last executing test programs: 9.039081538s ago: executing program 4 (id=63): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000300)=ANY=[@ANYBLOB="400f06"], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000480)={0x20, 0x9, 0x4, "77eaede5"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x5}, 0x0, 0x0, 0x0, 0x0}) 6.296315499s ago: executing program 4 (id=84): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000090000008b0000"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000680), &(0x7f0000000680), 0x2000006c, r0}, 0x38) 6.28184075s ago: executing program 4 (id=85): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_pidfd_open(0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket(0x8000000010, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000685000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x2, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 5.612138177s ago: executing program 0 (id=94): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a400fe00000000b7060000080000001e64000000000000450403000100ff801704000001000a00b7040000ff010000720af2fe000000008500000049000000b700000070b2000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d761ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a8321e056acf27c34bed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb93ce1c0983cdcb48477b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e44c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6bc7c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000000000000000000000000007a4604baa70bda5d5f18f54e9638350a6dd81a55ab5528efd1ef5a564908db7cce99e5c569c2947763b90e03b6d1a53b590e4ff4867f0d86b9af58244866b9df33634c8d85ce1b3bfa3e5bec6989c907c2f46b9a837676e07d87bb7dba3f34694ceb5b9faf10eece00bcfd503ed3f3048782665a848d79e443de4ba97db3a9bde69be7612cb1441c61eadd5bb4494ff2eb189c2ab3a241c12f764c0719650c1b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000080), 0x60, 0x10, &(0x7f0000000340), 0xfffffffffffffdef, 0x0, 0xffffffffffffffff, 0xfffffffffffffe96}, 0x42) 5.212231686s ago: executing program 4 (id=96): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x5a4, 0x8003, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xd0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x7, {0x7, 0x0, "392cdaab4a"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 5.205029016s ago: executing program 3 (id=97): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000840)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x64, 0xd, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x4096}, 0x0) 4.788318097s ago: executing program 2 (id=98): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0xfffffffe, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000200)=@gcm_128={{0x303}, "f64d87da603fa09a", "ec9580400006000000ba6a6b247009d4", "be164209", '\x00\x00\x00\x00\x00\x00\b\x00'}, 0x28) sendmsg(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[{0x10, 0x11a, 0x5}], 0x10}, 0x80) 3.028311001s ago: executing program 2 (id=99): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r0) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff00000000010000000c00060003000000000500000400078008000100000000000c0002"], 0x38}}, 0x20000000) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000026c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000027c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="5d4528bd70a0fcdbdf25010000000c0002000100000000000000340007"], 0x60}, 0x1, 0x0, 0x0, 0x4040005}, 0x8044) 3.028014111s ago: executing program 3 (id=100): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000380)=""/113, 0x71}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="02"], 0x50) syz_clone(0x80040000, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 3.027845001s ago: executing program 2 (id=101): syz_usb_connect(0x0, 0x6b, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a240102000502010209240743040001a530112406060405080004"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x9c, &(0x7f0000000140)=@string={0x9c, 0x3, "0b6916c99ddc402d34412273c4bfa0083ae1eda94d6f45bb0bc0326d34004a672c167567a04847c3c50dd5e2c24be13299e6ee0fce0b67f73e94c82696003432aaff9cdbfdc4a664764e56fe7e058e3bf5056a3768e149e8aa38c463973091612620ac4f222d6deb8cf828235d5651918b015fbb6a2f18429269417fbcfca96eef619a135afbe8123ed0808b11ce4ed9eb3c5ffc2f2a6b9438bb"}}, {0x0, 0x0}, {0x1a, &(0x7f00000002c0)=@string={0x1a, 0x3, "9b5271b2fe2c45007b0897a4f2e3c58c5ea40330438b19ad"}}, {0x1e, &(0x7f0000000340)=@string={0x1e, 0x3, "85af0444c6936b44723600160cfce5779932a434ef84b9ef2fe50338"}}]}) listen(0xffffffffffffffff, 0x0) 3.027634121s ago: executing program 3 (id=102): r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000380)={'syz0\x00', {0xff, 0x6, 0x7fff, 0x8d5}, 0x24, [0x10000, 0xeba, 0x7, 0xe6a, 0x8, 0x1, 0x5, 0x80, 0x54, 0x7fffdfff, 0x2, 0xc, 0x8, 0x9, 0x9, 0x3, 0x7, 0x40000, 0x1a, 0x26, 0x2, 0x0, 0x3ff, 0xfffffff4, 0x1, 0xda6, 0x3, 0xa7, 0xeb36, 0x2, 0x9, 0x200, 0x200, 0x1, 0x1, 0x1, 0x7, 0x9, 0xd, 0x7, 0x9, 0x80000000, 0x9, 0xb50, 0x0, 0x800, 0x3, 0x0, 0x7, 0xfffffffe, 0x5, 0x8, 0x24, 0x7fff, 0x8, 0xffffffff, 0x1, 0x0, 0x0, 0x7f, 0x964e, 0x2d5, 0x149, 0x1], [0x66ac, 0xfffffff9, 0x4, 0x3, 0x8e, 0x7, 0x80000001, 0x9, 0x4, 0x2, 0x0, 0x7, 0x6, 0x8001, 0x9, 0x8, 0x2, 0x5, 0xb, 0x7ff, 0x7ff, 0x5, 0x9, 0xc00, 0x89, 0x7ff, 0x0, 0x1, 0x10000, 0x9, 0x9, 0x4d26, 0x10000, 0x8, 0x1, 0x7, 0x0, 0x4, 0x4c, 0x9, 0x8, 0x5, 0xe66, 0x8, 0x2, 0x81, 0x4b, 0x7d, 0x6, 0xb, 0x4, 0x9, 0x1, 0x8d1, 0x100008fd, 0xfffffffa, 0xe0, 0x8e, 0x10001, 0x2004, 0x401, 0x80000001, 0x7f, 0x9], [0x8396, 0x7, 0x10000, 0x9, 0x8000, 0x1, 0x9, 0xe, 0x8, 0x6, 0x0, 0x400, 0x1000, 0x9, 0x6e, 0x8001, 0x7, 0x3, 0x6, 0x6, 0x3, 0xc7, 0x2, 0x3, 0x1, 0x2, 0x8001, 0xc, 0x5, 0xb10, 0x1e, 0x3, 0x800, 0x80008, 0x9, 0x3, 0x200, 0xfffffff7, 0x4, 0xe, 0x464b, 0x6, 0x2e7, 0x7ff, 0x200, 0x6, 0x87ff, 0x2, 0x7fffffff, 0xffffffff, 0x5, 0xfdff, 0xd5d, 0xa0c787d, 0xffffff4e, 0x9, 0x6, 0x40, 0x3, 0x0, 0x1fc1, 0x9, 0x1, 0x16], [0x10000010, 0x7, 0x7, 0x2, 0xa5e, 0xfe, 0xff, 0x8, 0x80000000, 0x0, 0xe, 0x2, 0x4, 0x7, 0x7, 0x0, 0xfffffffd, 0xfffffff8, 0xdaa, 0x4, 0x3, 0x103, 0x6, 0xcc, 0x6, 0x4000400, 0xffffffff, 0xfffffffa, 0x40, 0x80000000, 0x4, 0x7, 0xfff, 0x40, 0x9, 0x0, 0x9, 0x1, 0x0, 0x7, 0x6, 0x3, 0x1, 0x80000002, 0x80000002, 0xff, 0x6, 0x3, 0xfffff801, 0xffefffff, 0x37d, 0xfffffff8, 0xd, 0x7, 0xd, 0x8, 0x0, 0x0, 0x8, 0x5e02, 0x2, 0x3, 0x5, 0x5]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000001240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000900)={0x34, r4, 0x1, 0x71bd25, 0x3, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xc0}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x95}]}]}]}, 0x34}}, 0x4) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x24, r7, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x82}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x20000801) ioctl$UI_DEV_CREATE(r0, 0x5501) sched_setscheduler(r1, 0x0, &(0x7f0000000080)=0x9) 2.63832703s ago: executing program 0 (id=103): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x18}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) 2.626002151s ago: executing program 0 (id=104): openat(0xffffffffffffff9c, &(0x7f0000001000)='./file1\x00', 0x42, 0x1ff) syz_clone(0x820400, 0x0, 0xfffffffffffffecc, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r0, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) 2.568406077s ago: executing program 0 (id=105): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x4}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000b80)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) r3 = fcntl$dupfd(r0, 0x0, r1) write$FUSE_NOTIFY_STORE(r3, &(0x7f00000000c0)={0x28, 0x4, 0x0, {0x0, 0x6}}, 0xc388) 2.568167527s