last executing test programs: 15.728550742s ago: executing program 0 (id=463): r0 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="100000005304"], 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xc076) msgctl$MSG_INFO(0xffffffffffffffff, 0xc, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$null(0xffffffffffffff9c, 0x0, 0x1, 0x103) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000280), r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRES16], 0x7c}, 0x1, 0x0, 0x0, 0x44095}, 0x0) mlock(&(0x7f00007fe000/0x800000)=nil, 0x800000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f0000b72000/0x400000)=nil, 0x400000}, 0x1}) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x19) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000001200)={0x50, 0x0, 0x0, {0x7, 0x27, 0x0, 0x500000}}, 0x50) lgetxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) ptrace$peekuser(0x3, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000100), 0x4000) gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={0x0, &(0x7f0000000100)}}, 0x0) mount(0x0, 0x0, &(0x7f0000000300)='sockfs\x00', 0x2a02896, 0x0) 11.847210029s ago: executing program 0 (id=476): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x14, r1, 0x1, 0x70bd27}, 0x14}, 0x1, 0x0, 0x0, 0x4040082}, 0x0) 11.659321377s ago: executing program 0 (id=479): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f00000002c0)=0x20f) r0 = getpid() r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_pidfd_open(0x0, 0xf0) socket$isdn_base(0x22, 0x3, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001080)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x20000000, 0x0, 0xfffffffc}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xffff}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x100, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r4, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xfffd, 0x4e23, 0x0, @loopback}, 0x1c) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.events.local\x00', 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) timer_create(0x0, 0x0, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) 10.312388201s ago: executing program 0 (id=482): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffd2a9dc6da626c0e21677ffaaaaaaaaaa2b86dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002001000000000000000000000001fe800000000000000000000000000038220560aeb59d3fb13258c6f29dd7eed9c5aaa04a18f74d2a890000000000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = mq_open(&(0x7f0000000300)='\xe1\xb7}=\x9ag\v|\xec\b\xb4\x160\xd8W\xadC5\x93} \x00', 0x8c2, 0x30, &(0x7f0000000080)={0x1, 0x100000001, 0x2, 0x9}) mq_timedsend(r2, 0x0, 0x0, 0x5, 0x0) epoll_create1(0x80000) mq_timedreceive(r2, &(0x7f0000000140)=""/154, 0x9a, 0x0, &(0x7f0000000040)={0x77359400}) creat(&(0x7f00000001c0)='./file0\x00', 0x10) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x1) ioctl$TCSETA(r3, 0x8925, &(0x7f0000000100)={0x2, 0x0, 0x1, 0x0, 0x13, "31f40000f7ece2f4"}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r4, 0x0, 0x48f, &(0x7f0000000740)={0x11, @multicast2, 0x4e24, 0x4, 'wrr\x00', 0x39, 0x7ff, 0x22}, 0x2c) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xaf86be13, &(0x7f0000000000)='cgroup\x00'}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000440)='cpu.weight.nice\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000040)=ANY=[@ANYRESOCT=r6], 0x27) r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r8, &(0x7f00000007c0)=ANY=[@ANYRESOCT=r8], 0x119) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r1, 0x0, 0x0) add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) close_range(r5, 0xffffffffffffffff, 0x0) 7.852842363s ago: executing program 1 (id=492): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)=""/230, 0xe6}], 0x1}, 0x2000000}], 0x2, 0x101, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="0003230c1100"}) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000106840)={0x0, 