type=1400 audit(1793849556.194:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.897698][ T277] cgroup: Unknown subsys name 'devices' [ 19.044522][ T277] cgroup: Unknown subsys name 'hugetlb' [ 19.050142][ T277] cgroup: Unknown subsys name 'rlimit' [ 19.157097][ T30] audit: type=1400 audit(1793849556.474:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.180623][ T30] audit: type=1400 audit(1793849556.474:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.205460][ T30] audit: type=1400 audit(1793849556.474:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.211645][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.237435][ T30] audit: type=1400 audit(1793849556.554:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.262846][ T30] audit: type=1400 audit(1793849556.554:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.298221][ T30] audit: type=1400 audit(1793849556.614:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.323872][ T30] audit: type=1400 audit(1793849556.614:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.323948][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.875155][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.882204][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.889644][ T285] device bridge_slave_0 entered promiscuous mode [ 19.896681][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.903900][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.911168][ T285] device bridge_slave_1 entered promiscuous mode [ 19.993711][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.000761][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.008161][ T286] device bridge_slave_0 entered promiscuous mode [ 20.016409][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.023506][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.030900][ T286] device bridge_slave_1 entered promiscuous mode [ 20.086048][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.093760][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.101182][ T287] device bridge_slave_0 entered promiscuous mode [ 20.111882][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.119077][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.126511][ T289] device bridge_slave_0 entered promiscuous mode [ 20.133192][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.140212][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.147653][ T287] device bridge_slave_1 entered promiscuous mode [ 20.166711][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.173837][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.181103][ T289] device bridge_slave_1 entered promiscuous mode [ 20.201417][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.208519][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.216552][ T288] device bridge_slave_0 entered promiscuous mode [ 20.225927][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.233089][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.240480][ T288] device bridge_slave_1 entered promiscuous mode [ 20.297673][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.304749][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.312093][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.319169][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.401088][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.408174][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.415799][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.422811][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.436566][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.443675][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.450929][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.457972][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.472288][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.479358][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.486625][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.493649][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.506971][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.514034][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.521287][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.528327][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.553754][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.562096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.571219][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.578570][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.586561][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.593909][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.601163][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.608438][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.615658][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.622770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.630569][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.637888][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.645491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.652830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.677297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.685169][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.693341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.701432][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.708462][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.716269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.724403][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.731401][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.739370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.747525][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.754550][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.792845][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.800943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.809571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.818281][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.825357][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.833254][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.841257][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.849448][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.856471][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.863905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.871822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.879920][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.887829][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.896020][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.903046][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.910421][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.918644][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.925666][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.933213][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.941447][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.948501][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.977434][ T285] device veth0_vlan entered promiscuous mode [ 20.983929][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.992014][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.002183][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.010543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.018900][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.027268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.035314][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.043551][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.051466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.059834][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.068258][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.076204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.084171][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.092405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.100839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.108738][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.116723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.124341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.131720][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.139286][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.146941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.154477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.163111][ T289] device veth0_vlan entered promiscuous mode [ 21.170268][ T286] device veth0_vlan entered promiscuous mode [ 21.182622][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.190785][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.199071][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.207566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.216122][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.224289][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.233320][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.241046][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.249249][ T288] device veth0_vlan entered promiscuous mode [ 21.258132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.266530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.278524][ T286] device veth1_macvtap entered promiscuous mode [ 21.290591][ T288] device veth1_macvtap entered promiscuous mode [ 21.298178][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.306374][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.314657][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.322198][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.330527][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.339247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.347559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.355869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.364924][ T285] device veth1_macvtap entered promiscuous mode [ 21.378237][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.386011][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.394817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.403907][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.412384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.420573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.428223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.448110][ T287] device veth0_vlan entered promiscuous mode [ 21.455026][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.463338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.471614][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.480075][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.488760][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.497171][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.505640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.514304][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.522571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.530994][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.539435][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.547909][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.556298][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.564494][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.573459][ T289] device veth1_macvtap entered promiscuous mode [ 21.592778][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 21.608763][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.617711][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.626208][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.635529][ T287] device veth1_macvtap entered promiscuous mode [ 21.644083][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.651814][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.660334][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.683787][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.696223][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.698853][ T310] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.707716][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.730227][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.739531][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.748671][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.333053][ T39] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 22.377884][ T345] FAULT_INJECTION: forcing a failure. [ 22.377884][ T345] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 22.391661][ T345] CPU: 0 PID: 345 Comm: syz.4.13 Not tainted syzkaller #0 [ 22.398805][ T345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 22.408901][ T345] Call Trace: [ 22.412191][ T345] [ 22.415108][ T345] __dump_stack+0x21/0x30 [ 22.419446][ T345] dump_stack_lvl+0x110/0x170 [ 22.424108][ T345] ? show_regs_print_info+0x20/0x20 [ 22.429298][ T345] dump_stack+0x15/0x20 [ 22.433481][ T345] should_fail+0x3ab/0x500 [ 22.438050][ T345] should_fail_usercopy+0x1a/0x20 [ 22.443075][ T345] _copy_to_iter+0x220/0x10b0 [ 22.447751][ T345] ? iov_iter_init+0x180/0x180 [ 22.452513][ T345] ? security_file_permission+0x79/0xa0 [ 22.458048][ T345] get_random_bytes_user+0x1cd/0x3b0 [ 22.463326][ T345] ? signal_pending+0xa0/0xa0 [ 22.467995][ T345] ? memset+0x35/0x40 [ 22.472002][ T345] ? import_single_range+0x14a/0x220 [ 22.477277][ T345] __x64_sys_getrandom+0x1d2/0x2c0 [ 22.482470][ T345] ? add_disk_randomness+0xd0/0xd0 [ 22.488200][ T345] ? ksys_write+0x1fa/0x260 [ 22.492823][ T345] ? __kasan_check_write+0x14/0x20 [ 22.497959][ T345] ? switch_fpu_return+0x15d/0x2c0 [ 22.503064][ T345] x64_sys_call+0x426/0x9a0 [ 22.507570][ T345] do_syscall_64+0x4c/0xa0 [ 22.512103][ T345] ? clear_bhb_loop+0x50/0xa0 [ 22.516777][ T345] ? clear_bhb_loop+0x50/0xa0 [ 22.521445][ T345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.527329][ T345] RIP: 0033:0x7f7240adfb19 [ 22.531734][ T345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.551357][ T345] RSP: 002b:00007f723f537028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 22.560090][ T345] RAX: ffffffffffffffda RBX: 00007f7240d65fa0 RCX: 00007f7240adfb19 [ 22.568063][ T345] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000001f00 [ 22.576063][ T345] RBP: 00007f7240b77b70 R08: 0000000000000000 R09: 0000000000000000 [ 22.584028][ T345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 22.591986][ T345] R13: 00007f7240d66038 R14: 00007f7240d65fa0 R15: 00007fffc3a74f78 [ 22.599951][ T345] [ 22.666403][ T356] device-mapper: table: 253:0: verity: Data device is too small [ 22.674150][ T356] device-mapper: ioctl: error adding target to table [ 22.701136][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 22.723025][ T39] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 22.740568][ T365] netlink: 44 bytes leftover after parsing attributes in process `syz.0.20'. [ 22.753973][ T39] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 22.815431][ T367] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 22.823582][ T367] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 22.855283][ T39] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 22.864438][ T39] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 22.872418][ T39] usb 4-1: SerialNumber: syz [ 22.913789][ T39] usb 4-1: 0:2 : does not exist [ 22.943015][ T346] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 22.944606][ T364] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.113021][ T369] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 23.113062][ T6] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.135782][ T39] usb 4-1: USB disconnect, device number 2 [ 23.183014][ T346] usb 5-1: Using ep0 maxpacket: 16 [ 23.192986][ T364] usb 3-1: Using ep0 maxpacket: 16 [ 23.303124][ T346] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 23.313300][ T346] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.323266][ T364] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 23.324449][ T346] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.334474][ T364] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 23.344562][ T346] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 23.365880][ T346] usb 5-1: config 0 interface 0 has no altsetting 0 [ 23.372469][ T346] usb 5-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 23.381515][ T346] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.390498][ T346] usb 5-1: config 0 descriptor?? [ 23.393026][ T6] usb 1-1: Using ep0 maxpacket: 32 [ 23.483034][ T369] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 23.491257][ T369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 23.501428][ T369] usb 2-1: config 0 has no interface number 0 [ 23.507656][ T369] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 23.518722][ T369] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 23.523051][ T6] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 23.528647][ T369] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 23.537094][ T364] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 23.558928][ T6] usb 1-1: config 0 has no interface number 0 [ 23.565018][ T6] usb 1-1: config 0 interface 184 has no altsetting 0 [ 23.571816][ T364] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.579873][ T364] usb 3-1: Product: syz [ 23.584061][ T364] usb 3-1: Manufacturer: syz [ 23.588636][ T364] usb 3-1: SerialNumber: syz [ 23.645705][ T376] input: syz1 as /devices/virtual/input/input4 [ 23.703098][ T369] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 23.712210][ T369] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.721675][ T369] usb 2-1: Product: syz [ 23.728117][ T369] usb 2-1: Manufacturer: syz [ 23.732780][ T369] usb 2-1: SerialNumber: syz [ 23.738070][ T369] usb 2-1: config 0 descriptor?? [ 23.753048][ T6] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 23.762095][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.770102][ T6] usb 1-1: Product: syz [ 23.774270][ T6] usb 1-1: Manufacturer: syz [ 23.778838][ T6] usb 1-1: SerialNumber: syz [ 23.787495][ T6] usb 1-1: config 0 descriptor?? [ 23.833348][ T6] smsc75xx v1.0.0 [ 23.875422][ T346] logitech-djreceiver 0003:046D:C53A.0001: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.4-1/input0 [ 23.913143][ T364] usb 3-1: 0:2 : does not exist [ 23.925774][ T364] usb 3-1: USB disconnect, device number 2 [ 23.997260][ T385] usb 2-1: USB disconnect, device number 2 [ 24.003204][ T296] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 24.096104][ T346] usb 5-1: USB disconnect, device number 2 [ 24.253000][ T296] usb 4-1: Using ep0 maxpacket: 8 [ 24.373064][ T296] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.384240][ T296] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.394051][ T30] kauditd_printk_skb: 68 callbacks suppressed [ 24.394064][ T30] audit: type=1400 audit(1793849561.704:142): avc: denied { name_bind } for pid=389 comm="syz.2.29" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 24.422043][ T296] usb 4-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.435353][ T296] usb 4-1: config 0 interface 0 has no altsetting 0 [ 24.441807][ T30] audit: type=1400 audit(1793849561.704:143): avc: denied { node_bind } for pid=389 comm="syz.2.29" saddr=::1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.442157][ T296] usb 4-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 24.472764][ T296] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.473648][ T30] audit: type=1400 audit(1793849561.714:144): avc: denied { read write } for pid=391 comm="syz.2.30" name="vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 24.484105][ T6] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 24.515514][ T296] usb 4-1: config 0 descriptor?? [ 24.520828][ T6] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 24.534848][ T30] audit: type=1400 audit(1793849561.714:145): avc: denied { open } for pid=391 comm="syz.2.30" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 24.558659][ T30] audit: type=1400 audit(1793849561.854:146): avc: denied { read write } for pid=393 comm="syz.2.31" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 24.581661][ T30] audit: type=1400 audit(1793849561.854:147): avc: denied { open } for pid=393 comm="syz.2.31" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 24.639710][ T400] HTB: quantum of class FFF10001 is small. Consider r2q change. [ 24.648096][ T30] audit: type=1400 audit(1793849561.964:148): avc: denied { unmount } for pid=393 comm="syz.2.31" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 24.813017][ T385] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 24.870299][ T30] audit: type=1400 audit(1793849562.184:149): avc: denied { create } for pid=405 comm="syz.4.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.889614][ T30] audit: type=1400 audit(1793849562.184:150): avc: denied { bind } for pid=405 comm="syz.4.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.909100][ T30] audit: type=1400 audit(1793849562.184:151): avc: denied { connect } for pid=405 comm="syz.4.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.913796][ T408] input: syz0 as /devices/virtual/input/input5 [ 24.984682][ T296] input: HID 046d:c623 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:046D:C623.0002/input/input6 [ 25.052961][ T385] usb 2-1: Using ep0 maxpacket: 16 [ 25.065489][ T296] logitech 0003:046D:C623.0002: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 046d:c623] on usb-dummy_hcd.3-1/input0 [ 25.173275][ T385] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.183468][ T385] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 25.343059][ T385] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 25.352323][ T385] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.360406][ T385] usb 2-1: Product: syz [ 25.364617][ T385] usb 2-1: Manufacturer: syz [ 25.369261][ T385] usb 2-1: SerialNumber: syz [ 25.602998][ T296] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 25.693030][ T385] usb 2-1: 0:2 : does not exist [ 25.734737][ T385] usb 2-1: USB disconnect, device number 3 [ 25.943864][ T374] udevd[374]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.963087][ T296] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.973346][ T296] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.053300][ T296] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 0.00 [ 26.062533][ T296] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 26.070556][ T296] usb 3-1: SerialNumber: syz [ 26.113561][ T296] usb 3-1: 0:2 : does not exist [ 26.541161][ T364] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 26.558463][ T369] usb 3-1: USB disconnect, device number 3 [ 26.623027][ T26] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 26.782957][ T364] usb 5-1: Using ep0 maxpacket: 16 [ 26.923079][ T364] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.933405][ T364] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.983058][ T26] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 26.994141][ T26] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.103744][ T364] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 27.113669][ T364] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.121884][ T364] usb 5-1: Product: syz [ 27.123537][ T26] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 27.126615][ T364] usb 5-1: Manufacturer: syz [ 27.140788][ T26] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 27.140941][ T20] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 27.149148][ T26] usb 2-1: Product: syz [ 27.149160][ T26] usb 2-1: Manufacturer: syz [ 27.165960][ T364] usb 5-1: SerialNumber: syz [ 27.183567][ T26] hub 2-1:4.0: USB hub found [ 27.213038][ T20] usb 4-1: device reset changed ep0 maxpacket size! [ 27.221120][ T385] usb 4-1: USB disconnect, device number 3 [ 27.325150][ T451] kvm [450]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x10000003c [ 27.334664][ T451] kvm [450]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 27.345415][ T451] kvm [450]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0x187 data 0x70b3 [ 27.356832][ T451] kvm [450]: vcpu0, guest rIP: 0x18e vmx_set_msr: BTF|LBR in IA32_DEBUGCTLMSR 0x6261, nop [ 27.382985][ T385] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.420697][ T454] capability: warning: `syz.2.52' uses deprecated v2 capabilities in a way that may be insecure [ 27.483037][ T26] hub 2-1:4.0: config failed, hub doesn't have any ports! (err -19) [ 27.483064][ T364] usb 5-1: 0:2 : does not exist [ 27.503715][ T364] usb 5-1: USB disconnect, device number 3 [ 27.526214][ T457] APIC base relocation is unsupported by KVM [ 27.552031][ T26] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 27.566003][ T26] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 27.587459][ T461] fido_id[461]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 27.622985][ T385] usb 4-1: Using ep0 maxpacket: 16 [ 27.663105][ T6] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 27.674112][ T6] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 27.683945][ T6] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 27.693526][ T6] smsc75xx: probe of 1-1:0.184 failed with error -71 [ 27.702828][ T6] usb 1-1: USB disconnect, device number 2 [ 27.723593][ T374] udevd[374]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.753046][ T385] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.763434][ T385] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.774507][ T385] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.784269][ T385] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 27.797140][ T385] usb 4-1: config 0 interface 0 has no altsetting 0 [ 27.803774][ T385] usb 4-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 27.812813][ T385] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.821472][ T385] usb 4-1: config 0 descriptor?? [ 27.826632][ T20] usb 2-1: USB disconnect, device number 4 [ 27.863010][ T26] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 28.009255][ T471] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 28.233005][ T26] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 28.244282][ T26] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 