ago: executing program 0 (id=106): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x2) syz_emit_ethernet(0x4a, &(0x7f00000002c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x9e, &(0x7f00000003c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a3ff2", 0x68, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x1a, 0x14, 0x8000, 0x0, 0x0, {[@sack={0x5, 0x16, [0x4, 0x6, 0x0, 0x2, 0x200]}, @generic={0xfe, 0xf, "7574364ce7ebf32dd6726fff0e"}, @sack_perm={0x4, 0x2}, @sack={0x5, 0x12, [0x5, 0x8, 0xc709, 0x401]}, @timestamp={0x8, 0xa, 0x2b, 0xf08}, @generic={0x8, 0xe, "ff93c7c1b9a91c5a96e2f5ec"}]}}}}}}}}, 0x0) 2.53887731s ago: executing program 0 (id=107): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000700)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x10, 0x938, 0x4000cd7, 0x7, 0x8, 0xb, 0x6, 0x4, 0x6, 0x7e7, 0x9, 0xe75}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.219340831s ago: executing program 4 (id=108): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc401020301090212"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.104246033s ago: executing program 3 (id=109): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x2641d82c) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x39383ddd, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) syz_io_uring_setup(0x38, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 2.103798293s ago: executing program 3 (id=110): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000be80)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) 2.103663213s ago: executing program 3 (id=111): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 1.992121334s ago: executing program 1 (id=117): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf80, 0x3}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000002080)="c2f742b15efaf3b42f712a35930152325cffed3ae8c8d3f31bb0bb166b3f05bf170f31099dce058c3b100048ac18b2fc7aa421fd3a2c974e4c1b2bdf6b0aeac7847f79edc9442b4ee34666d67e1df6eee3f2a0a14d709922dab3de0a02ec83c0626199dc3294c00e84cb42a354b87b933644b3c6bd27e24c21af58f878a2b0826eb434c405061aa14292278956bef40ff1316fd7bfb0d5befe2155570817a17a9498c5a2caae355e81015a10fcc78258f1d9dc6bc87375bcb311242038f5a8a01b341d276cad374b301827b8932faff3d6462d28f2605f9b88b787aab1b735edaeb9ba6979152c36ad73be96ab77b7cf6501bfd89aa9dacfdc55a921a5ed910882304c5c2be59e58947d02c754fa78800f04a4d02f142525f8f5ae0a98f000001ec276ff2e182ec8303056a515d0c3c15cf25fc155cc078de38eac55a6106e10fcee5e2404237cd7a951665140ad8596bb17b39e12bc0677b42cce532b03a69c13b064fde504f58d6414890b170d806142cf7267c16a6026ca07ae7cd9526905510a7515abc223f1c8abd2af566d4b9e9822341f76874c90f0254e11a826bc17828ed228abcf8c849b3386103aaec4332f2d88f654793205df3c78c5eb3203e30b016af5322e3aa7231c4f132d740eedf3286c66424a85f2fc73c23332a44af0a96ce4136c61a4dca2082279e021a0308b367ba21accd1039cca666dac81e1a7c346d7723c5d5f165d4533eaab122093ffef76ddfd03646d3d946d6e35bb25dc152421c54aaf53145d4da3959c56f5f6a28efa5ce8c84b63a20e57571cf8cba399257b475048ae39e4d22a145b7ca74813ba22f8ccd3970ee90910c18e2ec7478efdc81199067036e9de6261547e35039b00eb4dc5b8f7113e1f2bf54a1dcd977073d8f335c6f79c36cb4f5a958c4ee3a97308af4143106f0cf48b3db94034d01d110ffd63a2d62fd657fccd2e9e149f0a232f209944f16738793d88fcbd6e2794c80aba8b1488b7d121dfcc7e67c53941bfc8271d157a5c577c14c7b5ddf67ca228ec716d5cecc78423fd18f126b33b211944a4c3421fa3fef7602b90819c35c850d8455100000000000000002fdad381a0b19fe5b11a132782666cdf54b33cc71d16e38b354e9586654c009de5affc23434d1426a94adbcbe5f7554dd143a3b05cf8747115fff9d660a402ced3c831a459fd15f12a188b8f8df4cf01ec84297860174ede6b2b2b8becd064bb07aed64b33cdf826be2c692b97e8fa52547e53c612ff1965f381284194c540c50dde298ad0352ddc3d54da2ae320f56a049c4bd208970dd2be1abac17345ccea3ed6f0e7d0b022ba6a198a5ca5aa27d1d43b28506f2015258ed1557bc28455967d1fb1f70730cb24eb3b52be7f9eb81fe76c17449dd474ea40064208292b6a35017c8e9fd64762f8b9ecddecd334a63fae3e36caf442ef734fc7bbd684089ad955b5cb6250472dbf84550a8e7dbcc6953812e5d4eb95e4ce20593d30779593e0ee41a7643384582d10274a0948997fa4e7d559690856ba75ca86ede4ee5ed777ee01cfda2bff124142189bc43cce5184b07b8b787ccb3a72504175d0c3789fe2227f8418ef3e145143d869bff85b0620e0e4c3fb6df818a779d389b6cf2d8551474b21e2c16fe8e2b157233699ece13991b0784e051885768a7639ac55f77c72124cb005f40164e069cc04c4d134d4fab18564edb0e249282ba00268be07ffa506d8d7283bbce5ce1da00f75a7b7cf7263159024cf1766921b88721e0eda34456eca168a4d4c16b8fbb013369367e5aa69d299a0afd4aa05cfe9c334e9a16345544e4859f915db3465b7ff34140d0558487c4a946c0bd241473b262c6e4a3a2d5b713aa49d13b3fa487cb1ba453f4b70d76be3cf50a4f1b41ad7ac6e07618ba55723f772adac19fc956d85e44419ee591323ca1fb27151626b951d929ea002805e84fc2c2a1bb0ec8d6468f7362f57f4955e47a12ed2c94a9fd85ecf0cf9f8eccfdd070648811fc2f2549f6fad247b5694ebfb7eda35e0fde2ab2d84db9cbbb501c355d14c1a09b08e1606c7a124f969f63bc5111d43e0cf0c9558f19536f0dba888d197bba908085594cc9a51b95954235a9eea285522d94f45e1a43ae87ddc518c9f615afdf3a3e6f6b2553e044538e2b99d1e225a1fd4d3b571877c6052238159b96a50d18f141e594568de107238790f3b6a06ba32c2b86aa38278f97351c43830be7c9afaa6cb2769219a72b5d77911fdf3008b85dbe5b0744ced650aba16b39daba1f7c480a3ada039e48dedebb59c2069c450440aeddff2430edf851a67df31d5b775239a4e65353a934458e8c10ee9d145ca95df8cc90f45353cc27b268700d972eae2a7688b9de0c129460f5d03f7e949df388dcd859b695863c5267ded7623157e6f6a522c206b318d3bd19c868d5af103e6c93f40071be87b53b44f319523a87654514d9b56d1bf6c833e90d45082dcdf4b9bc7d60aa09f453d5f591038d330727c7a901c210f8dcadba479df737e1a20a3084cba76578593bf9220863b89a1d77a42bc505a04a9e6476a4c9afabab521c2036fdeb6791058a4da745fdd580a1630da7988dd0698081e43682acb4b46eeb80880ff6cd7ecb0fc032490c9f9a414c21942cb5bdd1e8606ba8ec1b86d94652bae2206f2f5872ce7e70191d08521c4855917f2383ac05873f22639217811dea291e4899390accde8f6fb7408324ef785da1fd83ae6b0190c1220173b1ab11f58e909f330f504b99cf3bc77ff8d57cec47da7bbdeaf8c22837898cf50e2b832100e0a54ac7fef2db966ed4d731abf5afb1df997359d79301c8287197c34fc0645614a458726aec773cbc0b09642d77b4ef9bf422d9f8c9ac318953a0d1a7e5ef657174bd223d3e39b28bf8390029420e7442c45236d924aa4dcd50056471efac90f78ac2b038c7a7e021355a2504f81bb13bdc932d9d3ae42cc3096392c9eecba6bc2f7652f93376978405ccdb242f943f70cc5384e918acf1f5d43649cae159c3e7995eedd37d8f1568c1dd6d7c7d9cd09be943e737126e461f63cfbd64053863ec3ba75b03334a9372b56f89e130b846db84eab2d0262a56208f96809bdd3d26b8a9324274cbbd323c6bec2dd11769ffb96aa2d1583f1a5518fdce1c4de9bd8b15d99ffed8e123dea58c9a50758dccc5f733f8f3fc448157b74d71fb8e5543a88e708dc6bda3bab420987f2ee1fdeaeaeece826494ff4d7d0ceb799df210f091b7e5bac850352c141050c5e2298eec8ff8338b703b00fb538af4ddd82057bea268534610ce8e6fff40e6a23febd734b16abcf7eeb6f10b90fd664d87e2f9a1c83eac76ad21e100e9cdc696a6a9f1a674b87e306f2f96fdce358b4dae8d2e50190b1831cbde1501cefa698cd06742958588ed49998c37f433ef186d88bf889dd3de8740e4fcb160159c1d49406ed702e00c6a1c10db952771262f6a23e8ccb14056c252697ddff65caf2d1f20c1e7fec1436e67143ae527562e47e2b57423c24c201889fb4426ad8a6e26061028863f4efa495d4c045010463247942b6e6fa6eb1e906d03b0dac3f11f07d096db06a2e596021ef8d84e64ecb5a45a2a40d77c8b7a21dde2a02ebe89348ce44f0aee58db0d75c0a38a786ca5a1055ee1654a9fcd29e2fb7a7306a75a28622679cdc0198e3bebad1da3d0568860d8a9f200503d4965c33f62cb2e3dc79bf6da6affa7d94dcc61766f66de229a3d6ea83e9c896717e975906d9d694979c66e8b66f08b9292ed6d5f0af09852df2effce0eb003e39d105b9d726134281569393d7270cb49d9a061a4ee1fe0ee231f0fb0032f2a8dbf0f72bd0554522cab86e2fa8e438d0c221caa473b721ac1fc20e576ea122babd65aa25c3a91c9fa90180ba56f2301046e35640fc10da26cccfe2de37a1560ea1b8aa194607f4ef3930b91c1855c26b6727009434d39db30f470a5987c74082d6b9ec85493c485809158a1d23b31bad735e61cf32611ba83d786f2993228c8797ea49d74a994ae4712324b55d47f3210970122d6f7bf046e5ea7aa5db4cf016897feb9a25ab16e948720e0079bfffb3b1c07f827d462189b4ab30594dc8be03991237729c69482f232eb0340c1cd791dff5b64f5cb7e98bcd46e9436abceaf2e0ae6237e2d995077a3b5d13fa9d5e4c55e4a083a54736cd5258ba6b1206c22937886170ed6df20daabf9a5a65a04d59f363d3fe1ec9c42206226d49187ac9396174a4e76255083e9cc5", 