0x0, "60800c61b2fe296f5b7d36ab1619dc1d5ccc36161fbd619917981483bf7cf877e7a0b79b12d263fc615c852c592574d41996276fac5a4fbb0ddffb77feed38272bc8af3ffc65ac31b3f1bcf41f0cb60cf4404b828ff89e52928b253e08987cb7e7f79a2dbb51c6b4a9a3b4fda43fd50db5e9b8d1089a1fa49e244effa417afb1351fb52ce08a491803c575f78d8def99d0e45f500128db291d68a9c2e8ccdf98144071833c01f0548536abc4d4abc93b9204960d7b59d5a172df7720ace7acf8c00c3ce6db78335c33cfd258ae719135ff4016acdb374e075c4c05ad58088f2e11668787620562a177c50d730c0afaebf7203d7d5bc7f9e768535caf8dafd6e6", "910f0228d1e0b61ef661dc4ea65b1533b979afd73e689d93b894b751ac9644baebdbcf635e20f222778a7b743ecb532622b6dd988b36f6e9c8ced1994c31232fd817c8836dc00cffad46adb21db34c7ac5231ea087d7ed00de68f82607df2bbd82a568cab165b0600a88435f4a52d1796d1d6015b47d144fa33597d43e61c8c57556bcefd2a064ca05cf85ffce3858c4d182056cfc5ae237f9c9323db8e86e6fe8bfb88351c4c02480c31c110b7afa945b22be2e3e336ace8cf1b7707bc8de30d81e8549bc8f81ba0ae6bd8446010b58711783316ed172a24e652f4fc536d318877b4a1709ffd58a8154da4075bdf0900d847d258bec4c603a0f96b826058c20cc7fabcb09eb14b512e3ae6fef2ebb861b6a356ae9c3101a8262b6b6f59f47624054b565a3c7fc014af53bcb8b50d3f5e0ab7b3f38f0a5ce7d203390ba20574c6e039048b84e1b2dbf029ac928227afc1fb082461f8cfd6426e92475129dbfae2cc34d8efc040e9917f8441583d31641dc400702e14979341f8681bb46ea096c8b3f805c77100240a9c8aa6ceed5883872d0a577fdb19bdbc8f208ad2b96e897c0362f371fed16d756057f3f32f834f0ffe05e0a16ddeaff2d1940d4f803152850ade873d8e2e86772ccc6c4266581b038733e2ae8e0dd805e22956eb965b73839fc609c3433476a2fdc54c91faa962319b056743472a898724d347254b62e74cc0f75d2abc2971034e6d8d24a2b9b9a9b26554c3ee8623561f990a630fc6aa162949d929eb89569c8f4f3ecb536b6f43d78a3bdc2efcca95a52856addf1d75a58e60d1cb6fdfe18db871a1e87da5dd5a835fd78b10babcbba6ed881de6e2f0c0c21d95327d6abf3c50338cbd127d17928dc9b8bf69a98c72dcf49f1acc78d011daca36522d46cf1bf9bfbc0869a112c2369d70c926ef9cb0e7b62f69d120460503b53123809b0492275a425607711adbbdfd7b70e0deef4404e2b861e5eb5b69667ab1070c73df48770788a26ca7c8246b1c29df0ec328b9d09a10526ee2af706f56210ca4caae250e32263a7112a88bb3f685cf6176a4033611a0db28e197ee3d233a838f596295c8f5e3fed4f4b8a968b3db40615902302ec56549b285b74b8216f11dbbfa26d1b1e7dd6a83c55dcb8e5c50c63105ae3cef743b822894f3d70878fadbc97794dfe3493fb27ce81e5dfd50b9909035e3828723f412314fb2a5554010663c6c0bdae68ddc8af99f54a77428cc21737f02d557cb92d6b198a11cede413e52f29ce2bd699ad5417fbd6dac98ebdc56c8a3ea11f22bb5e0dde6802fb3b18f5bae9bb9cda8448a18180f2411d281739f356dd73247ebb7c320263e70086dd4bc1da705ec8463ae5a349f92f79e698d5ae9fb5d7b092bbf75303607c1c60d3aadf32cdb54477690dbae279dc7ab6d5fc2662873d558904dfa8fa9eabfea76884a0deec045b3a14c05e67f185f42dd4a8522f4c3429d64574202789c377ffe1696ee7d03f0c9b17cb91dd894e7f74c57f1b940008fb18c373c5f748fd81882f940aa7a8abf23c06363b8ad69edc6fcc4206530ec9a32a6e7b156424ef454a7b75ba014931f0145896cbfae9750aaa13fefc6fb22b63f0f0ec5193a57de15d42a7baca1b92249686f64210dc789729b032e1f9cf63542d378c719da1553bab4a2d954e17f712c10b3903eb38fb62c2b639b06795627a62923f947241b45ea26a8494a2933da6a13bcdf94994e1a0c93646e54e5d4d436760f76e736bc3e9b048c61c7dabbf876c9b159875d597099d3a0a9a7be3b57b63e13a2df0f77d81abea56873b04be97a7df1c50c3c64c997a1849538022e0e713abfaabb9d15800a534d12c3177c34bb278b21bf85be4dfa1cef02c87a1a0c91cfd76be414df8a4a0717a49c9c90e4b115344966e82fce40757811aaeaaeecd93073f17d37903b216f34bab68f8c7cf9729437fce1d9d93208adccecc4167f7555e1b2c83367b9c0bc7dfe913317403416b74a1af5f23ca421383bd59070b165028bf8b35f7d4f1920579ba86c9a2ac83dfb4649ffb9eb5f53bea5378d0af2b06d34c78c6809e3b7338f2a5bc328be056fd8bdee929b5ed1ac3de03a787faf93987ed569a6672c5c4ae6570b37a23e6f0cb88f3455e25529775a5504b1ebad232caa8f40078c0d22292e4f45608ce39b41562bb103204a5a8e5edbd64ae392d5324111eb4aad6c376b5da23c3deeb3722094f44a4e94b4ea97ad370e209285607a9dbc58c746855a35cae22fa4cf618321aa869282db8af7aac97ecd1071e975ff0fc3f251a71a44c8bf86ff6b30628d263659719697d3196bf557ae7ad229e051b497af981859d8489f9c49efb4df31f20ffe