28.257474][ T26] usb 3-1: config 0 interface 0 has no altsetting 0 [ 28.264204][ T26] usb 3-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 28.273268][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.281690][ T26] usb 3-1: config 0 descriptor?? [ 28.294967][ T385] logitech-djreceiver 0003:046D:C53A.0004: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.3-1/input0 [ 28.492967][ T346] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 28.531879][ T476] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.539073][ T476] FAULT_INJECTION: forcing a failure. [ 28.539073][ T476] name failslab, interval 1, probability 0, space 0, times 1 [ 28.551724][ T476] CPU: 0 PID: 476 Comm: syz.4.60 Not tainted syzkaller #0 [ 28.558836][ T476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 28.569053][ T476] Call Trace: [ 28.572354][ T476] [ 28.575274][ T476] __dump_stack+0x21/0x30 [ 28.579599][ T476] dump_stack_lvl+0x110/0x170 [ 28.584266][ T476] ? show_regs_print_info+0x20/0x20 [ 28.589453][ T476] dump_stack+0x15/0x20 [ 28.593627][ T476] should_fail+0x3ab/0x500 [ 28.598049][ T476] ? br_info_notify+0xae/0x170 [ 28.602879][ T476] __should_failslab+0xa4/0xe0 [ 28.607648][ T476] should_failslab+0x9/0x20 [ 28.612169][ T476] slab_pre_alloc_hook+0x39/0xd0 [ 28.617152][ T476] ? br_info_notify+0xae/0x170 [ 28.621904][ T476] ? br_info_notify+0xae/0x170 [ 28.626772][ T476] __kmalloc_track_caller+0x6c/0x2c0 [ 28.632051][ T476] ? br_info_notify+0xae/0x170 [ 28.636838][ T476] ? br_info_notify+0xae/0x170 [ 28.641608][ T476] __alloc_skb+0x210/0x730 [ 28.646012][ T476] br_info_notify+0xae/0x170 [ 28.650715][ T476] br_ifinfo_notify+0x2a/0x40 [ 28.655478][ T476] br_stp_disable_port+0xb7/0x1b0 [ 28.660493][ T476] br_stp_disable_bridge+0x82/0x150 [ 28.665721][ T476] ? br_dev_open+0xe0/0xe0 [ 28.670122][ T476] br_dev_stop+0x2c/0xd0 [ 28.674361][ T476] ? br_dev_open+0xe0/0xe0 [ 28.678780][ T476] __dev_close_many+0x28a/0x350 [ 28.683643][ T476] ? dev_close_many+0x4d0/0x4d0 [ 28.688523][ T476] ? __local_bh_enable_ip+0x58/0x80 [ 28.693713][ T476] ? dev_set_rx_mode+0x20a/0x2c0 [ 28.698656][ T476] ? br_dev_change_rx_flags+0x30/0x50 [ 28.704019][ T476] __dev_change_flags+0x2c9/0x6a0 [ 28.709035][ T476] ? do_vfs_ioctl+0x1c15/0x1d80 [ 28.713870][ T476] ? dev_get_flags+0x1e0/0x1e0 [ 28.718621][ T476] dev_change_flags+0x80/0x1a0 [ 28.723377][ T476] dev_ifsioc+0x130/0xd50 [ 28.727704][ T476] ? dev_ioctl+0xd00/0xd00 [ 28.732101][ T476] ? __kasan_check_write+0x14/0x20 [ 28.733033][ T346] usb 2-1: Using ep0 maxpacket: 16 [ 28.737199][ T476] ? mutex_lock+0x9b/0x1c0 [ 28.737225][ T476] ? wait_for_completion_killable_timeout+0x10/0x10 [ 28.753309][ T476] ? dev_get_by_name_rcu+0xc8/0xf0 [ 28.758407][ T476] dev_ioctl+0x546/0xd00 [ 28.762641][ T476] sock_do_ioctl+0x241/0x310 [ 28.765195][ T26] hid-generic 0003:04F3:074D.0005: ignoring exceeding usage max [ 28.767229][ T476] ? sock_show_fdinfo+0xa0/0xa0 [ 28.779574][ T26] hid-generic 0003:04F3:074D.0005: No inputs registered, leaving [ 28.779673][ T476] ? selinux_file_ioctl+0x3ad/0x4c0 [ 28.792545][ T476] ? alloc_file+0x448/0x580 [ 28.797147][ T476] sock_ioctl+0x459/0x6d0 [ 28.799866][ T26] hid-generic 0003:04F3:074D.0005: hidraw1: USB HID v0.10 Joystick [HID 04f3:074d] on usb-dummy_hcd.2-1/input0 [ 28.801479][ T476] ? sock_poll+0x3f0/0x3f0 [ 28.801501][ T476] ? __fget_files+0x2e1/0x340 [ 28.822255][ T476] ? security_file_ioctl+0x84/0xa0 [ 28.827372][ T476] ? sock_poll+0x3f0/0x3f0 [ 28.831791][ T476] __se_sys_ioctl+0x121/0x1a0 [ 28.836480][ T476] __x64_sys_ioctl+0x7b/0x90 [ 28.841068][ T476] x64_sys_call+0x2f/0x9a0 [ 28.845583][ T476] do_syscall_64+0x4c/0xa0 [ 28.849991][ T476] ? clear_bhb_loop+0x50/0xa0 [ 28.854680][ T476] ? clear_bhb_loop+0x50/0xa0 [ 28.859357][ T476] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.865252][ T476] RIP: 0033:0x7f7240adfb19 [ 28.869689][ T476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.889368][ T476] RSP: 002b:00007f723f537028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 28.897771][ T476] RAX: ffffffffffffffda RBX: 00007f7240d65fa0 RCX: 00007f7240adfb19 [ 28.905729][ T476] RDX: 0000200000000900 RSI: 0000000000008914 RDI: 0000000000000004 [ 28.913688][ T476] RBP: 00007f7240b77b70 R08: 0000000000000000 R09: 0000000000000000 [ 28.921647][ T476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.929609][ T476] R13: 00007f7240d66038 R14: 00007f7240d65fa0 R15: 00007fffc3a74f78 [ 28.937567][ T476] [ 28.940900][ T476] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.953033][ T346] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.970897][ T346] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 29.005803][ T39] usb 3-1: USB disconnect, device number 4 [ 29.153035][ T346] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 29.162328][ T346] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.170559][ T346] usb 2-1: Product: syz [ 29.174887][ T346] usb 2-1: Manufacturer: syz [ 29.179500][ T346] usb 2-1: SerialNumber: syz [ 29.259358][ T496] Zero length message leads to an empty skb [ 29.266386][ T496] input: syz1 as /devices/virtual/input/input8 [ 29.333005][ T26] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.503044][ T346] usb 2-1: 0:2 : does not exist [ 29.522883][ T498] device bridge_slave_0 left promiscuous mode [ 29.529173][ T498] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.537008][ T498] device bridge_slave_1 left promiscuous mode [ 29.543851][ T498] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.547719][ T346] usb 2-1: USB disconnect, device number 5 [ 29.562983][ T20] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 29.693013][ T26] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 29.702168][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.873006][ T60] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 29.983018][ T20] usb 5-1: unable to get BOS descriptor or descriptor too short [ 30.032717][ T510] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 30.042597][ T510] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 30.442956][ T60] usb 3-1: Using ep0 maxpacket: 16 [ 30.570621][ T20] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.581302][ T20] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.581422][ T39] usb 4-1: USB disconnect, device number 4 [ 30.601048][ T60] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.613381][ T60] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.622196][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 30.622209][ T30] audit: type=1400 audit(1793849567.934:175): avc: denied { create } for pid=519 comm="syz.3.76" name="md0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 30.650694][ T60] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.650769][ T60] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 30.674159][ T60] usb 3-1: config 0 interface 0 has no altsetting 0 [ 30.675034][ T30] audit: type=1400 audit(1793849567.934:176): avc: denied { read write } for pid=519 comm="syz.3.76" name="md0" dev="tmpfs" ino=74 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 30.688749][ T60] usb 3-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 30.706782][ T30] audit: type=1400 audit(1793849567.934:177): avc: denied { open } for pid=519 comm="syz.3.76" path="/11/md0" dev="tmpfs" ino=74 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 30.713775][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.744838][ T60] usb 3-1: config 0 descriptor?? [ 30.793081][ T20] usb 5-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 30.802684][ T20] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.817266][ T20] usb 5-1: Product: syz [ 30.821897][ T20] usb 5-1: Manufacturer: syz [ 30.826641][ T20] usb 5-1: SerialNumber: syz [ 31.012206][ T30] audit: type=1400 audit(1793849568.324:178): avc: denied { unlink } for pid=286 comm="syz-executor" name="md0" dev="tmpfs" ino=74 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 31.154750][ T30] audit: type=1400 audit(1793849568.474:179): avc: denied { unlink } for pid=531 comm="syz.3.79" name="#1" dev="tmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 31.178097][ T30] audit: type=1400 audit(1793849568.474:180): avc: denied { mount } for pid=531 comm="syz.3.79" name="/" dev="overlay" ino=81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 31.233052][ T20] usb 5-1: MIDIStreaming interface descriptor not found [ 31.242376][ T20] usb 5-1: USB disconnect, device number 4 [ 31.264883][ T60] logitech-djreceiver 0003:046D:C53A.0006: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.2-1/input0 [ 31.411902][ T30] audit: type=1400 audit(1793849568.724:181): avc: denied { write } for pid=536 comm="syz.1.80" name="ip_tables_targets" dev="proc" ino=4026532592 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 31.439568][ T30] audit: type=1400 audit(1793849568.754:182): avc: denied { bpf } for pid=538 comm="syz.1.81" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 31.511519][ T20] usb 3-1: USB disconnect, device number 5 [ 31.583942][ T30] audit: type=1400 audit(1793849568.904:183): avc: denied { perfmon } for pid=538 comm="syz.1.81" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 31.605798][ T30] audit: type=1400 audit(1793849568.924:184): avc: denied { prog_run } for pid=538 comm="syz.1.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 31.636197][ T542] loop1: detected capacity change from 0 to 512 [ 31.650545][ T542] EXT4-fs (loop1): Ignoring removed nobh option [ 31.683923][ T542] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.82: invalid indirect mapped block 256 (level 2) [ 31.697638][ T542] EXT4-fs (loop1): 2 truncates cleaned up [ 31.703494][ T542] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobh,auto_da_alloc,grpquota,,errors=continue. Quota mode: writeback. [ 32.249711][ T20] usb 1-1: USB disconnect, device number 3 [ 32.492678][ T541] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.82: bg 0: block 5: invalid block bitmap [ 32.698635][ T541] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 33 with error 28 [ 32.711008][ T541] EXT4-fs (loop1): This should not happen!! Data will be lost [ 32.711008][ T541] [ 32.720794][ T541] EXT4-fs (loop1): Total free blocks count 0 [ 32.726792][ T541] EXT4-fs (loop1): Free/Dirty block details [ 32.732683][ T541] EXT4-fs (loop1): free_blocks=0 [ 32.737635][ T541] EXT4-fs (loop1): dirty_blocks=33 [ 32.742750][ T541] EXT4-fs (loop1): Block reservation details [ 32.748888][ T541] EXT4-fs (loop1): i_reserved_data_blocks=33 [ 32.755558][ T541] syz.1.82 (541) used greatest stack depth: 21792 bytes left [ 32.984372][ T570] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 33.000744][ T570] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 33.211192][ T584] futex_wake_op: syz.4.96 tries to shift op by 144; fix this program [ 33.263740][ T584] futex_wake_op: syz.4.96 tries to shift op by 144; fix this program [ 33.344088][ T608] FAULT_INJECTION: forcing a failure. [ 33.344088][ T608] name failslab, interval 1, probability 0, space 0, times 0 [ 33.356871][ T608] CPU: 0 PID: 608 Comm: syz.0.106 Not tainted syzkaller #0 [ 33.364078][ T608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 33.374318][ T608] Call Trace: [ 33.377602][ T608] [ 33.380538][ T608] __dump_stack+0x21/0x30 [ 33.384885][ T608] dump_stack_lvl+0x110/0x170 [ 33.389575][ T608] ? show_regs_print_info+0x20/0x20 [ 33.394783][ T608] dump_stack+0x15/0x20 [ 33.398975][ T608] should_fail+0x3ab/0x500 [ 33.403400][ T608] __should_failslab+0xa4/0xe0 [ 33.408181][ T608] should_failslab+0x9/0x20 [ 33.412692][ T608] slab_pre_alloc_hook+0x39/0xd0 [ 33.417690][ T608] kmem_cache_alloc_trace+0x48/0x270 [ 33.423080][ T608] ? __se_sys_fsopen+0x1a4/0x330 [ 33.428031][ T608] __se_sys_fsopen+0x1a4/0x330 [ 33.432800][ T608] __x64_sys_fsopen+0x5b/0x70 [ 33.437487][ T608] x64_sys_call+0x553/0x9a0 [ 33.441998][ T608] do_syscall_64+0x4c/0xa0 [ 33.446429][ T608] ? clear_bhb_loop+0x50/0xa0 [ 33.451114][ T608] ? clear_bhb_loop+0x50/0xa0 [ 33.455796][ T608] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 33.461694][ T608] RIP: 0033:0x7f6a6a7ebb19 [ 33.466203][ T608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.485964][ T608] RSP: 002b:00007f6a69243028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 33.494451][ T608] RAX: ffffffffffffffda RBX: 00007f6a6aa71fa0 RCX: 00007f6a6a7ebb19 [ 33.502410][ T608] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000440 [ 33.510482][ T608] RBP: 00007f6a6a883b70 R08: 0000000000000000 R09: 0000000000000000 [ 33.518448][ T608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.526410][ T608] R13: 00007f6a6aa72038 R14: 00007f6a6aa71fa0 R15: 00007ffdfc13dda8 [ 33.534649][ T608] [ 34.095722][ T621] loop4: detected capacity change from 0 to 4096 [ 34.120083][ T621] EXT4-fs (loop4): Ignoring removed nobh option [ 34.135988][ T621] EXT4-fs (loop4): Test dummy encryption mode enabled [ 34.162548][ T621] EXT4-fs (loop4): Ignoring removed bh option [ 34.181215][ T621] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,nobh,nodioread_nolock,test_dummy_encryption,lazytime,nojournal_checksum,minixdf,bh,,errors=continue. Quota