0xbcd}], 0x1) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000000)=0x1, 0x4) syz_emit_ethernet(0x102b, &(0x7f0000002c40)=ANY=[], 0x0) 1.992032953s ago: executing program 1 (id=118): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x800000000000001) 1.988172424s ago: executing program 1 (id=119): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0x80000000, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xffe0}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xaf62}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.954390347s ago: executing program 1 (id=120): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x800, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) syz_emit_ethernet(0x7a, &(0x7f00000001c0)=ANY=[], 0x0) 1.904390602s ago: executing program 1 (id=121): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a0302000200000000000002000000090002"], 0x80}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdir(&(0x7f00000002c0)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x54) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) splice(r2, 0x0, r3, 0x0, 0x10000000000016, 0x0) r4 = open(&(0x7f0000000300)='./bus\x00', 0x14103e, 0x18a) r5 = open(&(0x7f00000001c0)='./file0\x00', 0x14b042, 0x83) ftruncate(r5, 0x3000000) sendfile(r4, r5, 0x0, 0x80000001) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_SETMODE(r7, 0x5602, &(0x7f0000000140)={0x2, 0x7, 0xd, 0x41b, 0x5}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000000)=0x17) 771.242814ms ago: executing program 1 (id=122): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000300)=ANY=[@ANYBLOB="400f06"], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000100)={0x14, 0x0, 0x0}, &(0x7f0000000440)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0xc0, 0xa2, 0x2f, "472c840fd8182ca7f387f168a154a0ae7b6c7f4ea8b4b00b30cf2202d6656420d1e286b8d465608bdc434c29e77842"}}) 770.948494ms ago: executing program 2 (id=123): mmap$IORING_OFF_SQ_RING(&(0x7f000071c000/0xe000)=nil, 0xe000, 0x0, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x309201, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0xe2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r2 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r2, &(0x7f0000000500)='./file1\x00', 0xc000, 0x0) chdir(&(0x7f0000000140)='./bus\x00') linkat(r2, &(0x7f0000000040)='./file1\x00', r2, &(0x7f0000000180)='./bus\x00', 0x0) link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') 148.142616ms ago: executing program 4 (id=124): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c040}, 0x0) 102.33837ms ago: executing program 2 (id=125): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, &(0x7f00000006c0)) 0s ago: executing program 2 (id=126): r0 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000080)={{0x2, 0x4e22, @loopback}, {0x306, @broadcast}, 0x22, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'syzkaller0\x00'}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.121' (ED25519) to the list of known hosts. [ 19.575348][ T30] audit: type=1400 audit(1760131010.324:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.576886][ T273] cgroup: Unknown subsys name 'net' [ 19.582110][ T30] audit: type=1400 audit(1760131010.324:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.589314][ T30] audit: type=1400 audit(1760131010.324:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.589457][ T273] cgroup: Unknown subsys name 'devices' [ 19.716622][ T273] cgroup: Unknown subsys name 'hugetlb' [ 19.722317][ T273] cgroup: Unknown subsys name 'rlimit' [ 19.861749][ T30] audit: type=1400 audit(1760131010.604:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.884936][ T30] audit: type=1400 audit(1760131010.604:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.907358][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.909888][ T30] audit: type=1400 audit(1760131010.604:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.941257][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.950043][ T30] audit: type=1400 audit(1760131010.664:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.975500][ T30] audit: type=1400 audit(1760131010.664:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.001125][ T30] audit: type=1400 audit(1760131010.684:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.026643][ T30] audit: type=1400 audit(1760131010.684:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.030029][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.037175][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.044658][ T281] device bridge_slave_0 entered promiscuous mode [ 21.051978][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.059072][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.066466][ T281] device bridge_slave_1 entered promiscuous mode [ 21.073133][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.080302][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.087715][ T282] device bridge_slave_0 entered promiscuous mode [ 21.095260][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.102307][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.109810][ T282] device bridge_slave_1 entered promiscuous mode [ 21.169159][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.176260][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.183575][ T284] device bridge_slave_0 entered promiscuous mode [ 21.200163][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.207257][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.214741][ T284] device bridge_slave_1 entered promiscuous mode [ 21.247625][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.254762][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.262103][ T283] device bridge_slave_0 entered promiscuous mode [ 21.284311][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.291456][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.298925][ T283] device bridge_slave_1 entered promiscuous mode [ 21.378405][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.385728][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.393185][ T285] device bridge_slave_0 entered promiscuous mode [ 21.400331][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.407396][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.414866][ T285] device bridge_slave_1 entered promiscuous mode [ 21.484427][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.491477][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.498812][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.505860][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.536035][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.543120][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.550420][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.557471][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.596277][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.603331][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.610639][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.617678][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.630303][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.637380][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.644658][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.651685][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.660198][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.667256][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.674549][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.681670][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