8b5d1b5e0618ae363e92c3c8cd6c5317bfa9cd0bbf9e61e3b560509371c96544a51c4c444bde40bdcc9407cdd1b0ef528898f30d9217af5eb9cbac0b373adaf37623b8b385f62255257d7a68ce1334f2f84571b132fc27ea81f39ac81703fda0e33130d9c8607905f3016de511e7d4d26949a99d0acb50af36832217bed7bde843cfbdb93986c434c99b87320dbf3a9e50cd490b7103d8a90509254ea69211d6aa3a64b9009bdab2871112252a82967c2a078c2fb876f97512c918094f12d42419b238e059fbde71a06afb859f96c48a960a5bf6499d133c2e18f9eb6766c41b00571b3fbcc95ef8882d7aa19c4cd1f2f68616a226677eb86e2baf8d516b72741c6ee51275c84b671764fc45af085df3126ae765651dbc4bd2cf7775dd01b5b9ffee780e8138af0cce644c29c4e5bbe27b36586eb48098f74c5811013f65e7eb336272251640e49c22cf4a226118eda226dddc787002f5b4893dbeaf7e855e4ee7eb8215d26b37fd7af1a400caa2fbb0ff60804af91ffb21728e2b35220d2d1ed1223409f1c871883d4175d385f29f49504cb374edc9b01ff8f25a8ca2e57c2930ec2c1bb7afe4122184b8b9e724687b7c1267c004e7f2e5ea294f8132e211cbd20d5cb6a613ccfd26fe763c36faa2142ba6bf5b09874a23d22c4d97c7f6c2768eb755b584a779e98712abcf1da878af66aec352ab1a6b9b3677e1ecc131411b408a3b0139d49f8cd900b10f08ee28cb3b63f4404740aa7a0ce6c67f67598ff075eef5de102f9c895b44b8ec74edc5a80ba709bcd741beae77fec6d950fb3e2c78130a71daa9d747711e82f152f4fd97844bbb4b6eb5dd2e8bd6af7b14701778ff413ce2911e3934474c068c1bd19d1df8b5f642b3344eed5dca8516c92fe6a0cd4ca5cc283adcc7b67a5cfde5125fb5b6c530c720a1262a54ea4cad0e5fe5156d0900386b0f1ed69d735a28a0d6d7746fa29d5e17df996506bc4dcfbce4c54bacadec2f207dece6e7570e616806b47a147bab6682f7c2028149153414f3e2e5e3e95ff9e1cdbc14bf5a5f5b5602941243d7c2c6b95c507ef2ad6051612f7e23eacb67c4ee86ccf3ad489c0b6e57ad6c23cdbaf3773249b155f20a0122dc13417d73434d3b26b24ae4076c65162ce426fad0e43f7c236bcba255301f533809c5ff26e6c586353946dcf29f632621ed34b38fb531d95862457221abd35dc5681a056a5e3113b91df492881c5f8472642ae3e6a7a1004d6a0c03bec2e38dd18b9c0b70c3787a62411c51aaf44afb841262d725ba594cc0312920c77b9b62ccfd931728ea4608043d48fa9e0caec6fb020cf34982703a60c3a8135b22d8aefe25bf5ff2b770ca4fdd1357abbc1772b894c5ac2df7e64f1c9f5f75128c316e9524869c49859c2ef3800043f71d9b27b33d3332975e4cc291edb40619e70140d32bc5ff6ff37a759d6f7202ab664876c9abfb35518b6cabe16bb61cfccacfed7f2280797f836006443070afcb2f40fbc4f03fe73dce4dd4864a8477329f335cd9a272dd4f8669e6f50cf3dd4e244ec7cbe86f73c37891dff2d170bdbddf6094673c2ebfee90ee0578e43c462330b4c28591a47dfaaaa671bd332adb580784b91462da18d9c5b7d19cd7c550bbab36d1527a9643152d9ab93811b81b188344453ab08a75e19795022307a347a2b9ce90606482dfd37359fce533c81faa1a211edd74024e2f2c138f73940bf519e73daa4b1b1d7456346ba4183c3adeddc186475959621151fa1f202ce455d9d10f7243ce4bdb4bcc10a53d551ed4ea90a42bfa0cc9aa3c32cfc95ce1688b27604187d718479b689cce0a590e03752e507b232c3c1458a82280acea98c7520d2b5e32d5a2fa37fb24e60558c946b2bac5004333ddaad4284737b01a919b09ded78df535f1ece649a01640c63773ffa03e9f867d46eed23adb876617ace57eb859c94db842d460fb79e108214f29392e50255390d5c70e17c147e6cd2308183247be1eb09d3a5daafd1841da3c677a1b80dbff6eda1879bd29dab3d0f37eedabba7ba965336f641a2a1270ed65697ac4f3761694f87a69ec3d0486121adac5503b099f93830857e9f6d12c61f97f98cab7fd750f35e7278e38cfaecee5358ee4d227bd0a5abb3087ccaa46e05255051d546d723f41626304361319aa7a9d1973f73f6a27fd19bcf3bfa3092a20897ce64a39ef86fdd8a78d200c995a36225a21eb67eddbc101c0859f09cfc989f73d659a5dccc8fa29968180c115f9d9c98aa9d76027f77111dc6b8793f9420845a122c6d8cec860b7eb563c1a8bdd35aa76aa0686164f28412423c64733478363027b8329b7cddbc24ee07fdae84c52c0d9055e9120178114ae4ce60f1c6d17a87f4bd17a1af7520f18ac3166ff36e72f44c840cea3ca574a8b3d36bbbaa5a2633bab8a1b1011a2612e52aa1918e9d1a1b09ef4a7399c259cf86396e475444544b51d58bfc2b4f65d2030aeada3c939bfd05475eecec889cc2a3cbcd388e6df9e50a768176cf7bbe431111f61ad6ae8f59da8d623fdd3a3c34136788f10fedd43bdc38e185d489bff68ec20d2327dbf2b7e96ce88e43aa11a4dfec18bb1b297710037e371af473423131280bf29fbaedfd00f750ca19b13d675629226ff6a18adb31b4e035b34c01b4e0e3b50f0dbaa936d02644db0e710fb1f872447749ae1abd9c6262ab2526480ea47a37332cb0fd6712dd9b5fe5ac713be72c68433b293047a9e06a2c5fec1553df5839629ad08218656d8c7af0ce33859b8c3722d37aae7d08368c64ce9b9298567c59dd3668b201c9574d8d352e6025ca834b23b67130bd001c348380e6334b4baab7db1994c5d76fcdc776f60ef53081e49f088df30b3da502f745da9e0038954166fa47b65cc4a0b22127d9f671fff5b238f4f12d462b9901eecb7f64d0caf7e3affa12bd8a394f9cd2eace150f3e85ebe4d342bfd57f5369344971922c9a985cd705a97e82556d35fa07c090264abdfbdc6a07b51b3fc257de84be2fd77daab76ab"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r2, 