mode: writeback. [ 34.358940][ T647] loop1: detected capacity change from 0 to 4096 [ 34.387042][ T647] EXT4-fs (loop1): Ignoring removed orlov option [ 34.399443][ T647] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,max_dir_size_kb=0x000000004f2040d2,auto_da_alloc,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 34.442989][ T385] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 34.458841][ T39] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 34.476096][ T650] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 34.492153][ T653] netlink: 8 bytes leftover after parsing attributes in process `syz.0.122'. [ 35.145556][ T385] usb 4-1: Using ep0 maxpacket: 8 [ 35.262984][ T385] usb 4-1: unable to get BOS descriptor or descriptor too short [ 35.312991][ T39] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 35.322068][ T39] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.322983][ T385] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 35.337683][ T385] usb 4-1: can't read configurations, error -71 [ 35.896645][ T690] netlink: 20 bytes leftover after parsing attributes in process `syz.0.134'. [ 35.954748][ T694] loop3: detected capacity change from 0 to 1024 [ 35.997836][ T694] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 36.023889][ T694] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e842c018, mo2=0003] [ 36.032101][ T694] System zones: 0-1, 3-12 [ 36.037457][ T694] EXT4-fs (loop3): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000001,nodelalloc,acl,debug,delalloc,noquota,stripe=0x0000000000000009,dioread_nolock,,errors=continue. Quota mode: none. [ 36.062671][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 36.062684][ T30] audit: type=1400 audit(1793849573.374:215): avc: denied { append } for pid=693 comm="syz.3.136" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 36.127589][ T700] loop4: detected capacity change from 0 to 128 [ 36.220877][ T30] audit: type=1400 audit(1793849573.534:216): avc: denied { mount } for pid=699 comm="syz.4.139" name="/" dev="loop4" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 36.319055][ T30] audit: type=1400 audit(1793849573.634:217): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 36.864848][ T721] usb 3-1: USB disconnect, device number 6 [ 36.907691][ T30] audit: type=1400 audit(1793849574.224:218): avc: denied { setopt } for pid=728 comm="syz.2.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.987038][ T30] audit: type=1400 audit(1793849574.304:219): avc: denied { map } for pid=722 comm="syz.0.146" path="/29/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=13111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 37.897667][ T30] audit: type=1400 audit(1793849575.214:220): avc: denied { ioctl } for pid=756 comm="syz.3.160" path="socket:[18174]" dev="sockfs" ino=18174 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 37.926538][ T757] netlink: 8 bytes leftover after parsing attributes in process `syz.3.160'. [ 38.402977][ T30] audit: type=1400 audit(1793849575.694:221): avc: denied { mount } for pid=762 comm="syz.2.162" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 38.457143][ T754] loop1: detected capacity change from 0 to 8192 [ 38.988771][ T30] audit: type=1400 audit(1793849576.244:222): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 39.017511][ T388] loop1: p1 < > p2 < > p3 p4 < p5 > [ 39.063718][ T388] loop1: partition table partially beyond EOD, truncated [ 39.079482][ T388] loop1: p1 start 83886080 is beyond EOD, truncated [ 39.093431][ T388] loop1: p2 start 16776960 is beyond EOD, truncated [ 39.112278][ T754] loop1: p1 < > p2 < > p3 p4 < p5 > [ 39.118971][ T754] loop1: partition table partially beyond EOD, truncated [ 39.133141][ T754] loop1: p1 start 83886080 is beyond EOD, truncated [ 39.139912][ T754] loop1: p2 start 16776960 is beyond EOD, truncated [ 39.239309][ T783] FAULT_INJECTION: forcing a failure. [ 39.239309][ T783] name failslab, interval 1, probability 0, space 0, times 0 [ 39.257722][ T388] udevd[388]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 39.257734][ T320] udevd[320]: inotify_add_watch(7, /dev/loop1p5, 10) failed: No such file or directory [ 39.259316][ T374] udevd[374]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 39.306512][ T783] CPU: 1 PID: 783 Comm: syz.1.170 Not tainted syzkaller #0 [ 39.313753][ T783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.323824][ T783] Call Trace: [ 39.327109][ T783] [ 39.330040][ T783] __dump_stack+0x21/0x30 [ 39.334389][ T783] dump_stack_lvl+0x110/0x170 [ 39.339091][ T783] ? show_regs_print_info+0x20/0x20 [ 39.344305][ T783] ? dump_stack+0x9/0x20 [ 39.348560][ T783] dump_stack+0x15/0x20 [ 39.352723][ T783] should_fail+0x3ab/0x500 [ 39.357234][ T783] __should_failslab+0xa4/0xe0 [ 39.362014][ T783] should_failslab+0x9/0x20 [ 39.366530][ T783] slab_pre_alloc_hook+0x39/0xd0 [ 39.371513][ T783] kmem_cache_alloc_trace+0x48/0x270 [ 39.376896][ T783] ? alloc_fs_context+0x64/0x7c0 [ 39.382022][ T783] alloc_fs_context+0x64/0x7c0 [ 39.386998][ T783] ? __se_sys_fsopen+0x108/0x330 [ 39.392252][ T783] fs_context_for_mount+0x22/0x30 [ 39.397297][ T783] __se_sys_fsopen+0x117/0x330 [ 39.402074][ T783] __x64_sys_fsopen+0x5b/0x70 [ 39.406757][ T783] x64_sys_call+0x553/0x9a0 [ 39.411261][ T783] do_syscall_64+0x4c/0xa0 [ 39.415677][ T783] ? clear_bhb_loop+0x50/0xa0 [ 39.420441][ T783] ? clear_bhb_loop+0x50/0xa0 [ 39.425114][ T783] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.431028][ T783] RIP: 0033:0x7f4472dd3b19 [ 39.435442][ T783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.455036][ T783] RSP: 002b:00007f447182b028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 39.463447][ T783] RAX: ffffffffffffffda RBX: 00007f4473059fa0 RCX: 00007f4472dd3b19 [ 39.471409][ T783] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000008c0 [ 39.479364][ T783] RBP: 00007f4472e6bb70 R08: 0000000000000000 R09: 0000000000000000 [ 39.487322][ T783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.495275][ T783] R13: 00007f447305a038 R14: 00007f4473059fa0 R15: 00007ffd94694688 [ 39.503231][ T783] [ 39.509906][ T388] udevd[388]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 39.520795][ T320] udevd[320]: inotify_add_watch(7, /dev/loop1p5, 10) failed: No such file or directory [ 39.532628][ T374] udevd[374]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 39.819203][ T369] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 39.923239][ T803] ================================================================== [ 