.696879][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.704090][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.711545][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.718901][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.726256][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.733460][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.740968][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.748144][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.755973][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.763177][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.771005][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.778470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.817082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.824902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.833169][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.840301][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.849271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.857586][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.864643][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.871975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.879945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.901861][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.910038][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.918271][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.925301][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.932776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.941131][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.948177][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.955524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.963647][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.970833][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.978296][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.986499][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.993524][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.000910][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.021820][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.029797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.037867][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.046080][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.069111][ T282] device veth0_vlan entered promiscuous mode [ 22.075609][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.083067][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.090687][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.099432][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.107953][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.115536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.122932][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.131022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.138933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.147397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.155703][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.162718][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.170150][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.178539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.186781][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.193800][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.209013][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.216433][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.223803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.232267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.240755][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.249181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.257297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.264827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.282856][ T285] device veth0_vlan entered promiscuous mode [ 22.293274][ T284] device veth0_vlan entered promiscuous mode [ 22.300573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.309065][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.317389][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.325471][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.332817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.340927][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.348926][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.357199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.365391][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.373701][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.381986][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.389034][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.396511][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.404931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.413092][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.420136][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.435632][ T282] device veth1_macvtap entered promiscuous mode [ 22.444887][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.453284][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.461654][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.485496][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.493637][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.502026][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.510555][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.519180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.527562][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.536033][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.544481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.552769][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.560961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.569177][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.577408][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.585451][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.593549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.601757][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.609312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.617371][ T284] device veth1_macvtap entered promiscuous mode [ 22.625576][ T283] device veth0_vlan entered promiscuous mode [ 22.638367][ T285] device veth1_macvtap entered promiscuous mode [ 22.645521][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.653800][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.662234][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.670647][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.686925][ T283] device veth1_macvtap entered promiscuous mode [ 22.699658][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 22.700818][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.715546][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.723747][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.731512][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.740158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.764420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.773288][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.782236][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.790804][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.800588][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.833026][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.855594][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.872539][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.881701][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.881766][ T342] xt_hashlimit: size too large, truncated to 1048576 [ 22.896772][ T281] device veth0_vlan entered promiscuous mode [ 22.906280][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.923100][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.946754][ T281] device veth1_macvtap entered promiscuous mode [ 23.051890][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.070545][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.096128][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.114057][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.132640][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.141245][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.167836][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.475346][ T362] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.516943][ T362] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 24.554217][ T286] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.617306][ T390] ======================================================= [ 24.617306][ T390] WARNING: The mand mount option has been deprecated and [ 24.617306][ T390] and is ignored by this kernel. Remove the mand [ 24.617306][ T390] option from the mount to silence this warning. [ 24.617306][ T390] ======================================================= [ 24.667860][ T30] kauditd_printk_skb: 105 callbacks suppressed [ 24.667877][ T30] audit: type=1400 audit(1760131015.414:179): avc: denied { mount } for pid=388 comm="syz.2.18" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 24.696368][ T30] audit: type=1400 audit(1760131015.414:180): avc: denied { mounton } for pid=388 comm="syz.2.18" path="/2/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 24.722675][ T30] audit: type=1400 audit(1760131015.414:181): avc: denied { mount } for pid=388 comm="syz.2.18" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.754558][ T30] audit: type=1400 audit(1760131015.444:182): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 24.759122][ T384] pit: kvm: requested 17600 ns i8254 timer period limited to 200000 ns [ 24.783767][ T384] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 24.793034][ T384] pit: kvm: requested 137447 ns i8254 timer period limited to 200000 ns [ 24.802252][ T384] pit: kvm: requested 116495 ns i8254 timer period limited to 200000 ns [ 24.810730][ T286] usb 2-1: Using ep0 maxpacket: 8 [ 24.815934][ T376] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.828012][ T384] pit: kvm: requested 135771 ns i8254 timer period limited to 200000 ns [ 24.840888][ T384] pit: kvm: requested 175162 ns i8254 timer period limited to 200000 ns [ 24.852362][ T384] pit: kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 24.863813][ T384] pit: kvm: requested 122361 ns i8254 timer period limited to 200000 ns [ 24.905322][ T384] pit: kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 24.932151][ T384] pit: kvm: requested 17600 ns i8254 timer period limited to 200000 ns [ 24.944245][ T286] usb 2-1: unable to get BOS descriptor or descriptor too short [ 25.014191][ T26] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 25.014247][ T286] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 25.029742][ T286] usb 2-1: can't read configurations, error -71 [ 25.060960][ T376] usb 4-1: Using ep0 maxpacket: 16 [ 25.184299][ T376] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.184334][ T376] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.184363][ T376] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 25.184397][ T376] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.194496][ T376] usb 4-1: config 0 descriptor?? [ 25.454298][ T26] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 25.464299][ T30] audit: type=1400 audit(1760131016.204:183): avc: denied { append } for pid=408 comm="syz.1.23" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 25.467681][ T26] usb 3-1: New USB device found, idVendor=056a, idProduct=0343, bcdDevice= 0.00 [ 25.499289][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.511310][ T30] audit: type=1400 audit(1760131016.254:184): avc: denied { create } for pid=408 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.522535][ T26] usb 3-1: config 0 descriptor?? [ 25.626896][ T30] audit: type=1400 audit(1760131016.254:185): avc: denied { setopt } for pid=408 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.665706][ T376] hid-generic 0003:1B1C:1B02.0001: unknown main item tag 0x0 [ 25.673128][ T376] hid-generic 0003:1B1C:1B02.0001: unknown main item tag 0x0 [ 25.682357][ T30] audit: type=1400 audit(1760131016.294:186): avc: denied { ioctl } for pid=408 comm="syz.1.23" path="socket:[16835]" dev="sockfs" ino=16835 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.701321][ T376] hid-generic 0003:1B1C:1B02.0001: unknown main item tag 0x0 [ 25.707310][ T30] audit: type=1400 audit(1760131016.294:187): avc: denied { write } for pid=408 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.714590][ T376] hid-generic 0003:1B1C:1B02.0001: unknown main item tag 0x0 [ 25.742610][ T376] hid-generic 0003:1B1C:1B02.0001: unknown main item tag 0x0 [ 25.761962][ T376] hid-generic 0003:1B1C:1B02.0001: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.3-1/input0 [ 25.843192][ T30] audit: type=1400 audit(1760131016.584:188): avc: denied { bind } for pid=418 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.029096][ T26] wacom 0003:056A:0343.0002: unknown main item tag 0x4 [ 26.046627][ T26] wacom 0003:056A:0343.0002: hidraw1: USB HID v1.00 Device [HID 056a:0343] on usb-dummy_hcd.2-1/input0 [ 27.683842][ T421] usb 4-1: USB disconnect, device number 2 [ 27.717704][ T425] xt_hashlimit: size too large, truncated to 1048576 [ 27.732031][ T26] usb 3-1: USB disconnect, device number 2 [ 27.748242][ T429] loop3: detected capacity change from 0 to 128 [ 27.820306][ T430] fido_id[430]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 27.941146][ T429] EXT4-fs (loop3): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000005,discard,,errors=continue. Quota mode: none. [ 27.955897][ T429] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.180780][ T398] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 29.284246][ T376] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.405105][ T467] binder: 465:467 ioctl c0306201 0 returned -14 [ 29.454267][ T398] usb 4-1: Using ep0 maxpacket: 8 [ 29.468192][ T468] process 'syz.4.36' launched './file1' with NULL argv: empty string added [ 29.484067][ T468] loop4: detected capacity change from 0 to 128 [ 29.564316][ T42] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 29.604237][ T398] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.622422][ T398] usb 4-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 29.639814][ T398] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.653789][ T398] usb 4-1: config 0 descriptor?? [ 29.664325][ T376] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 29.672443][ T376] usb 1-1: config 95 has no interface number 0 [ 29.686632][ T376] usb 1-1: config 95 interface 1 has no altsetting 0 [ 29.704856][ T398] usb 4-1: Found UVC 0.00 device (2833:0201) [ 29.722134][ T398] usb 4-1: No valid video chain found. [ 29.732369][ T30] kauditd_printk_skb: 86 callbacks suppressed [ 29.732383][ T30] audit: type=1400 audit(1760131020.474:275): avc: denied { load_policy } for pid=471 comm="syz.1.40" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 29.777698][ T472] SELinux: failed to load policy [ 29.854288][ T376] usb 1-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice=79.79 [ 29.863540][ T376] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.871610][ T376] usb 1-1: Product: syz [ 29.876151][ T376] usb 1-1: Manufacturer: syz [ 29.880786][ T376] usb 1-1: SerialNumber: syz [ 30.124728][ T42] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 30.159726][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.246672][ T450] netlink: 60 bytes leftover after parsing attributes in process `syz.0.33'. [ 30.260808][ T42] usb 3-1: config 0 descriptor?? [ 30.386945][ T485] loop3: detected capacity change from 0 to 128 [ 30.772043][ T376] usb 1-1: USB disconnect, device number 2 [ 30.887510][ T492] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 30.943123][ T30] audit: type=1400 audit(1760131021.684:276): avc: denied { create } for pid=499 comm="syz.0.