0xd000943d, &(0x7f0000107840)={0x5a, [{}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x40, "353c753e1cbd25"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r2, 0xd000943d, &(0x7f0000108840)={0x7d, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r9}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}, {}, {r10}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}], 0xfb, "ca7a8deac37750"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r4, 0xd000943d, &(0x7f0000109840)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {r8, r11}], 0x7, "904ca0414df38a"}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r12 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0xa, 0x1f4200) readv(r12, &(0x7f00000002c0)=[{&(0x7f0000001500)=""/4110, 0x100e}], 0x1) r13 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8e383, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$SNDRV_CTL_IOCTL_TLV_READ(0xffffffffffffffff, 0xc008551a, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r13, @ANYRESOCT=r13]) socket$nl_netfilter(0x10, 0x3, 0xc) r14 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r15 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r15, 0xc0184800, &(0x7f0000000100)={0x4, r14}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_flash={0x33, 0xea5, './file0\x00'}}) 6.930801842s ago: executing program 1 (id=497): r0 = openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$proc_mixer(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="4f4741494e20274361707475726520566f6c756d65272030303030303030303030303030303030303030300a494741494e0a50486ce2369e9e"], 0xaf) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000940)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELOBJ={0x7c, 0x14, 0xa, 0x500, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_OBJ_USERDATA={0x5c, 0x8, "15bb4a4330bc28b005d4d213cb64e6c0549f13a4588707d669f07a1333b416101896b5edbfdf55d65952d9117de88eb50ed7d9f80619a9e00ea32d6f427a7e7d22e89ca28b11d4f8c8020e865cd2a8a665e3129757e7e007"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x1d4, 0x18, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth0_macvtap\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK={0x13c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6_vti0\x00'}, {0x14, 0x1, 'vlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0xcc, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg0\x00'}, {0x14, 0x1, 'gretap0\x00'}, {0x14, 0x1, 'ip6gretap0\x00'}, {0x14, 0x1, 'wlan1\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'veth0_to_bridge\x00'}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'veth0_to_batadv\x00'}, {0x14, 0x1, 'wlan0\x00'}, {0x14, 0x1, 'gretap0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x69}]}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8f}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}, @NFT_MSG_DELSET={0x30, 0xb, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x1}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xff}]}, @NFT_MSG_DELRULE={0x38, 0x8, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWSETELEM={0x28, 0xc, 0xa, 0x104, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELOBJ={0x44, 0x14, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_USERDATA={0x4}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x378}, 0x1, 0x0, 0x0, 0x44094}, 0x4040000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x5}, {0xfff1, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x6, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000240)={0x2, {0x2, 