39.931364][ T803] BUG: KASAN: slab-out-of-bounds in sk_skb_adjust_room+0x389/0x5c0 [ 39.939353][ T803] Read of size 8 at addr ffff88811d284528 by task syz.4.177/803 [ 39.946988][ T803] [ 39.949314][ T803] CPU: 0 PID: 803 Comm: syz.4.177 Not tainted syzkaller #0 [ 39.956521][ T803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.967352][ T803] Call Trace: [ 39.970639][ T803] [ 39.973567][ T803] __dump_stack+0x21/0x30 [ 39.977923][ T803] dump_stack_lvl+0x110/0x170 [ 39.982605][ T803] ? show_regs_print_info+0x20/0x20 [ 39.987801][ T803] ? load_image+0x3f0/0x3f0 [ 39.992388][ T803] ? skb_release_data+0x1b5/0xa20 [ 39.997410][ T803] print_address_description+0x7f/0x2c0 [ 40.002956][ T803] ? sk_skb_adjust_room+0x389/0x5c0 [ 40.008158][ T803] kasan_report+0x10f/0x150 [ 40.012658][ T803] ? sk_skb_adjust_room+0x389/0x5c0 [ 40.017870][ T803] __asan_report_load8_noabort+0x14/0x20 [ 40.023502][ T803] sk_skb_adjust_room+0x389/0x5c0 [ 40.028525][ T803] bpf_prog_e15ab8bd9cea3c06+0x19/0xa38 [ 40.034073][ T803] sk_psock_verdict_recv+0x245/0x7f0 [ 40.039357][ T803] unix_read_sock+0x108/0x2d0 [ 40.044041][ T803] ? sk_psock_skb_redirect+0x440/0x440 [ 40.049499][ T803] ? unix_stream_splice_actor+0x120/0x120 [ 40.055218][ T803] ? copy_mc_pipe_to_iter+0x7e0/0x7e0 [ 40.060591][ T803] ? sk_psock_skb_redirect+0x440/0x440 [ 40.066048][ T803] unix_stream_read_sock+0x61/0x90 [ 40.071158][ T803] sk_psock_verdict_data_ready+0x167/0x1d0 [ 40.076966][ T803] ? sk_psock_start_verdict+0xc0/0xc0 [ 40.082343][ T803] ? _raw_spin_lock+0x94/0xf0 [ 40.087027][ T803] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 40.092835][ T803] ? skb_queue_tail+0xcb/0xf0 [ 40.097515][ T803] unix_stream_sendmsg+0x7d1/0xc90 [ 40.102643][ T803] ? unix_show_fdinfo+0xa0/0xa0 [ 40.107504][ T803] ? __fget_files+0x2e1/0x340 [ 40.112181][ T803] ? security_socket_sendmsg+0x82/0xa0 [ 40.117639][ T803] __sys_sendto+0x46d/0x620 [ 40.122144][ T803] ? __ia32_sys_getpeername+0x90/0x90 [ 40.127511][ T803] ? map_update_elem+0x286/0x780 [ 40.132451][ T803] ? __se_sys_futex+0x135/0x330 [ 40.137303][ T803] ? __kasan_check_write+0x14/0x20 [ 40.142416][ T803] __x64_sys_sendto+0xe5/0x100 [ 40.147179][ T803] x64_sys_call+0x178/0x9a0 [ 40.151700][ T803] do_syscall_64+0x4c/0xa0 [ 40.156132][ T803] ? clear_bhb_loop+0x50/0xa0 [ 40.160820][ T803] ? clear_bhb_loop+0x50/0xa0 [ 40.165591][ T803] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.171491][ T803] RIP: 0033:0x7f7240adfb19 [ 40.175994][ T803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.195707][ T803] RSP: 002b:00007f723f537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 40.204133][ T803] RAX: ffffffffffffffda RBX: 00007f7240d65fa0 RCX: 00007f7240adfb19 [ 40.212137][ T803] RDX: 0000000000000004 RSI: 0000200000000540 RDI: 0000000000000006 [ 40.220113][ T803] RBP: 00007f7240b77b70 R08: 0000000000000000 R09: 0000000000000000 [ 40.228207][ T803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.236186][ T803] R13: 00007f7240d66038 R14: 00007f7240d65fa0 R15: 00007fffc3a74f78 [ 40.244166][ T803] [ 40.247183][ T803] [ 40.249500][ T803] Allocated by task 803: [ 40.253736][ T803] __kasan_slab_alloc+0xb7/0xe0 [ 40.258589][ T803] slab_post_alloc_hook+0x4f/0x2b0 [ 40.263703][ T803] kmem_cache_alloc+0xf7/0x260 [ 40.268463][ T803] sk_prot_alloc+0x5f/0x320 [ 40.272974][ T803] sk_alloc+0x38/0x430 [ 40.277038][ T803] unix_create1+0xb4/0x610 [ 40.281446][ T803] unix_create+0x149/0x200 [ 40.285863][ T803] __sock_create+0x38d/0x7a0 [ 40.290449][ T803] __sys_socketpair+0x1a1/0x590 [ 40.295293][ T803] __x64_sys_socketpair+0x9b/0xb0 [ 40.300308][ T803] x64_sys_call+0x36/0x9a0 [ 40.304721][ T803] do_syscall_64+0x4c/0xa0 [ 40.309134][ T803] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.315024][ T803] [ 40.317340][ T803] The buggy address belongs to the object at ffff88811d284000 [ 40.317340][ T803] which belongs to the cache UNIX-STREAM of size 1216 [ 40.331471][ T803] The buggy address is located 104 bytes to the right of [ 40.331471][ T803] 1216-byte region [ffff88811d284000, ffff88811d2844c0) [ 40.345361][ T803] The buggy address belongs to the page: [ 40.351003][ T803] page:ffffea000474a100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d284 [ 40.361244][ T803] head:ffffea000474a100 order:2 compound_mapcount:0 compound_pincount:0 [ 40.369570][ T803] flags: 0x4000000000010200(slab|head|zone=1) [ 40.375668][ T803] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881003e7380 [ 40.384245][ T803] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 40.392815][ T803] page dumped because: kasan: bad access detected [ 40.399218][ T803] page_owner tracks the page as allocated [ 40.404922][ T803] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 276, ts 18171103232, free_ts 0 [ 40.423064][ T803] post_alloc_hook+0x192/0x1b0 [ 40.427847][ T803] prep_new_page+0x1c/0x110 [ 40.432369][ T803] get_page_from_freelist+0x2d42/0x2dd0 [ 40.437931][ T803] __alloc_pages+0x1a2/0x460 [ 40.442537][ T803] new_slab+0xa0/0x4d0 [ 40.446615][ T803] ___slab_alloc+0x3ac/0x840 [ 40.451217][ T803] __slab_alloc+0x49/0x90 [ 40.455562][ T803] kmem_cache_alloc+0x138/0x260 [ 40.460424][ T803] sk_prot_alloc+0x5f/0x320 [ 40.464946][ T803] sk_alloc+0x38/0x430 [ 40.469018][ T803] unix_create1+0xb4/0x610 [ 40.472744][ T369] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 40.473438][ T803] unix_stream_connect+0x308/0x1020 [ 40.473459][ T803] __sys_connect+0x3cb/0x450 [ 40.473479][ T803] __x64_sys_connect+0x7a/0x90 [ 40.473493][ T803] x64_sys_call+0x7c/0x9a0 [ 40.501882][ T803] do_syscall_64+0x4c/0xa0 [ 40.506286][ T803] page_owner free stack trace missing [ 40.511632][ T803] [ 40.513933][ T803] Memory state around the buggy address: [ 40.519544][ T803] ffff88811d284400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.527587][ T803] ffff88811d284480: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 40.535629][ T803] >ffff88811d284500: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 40.543666][ T803] ^ [ 40.549013][ T803] ffff88811d284580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.557052][ T803] ffff88811d284600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.565603][ T803] ================================================================== [ 40.573660][ T803] Disabling lock debugging due to kernel taint [ 40.605011][ T30] audit: type=1400 audit(1793849577.924:223): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 40.648551][ T30] audit: type=1400 audit(1793849577.924:224): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1