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 30.992307][ T30] audit: type=1400 audit(1760131021.704:277): avc: denied { connect } for pid=499 comm="syz.0.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 31.011946][ T30] audit: type=1400 audit(1760131021.704:278): avc: denied { ioctl } for pid=499 comm="syz.0.49" path="socket:[17023]" dev="sockfs" ino=17023 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 31.037257][ T30] audit: type=1400 audit(1760131021.704:279): avc: denied { write } for pid=499 comm="syz.0.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 31.201266][ T421] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 31.389446][ T30] audit: type=1400 audit(1760131022.134:280): avc: denied { ioctl } for pid=507 comm="syz.0.52" path="cgroup:[4026532547]" dev="nsfs" ino=4026532547 ioctlcmd=0xb704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.537281][ T30] audit: type=1400 audit(1760131022.284:281): avc: denied { ioctl } for pid=463 comm="syz.2.37" path="/dev/raw-gadget" dev="devtmpfs" ino=254 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.564460][ T421] usb 2-1: Using ep0 maxpacket: 8 [ 31.989546][ T30] audit: type=1400 audit(1760131022.484:282): avc: denied { prog_load } for pid=509 comm="syz.0.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 32.008564][ T30] audit: type=1400 audit(1760131022.484:283): avc: denied { bpf } for pid=509 comm="syz.0.53" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.029117][ T30] audit: type=1400 audit(1760131022.484:284): avc: denied { perfmon } for pid=509 comm="syz.0.53" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.135824][ T517] SELinux: failed to load policy [ 32.189772][ T421] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.205288][ T421] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.218705][ T421] usb 2-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 32.218793][ T522] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.56' sets config #-1 [ 32.228084][ T421] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.248301][ T421] usb 2-1: config 0 descriptor?? [ 32.313808][ T529] binder: 528:529 unknown command 0 [ 32.319159][ T529] binder: 528:529 ioctl c0306201 200000000180 returned -22 [ 32.685414][ T60] usb 4-1: USB disconnect, device number 3 [ 32.845378][ T421] uclogic 0003:5543:0003.0003: item fetching failed at offset 0/3 [ 32.853367][ T421] uclogic 0003:5543:0003.0003: parse failed [ 32.859340][ T421] uclogic: probe of 0003:5543:0003.0003 failed with error -22 [ 33.024220][ T376] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 33.024301][ T42] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 33.041982][ T42] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write Medium Mode mode to 0x0306: ffffffb9 [ 33.053776][ T42] asix: probe of 3-1:0.0 failed with error -71 [ 33.073453][ T42] usb 3-1: USB disconnect, device number 3 [ 33.238512][ T421] usb 2-1: USB disconnect, device number 4 [ 33.554284][ T376] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 33.562573][ T376] usb 5-1: config 0 has no interface number 0 [ 33.568794][ T376] usb 5-1: config 0 interface 41 has no altsetting 0 [ 33.636656][ T286] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 33.776117][ T376] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 33.789508][ T376] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.797979][ T376] usb 5-1: Product: syz [ 33.802182][ T376] usb 5-1: Manufacturer: syz [ 33.818087][ T376] usb 5-1: SerialNumber: syz [ 33.826880][ T376] usb 5-1: config 0 descriptor?? [ 34.284198][ T42] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 34.484311][ T286] usb 1-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 34.493383][ T286] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.501395][ T286] usb 1-1: Product: syz [ 34.505593][ T286] usb 1-1: Manufacturer: syz [ 34.510189][ T286] usb 1-1: SerialNumber: syz [ 34.515678][ T286] usb 1-1: config 0 descriptor?? [ 34.535128][ T42] usb 4-1: Using ep0 maxpacket: 32 [ 34.564278][ T544] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 34.694348][ T42] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 34.702461][ T42] usb 4-1: config 0 has no interface number 0 [ 34.709358][ T42] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 34.720789][ T42] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 34.884313][ T42] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 34.893525][ T42] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=3 [ 34.901779][ T42] usb 4-1: Product: syz [ 34.906299][ T42] usb 4-1: Manufacturer: syz [ 34.910944][ T42] usb 4-1: SerialNumber: syz [ 34.919671][ T42] usb 4-1: config 0 descriptor?? [ 34.944291][ T544] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.954668][ T544] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 34.963613][ T544] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.984311][ T376] CoreChips: probe of 5-1:0.41 failed with error -71 [ 34.994594][ T376] usb 5-1: USB disconnect, device number 2 [ 35.164319][ T544] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.40 [ 35.173397][ T544] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.182314][ T544] usb 3-1: Product: syz [ 35.186753][ T544] usb 3-1: Manufacturer: syz [ 35.191345][ T544] usb 3-1: SerialNumber: syz [ 35.205229][ T42] usb 4-1: USB disconnect, device number 4 [ 35.304250][ T543] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 35.436046][ T42] usb 3-1: USB disconnect, device number 4 [ 35.707936][ T286] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 35.717951][ T286] asix: probe of 1-1:0.0 failed with error -71 [ 35.725814][ T286] usb 1-1: USB disconnect, device number 3 [ 35.824522][ T543] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 35.849763][ T543] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.864643][ T543] usb 2-1: Product: syz [ 35.868955][ T543] usb 2-1: Manufacturer: syz [ 35.873740][ T543] usb 2-1: SerialNumber: syz [ 36.012604][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 36.012619][ T30] audit: type=1400 audit(1760131026.754:333): avc: denied { sys_module } for pid=608 comm="syz.2.91" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 36.049521][ T30] audit: type=1400 audit(1760131026.794:334): avc: denied { read write } for pid=612 comm="syz.3.93" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 36.072758][ T30] audit: type=1400 audit(1760131026.794:335): avc: denied { open } for pid=612 comm="syz.3.93" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 36.096271][ T30] audit: type=1400 audit(1760131026.794:336): avc: denied { mounton } for pid=612 comm="syz.3.93" path="/13/file0" dev="tmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 36.118679][ T30] audit: type=1400 audit(1760131026.794:337): avc: denied { mount } for pid=612 comm="syz.3.93" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 36.343666][ T30] audit: type=1400 audit(1760131026.944:338): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 36.552204][ T30] audit: type=1400 audit(1760131027.294:339): avc: denied { bind } for pid=622 comm="syz.3.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.571977][ T30] audit: type=1400 audit(1760131027.304:340): avc: denied { getopt } for pid=622 comm="syz.3.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.834630][ T42] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 39.084197][ T376] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 39.218932][ T30] audit: type=1400 audit(1760131029.964:341): avc: denied { name_bind } for pid=652 comm="syz.0.106" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 39.263949][ T30] audit: type=1400 audit(1760131029.984:342): avc: denied { node_bind } for pid=652 comm="syz.0.106" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 39.284336][ T653] syz.0.106 (653) used greatest stack depth: 21344 bytes left [ 39.334203][ T376] usb 3-1: Using ep0 maxpacket: 8 [ 39.384261][ T42] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.395224][ T42] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.405257][ T42] usb 5-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 39.414505][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.426613][ T42] usb 5-1: config 0 descriptor?? [ 39.514310][ T376] usb 3-1: unable to get BOS descriptor or descriptor too short [ 39.584304][ T20] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 39.604364][ T376] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 39.615996][ T376] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 39.637133][ T376] usb 3-1: config 4 has no interface number 0 [ 39.694310][ T42] usbhid 5-1:0.0: can't add hid device: -71 [ 39.700267][ T42] usbhid: probe of 5-1:0.0 failed with error -71 [ 39.707936][ T42] usb 5-1: USB disconnect, device number 3 [ 39.731447][ T6] usb 2-1: USB disconnect, device number 5 [ 39.806147][ T680] netlink: 12 bytes leftover after parsing attributes in process `syz.1.119'. [ 39.815482][ T680] netlink: 12 bytes leftover after parsing attributes in process `syz.1.119'. [ 39.824486][ T680] Zero length message leads to an empty skb [ 39.944304][ T286] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 39.964285][ T20] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.014302][ T376] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 40.023461][ T376] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.031520][ T376] usb 3-1: Product: 力뉱⳾Eࡻ꒗賅ꑞ〃譃괙 [ 40.038533][ T376] usb 3-1: SerialNumber: 꾅䐄鏆䑫㙲ᘀﰌ知㊙㒤蓯㠃 [ 40.074203][ T42] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 40.134221][ T20] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 40.143360][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.151399][ T20] usb 1-1: Product: syz [ 40.155636][ T20] usb 1-1: Manufacturer: syz [ 40.160246][ T20] usb 1-1: SerialNumber: syz [ 40.184231][ T286] usb 4-1: Using ep0 maxpacket: 32 [ 40.324229][ T42] usb 5-1: Using ep0 maxpacket: 8 [ 40.404441][ T376] usb 3-1: Found UVC 0.02 device 力뉱⳾Eࡻ꒗賅ꑞ〃譃괙 (04f2:b746) [ 40.413617][ T376] usb 3-1: No valid video chain found. [ 40.419993][ T376] usb 3-1: USB disconnect, device number 5 [ 40.454251][ T42] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 40.464474][ T42] usb 5-1: config 0 has no interfaces? [ 40.474340][ T286] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 40.483531][ T286] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.491555][ T286] usb 4-1: Product: syz [ 40.495737][ T286] usb 4-1: Manufacturer: syz [ 40.500323][ T286] usb 4-1: SerialNumber: syz [ 40.505754][ T286] usb 4-1: config 0 descriptor?? [ 40.634315][ T42] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 40.643805][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.652178][ T42] usb 5-1: Product: syz [ 40.656425][ T42] usb 5-1: Manufacturer: syz [ 40.661022][ T42] usb 5-1: SerialNumber: syz [ 40.666509][ T42] usb 5-1: config 0 descriptor?? [ 40.974227][ T376] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 41.019824][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 41.019855][ T30] audit: type=1400 audit(1760131031.764:346): avc: denied { write } for pid=656 comm="syz.4.108" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 41.068630][ T6] usb 5-1: USB disconnect, device number 4 [ 41.284285][ T20] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 41.290818][ T20] cdc_ncm 1-1:1.0: setting rx_max = 16384 [ 41.334328][ T376] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 41.342530][ T376] usb 2-1: config 0 has no interface number 0 [ 41.348683][ T376] usb 2-1: config 0 interface 41 has no altsetting 0 [ 41.494303][ T20] cdc_ncm 1-1:1.0: setting tx_max = 184 [ 41.501382][ T20] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42 [ 41.513363][ T20] usb 1-1: USB disconnect, device number 4 [ 41.519389][ T376] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 41.528479][ T30] audit: type=1400 audit(1760131032.264:347): avc: denied { read } for pid=140 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 41.549674][ T20] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM [ 41.558098][ T376] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.566159][ T30] audit: type=1400 audit(1760131032.264:348): avc: denied { search } for pid=140 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.566174][ T376] usb 2-1: Product: syz [ 41.566210][ T30] audit: type=1400 audit(1760131032.274:349): avc: denied { read } for pid=140 comm="dhcpcd" name="n15" dev="tmpfs" ino=1093 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 41.589666][ T376] usb 2-1: Manufacturer: syz [ 41.594976][ T30] audit: type=1400 audit(1760131032.274:350): avc: denied { open } for pid=140 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1093 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 41.650694][ T30] audit: type=1400 audit(1760131032.274:351): avc: denied { getattr } for pid=140 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1093 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 41.654685][ T376] usb 2-1: SerialNumber: syz [ 41.705234][ T30] audit: type=1400 audit(1760131032.304:352): avc: denied { read } for pid=700 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.717240][ T376] usb 2-1: config 0 descriptor?? [ 41.734295][ T30] audit: type=1400 audit(1760131032.304:353): avc: denied { open } for pid=700 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.763675][ T30] audit: type=1400 audit(1760131032.304:354): avc: denied { getattr } for pid=700 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.767490][ T6] ================================================================== [ 41.796798][ T6] BUG: KASAN: use-after-free in worker_thread+0xa2e/0x1200 [ 41.804025][ T6] Read of size 8 at addr ffff888119cdac60 by task kworker/0:0/6 [ 41.811654][ T6] [ 41.813985][ T6] CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted syzkaller #0 [ 41.821175][ T6] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 41.831248][ T6] Workqueue: 0x0 (events) [ 41.835705][ T6] Call Trace: [ 41.839001][ T6] [ 41.841930][ T6] __dump_stack+0x21/0x30 [ 41.846263][ T6] dump_stack_lvl+0xee/0x150 [ 41.850867][ T6] ? show_regs_print_info+0x20/0x20 [ 41.856072][ T6] ? load_image+0x3a0/0x3a0 [ 41.860569][ T6] ? __schedule+0xb76/0x14c0 [ 41.865330][ T6] print_address_description+0x7f/0x2c0 [ 41.870891][ T6] ? worker_thread+0xa2e/0x1200 [ 41.875739][ T6] kasan_report+0xf1/0x140 [ 41.880153][ T6] ? worker_thread+0xa2e/0x1200 [ 41.885014][ T6] __asan_report_load8_noabort+0x14/0x20 [ 41.890645][ T6] worker_thread+0xa2e/0x1200 [ 41.895333][ T6] ? __kthread_parkme+0xac/0x200 [ 41.900355][ T6] kthread+0x411/0x500 [ 41.904456][ T6] ? worker_clr_flags+0x190/0x190 [ 41.909482][ T6] ? kthread_blkcg+0xd0/0xd0 [ 41.914077][ T6] ret_from_fork+0x1f/0x30 [ 41.918513][ T6] [ 41.921524][ T6] [ 41.923841][ T6] Allocated by task 20: [ 41.927985][ T6] __kasan_kmalloc+0xda/0x110 [ 41.932655][ T6] __kmalloc+0x13d/0x2c0 [ 41.936898][ T6] kvmalloc_node+0x206/0x300 [ 41.941485][ T6] alloc_netdev_mqs+0x8d/0xc90 [ 41.946264][ T6] alloc_etherdev_mqs+0x34/0x40 [ 41.951106][ T6] usbnet_probe+0x219/0x2860 [ 41.955683][ T6] usb_probe_interface+0x5ff/0xae0 [ 41.960785][ T6] really_probe+0x285/0x970 [ 41.965282][ T6] __driver_probe_device+0x198/0x280 [ 41.970557][ T6] driver_probe_device+0x54/0x3e0 [ 41.975573][ T6] __device_attach_driver+0x2a6/0x460 [ 41.980935][ T6] bus_for_each_drv+0x175/0x200 [ 41.985776][ T6] __device_attach+0x2a2/0x400 [ 41.990533][ T6] device_initial_probe+0x1a/0x20 [ 41.995541][ T6] bus_probe_device+0xc0/0x1e0 [ 42.000293][ T6] device_add+0xb31/0xed0 [ 42.004608][ T6] usb_set_configuration+0x19c2/0x1f10 [ 42.010054][ T6] usb_generic_driver_probe+0x91/0x150 [ 42.015496][ T6] usb_probe_device+0x148/0x260 [ 42.020349][ T6] really_probe+0x285/0x970 [ 42.024849][ T6] __driver_probe_device+0x198/0x280 [ 42.030121][ T6] driver_probe_device+0x54/0x3e0 [ 42.035131][ T6] __device_attach_driver+0x2a6/0x460 [ 42.040486][ T6] bus_for_each_drv+0x175/0x200 [ 42.045325][ T6] __device_attach+0x2a2/0x400 [ 42.050074][ T6] device_initial_probe+0x1a/0x20 [ 42.055085][ T6] bus_probe_device+0xc0/0x1e0 [ 42.059834][ T6] device_add+0xb31/0xed0 [ 42.064148][ T6] usb_new_device+0xd06/0x1620 [ 42.068907][ T6] hub_event+0x29c4/0x4480 [ 42.073311][ T6] process_one_work+0x6be/0xba0 [ 42.078150][ T6] worker_thread+0xa59/0x1200 [ 42.082819][ T6] kthread+0x411/0x500 [ 42.086891][ T6] ret_from_fork+0x1f/0x30 [ 42.091295][ T6] [ 42.093610][ T6] Freed by task 20: [ 42.097403][ T6] kasan_set_track+0x4a/0x70 [ 42.102000][ T6] kasan_set_free_info+0x23/0x40 [ 42.106929][ T6] ____kasan_slab_free+0x125/0x160 [ 42.112039][ T6] __kasan_slab_free+0x11/0x20 [ 42.116789][ T6] slab_free_freelist_hook+0xc2/0x190 [ 42.122154][ T6] kfree+0xc4/0x270 [ 42.125952][ T6] kvfree+0x35/0x40 [ 42.129764][ T6] netdev_freemem+0x3f/0x60 [ 42.134260][ T6] netdev_release+0x7f/0xb0 [ 42.138750][ T6] device_release+0x96/0x1c0 [ 42.143506][ T6] kobject_put+0x18a/0x270 [ 42.147925][ T6] put_device+0x1f/0x30 [ 42.152078][ T6] free_netdev+0x34b/0x450 [ 42.156539][ T6] usbnet_disconnect+0x24b/0x3a0 [ 42.161498][ T6] usb_unbind_interface+0x212/0x8c0 [ 42.166689][ T6] device_release_driver_internal+0x4c1/0x760 [ 42.172749][ T6] device_release_driver+0x19/0x20 [ 42.177860][ T6] bus_remove_device+0x2dd/0x340 [ 42.182791][ T6] device_del+0x696/0xe90 [ 42.187114][ T6] usb_disable_device+0x3a8/0x750 [ 42.192128][ T6] usb_disconnect+0x31e/0x850 [ 42.196795][ T6] hub_event+0x1a96/0x4480 [ 42.201199][ T6] process_one_work+0x6be/0xba0 [ 42.206042][ T6] worker_thread+0xd7b/0x1200 [ 42.210705][ T6] kthread+0x411/0x500 [ 42.214758][ T6] ret_from_fork+0x1f/0x30 [ 42.219162][ T6] [ 42.221491][ T6] Last potentially related work creation: [ 42.227189][ T6] kasan_save_stack+0x3a/0x60 [ 42.231873][ T6] __kasan_record_aux_stack+0xd2/0x100 [ 42.237322][ T6] kasan_record_aux_stack_noalloc+0xb/0x10 [ 42.243121][ T6] insert_work+0x51/0x310 [ 42.247454][ T6] __queue_work+0x8e5/0xc60 [ 42.251954][ T6] queue_work_on+0xd2/0x140 [ 42.256455][ T6] usbnet_link_change+0x189/0x1b0 [ 42.261474][ T6] usbnet_probe+0x1dfd/0x2860 [ 42.266141][ T6] usb_probe_interface+0x5ff/0xae0 [ 42.271245][ T6] really_probe+0x285/0x970 [ 42.275739][ T6] __driver_probe_device+0x198/0x280 [ 42.281015][ T6] driver_probe_device+0x54/0x3e0 [ 42.286028][ T6] __device_attach_driver+0x2a6/0x460 [ 42.291395][ T6] bus_for_each_drv+0x175/0x200 [ 42.296264][ T6] __device_attach+0x2a2/0x400 [ 42.301016][ T6] device_initial_probe+0x1a/0x20 [ 42.306036][ T6] bus_probe_device+0xc0/0x1e0 [ 42.310795][ T6] device_add+0xb31/0xed0 [ 42.315113][ T6] usb_set_configuration+0x19c2/0x1f10 [ 42.320561][ T6] usb_generic_driver_probe+0x91/0x150 [ 42.326012][ T6] usb_probe_device+0x148/0x260 [ 42.330848][ T6] really_probe+0x285/0x970 [ 42.335350][ T6] __driver_probe_device+0x198/0x280 [ 42.340621][ T6] driver_probe_device+0x54/0x3e0 [ 42.345635][ T6] __device_attach_driver+0x2a6/0x460 [ 42.350993][ T6] bus_for_each_drv+0x175/0x200 [ 42.355827][ T6] __device_attach+0x2a2/0x400 [ 42.360588][ T6] device_initial_probe+0x1a/0x20 [ 42.365607][ T6] bus_probe_device+0xc0/0x1e0 [ 42.370366][ T6] device_add+0xb31/0xed0 [ 42.374676][ T6] usb_new_device+0xd06/0x1620 [ 42.379434][ T6] hub_event+0x29c4/0x4480 [ 42.383838][ T6] process_one_work+0x6be/0xba0 [ 42.388677][ T6] worker_thread+0xa59/0x1200 [ 42.393364][ T6] kthread+0x411/0x500 [ 42.397419][ T6] ret_from_fork+0x1f/0x30 [ 42.401817][ T6] [ 42.404127][ T6] The buggy address belongs to the object at ffff888119cda000 [ 42.404127][ T6] which belongs to the cache kmalloc-4k of size 4096 [ 42.418256][ T6] The buggy address is located 3168 bytes inside of [ 42.418256][ T6] 4096-byte region [ffff888119cda000, ffff888119cdb000) [ 42.431690][ T6] The buggy address belongs to the page: [ 42.437306][ T6] page:ffffea0004673600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119cd8 [ 42.447536][ T6] head:ffffea0004673600 order:3 compound_mapcount:0 compound_pincount:0 [ 42.455841][ T6] flags: 0x4000000000010200(slab|head|zone=1) [ 42.461902][ T6] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043380 [ 42.470489][ T6] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 42.479154][ T6] page dumped because: kasan: bad access detected [ 42.485549][ T6] page_owner tracks the page as allocated [ 42.491244][ T6] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 113, ts 5662840311, free_ts 0 [ 42.509326][ T6] post_alloc_hook+0x192/0x1b0 [ 42.514082][ T6] prep_new_page+0x1c/0x110 [ 42.518571][ T6] get_page_from_freelist+0x2cc5/0x2d50 [ 42.524103][ T6] __alloc_pages+0x18f/0x440 [ 42.528680][ T6] new_slab+0xa1/0x4d0 [ 42.532751][ T6] ___slab_alloc+0x381/0x810 [ 42.537333][ T6] __slab_alloc+0x49/0x90 [ 42.541650][ T6] kmem_cache_alloc_trace+0x146/0x270 [ 42.547004][ T6] uevent_show+0x160/0x330 [ 42.551411][ T6] dev_attr_show+0x56/0xd0 [ 42.555821][ T6] sysfs_kf_seq_show+0x266/0x3d0 [ 42.560761][ T6] kernfs_seq_show+0x119/0x160 [ 42.565523][ T6] seq_read_iter+0x490/0xd30 [ 42.570109][ T6] kernfs_fop_read_iter+0x147/0x470 [ 42.575301][ T6] vfs_read+0x68b/0xbe0 [ 42.579449][ T6] ksys_read+0x140/0x240 [ 42.583809][ T6] page_owner free stack trace missing [ 42.589163][ T6] [ 42.591471][ T6] Memory state around the buggy address: [ 42.597082][ T6] ffff888119cdab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.605172][ T6] ffff888119cdab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.613219][ T6] >ffff888119cdac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.621263][ T6] ^ [ 42.628456][ T6] ffff888119cdac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.636509][ T6] ffff888119cdad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.644562][ T6] ================================================================== [ 42.652638][ T6] Disabling lock debugging due to kernel taint [ 42.672171][ T30] audit: type=1400 audit(1760131033.414:355): avc: denied { ioctl } for pid=710 comm="syz.2.126" path="socket:[16307]" dev="sockfs" ino=16307 ioctlcmd=0x8954 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 42.707373][ T286] usb 4-1: USB disconnect, device number 5 [ 43.574290][ T376] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 45.024300][ T376] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Error reading RX_CTL register:ffffffb9 [ 45.054250][ T376] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0000:ffffffb9 [ 45.065642][ T376] CoreChips: probe of 2-1:0.41 failed with error -71 [ 45.074600][ T376] usb 2-1: USB disconnect, device number 6