0xa, 0xdcf, 0x490, 0x1000, 0x3}}) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 6.445564953s ago: executing program 1 (id=500): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x18) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) r5 = getpgrp(r0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000180)={'\x00', 0x5, 0x13e, 0x5, 0x4, 0x2, r5}) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e21, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) memfd_create(0x0, 0x0) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r7, 0xc0d05640, &(0x7f0000000000)={0xa, @raw_data="3aee44a9c226a51c91d96d057945493d62731d82b7b243ac2b8c09e616fac25ae19d22dde9f23f852c3c3ccc3a9bd805898c9b2332eefd90a8a3ec23a13d253cf99691b813d8bfe75bfd83c66b56546b67a6d49ef1aa41cd5fb1faa24fd3f04c0551ed1ce90da7f3c55d1722a954283520a13b98bbbda5d490614b0b944b44d09086680a995a0ef055c7b45c50f7096e53c69a5af5d8af27a799d80635b87bb98d78c265cc91f11d80f3215cb8e27902ded8695717e1bc25acbcb5f28d2e5cddcd7b000000009cae"}) 5.355976096s ago: executing program 1 (id=502): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000340), 0x42a102, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000480)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b800000010000004feffffff0000000000000000", @ANYRES32=r3, @ANYBLOB="c31407001b14bf263000128008000100736974002400028008000300e000000208000200ac14141d0600080015000000060011004e21000008001f00070000003800168034000180100006000400000008000000050000000c00040071000000ff03000014000b0008000000000000000700000000000000050027000400000008000500", @ANYRES32=r3, @ANYBLOB="0800230080000004080028003da300000500110005000000"], 0xb8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$inet(r1, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) socket(0x10, 0x80002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r6 = socket$netlink(0x10, 0x3, 0xb) unshare(0x22020600) mkdir(&(0x7f0000000180)='./file1\x00', 0x60) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000240)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r7, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x0, 0x800000000009, 0x9, 0x4, 0x0, 0x1, 0xffffffffffffffff, 0x3, 0xfffffffb}) r8 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') setns(r8, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 5.08218213s ago: executing program 2 (id=503): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) set_mempolicy(0x8004, &(0x7f0000003ac0)=0x9, 0x5) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@main=@item_012={0x2, 0x0, 0xb, "3cfc"}, @main=@item_012={0x1, 0x0, 0xb, "e7"}]}}, 0x0}, 0x0) 5.059599122s ago: executing program 4 (id=505): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r0, 0x101, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, &(0x7f00000003c0)={0x0, 0x20001c2a, 0x10100, 0x2, 0x20a, 0x0, r3}, &(0x7f0000000080), &(0x7f00000001c0)) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000007000/0x1000)=nil, &(0x7f000000e000/0x3000)=nil, 0x1000, 0x2}) r4 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000000180)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)="a92e81d0991808e33c2323df00000000", 0x10}, {&(0x7f00000000c0)="200d354ec1cb1eea", 0x8}], 0x2, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x20084005) recvmmsg(r4, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000200)=""/23, 0x17}], 0x1}, 0x10000}], 0x1, 0x102, 0x0) getdents64(r0, &(0x7f0000000000)=""/48, 0x30) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket(0x2, 0x80805, 0x0) r7 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r7, &(0x7f0000000300)={&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0xa96}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000140)='#', 0x1}], 0x1, &(0x7f0000001f80)=ANY=[@ANYBLOB="10000068d50000008400000008000000"], 0x10}, 0x20000041) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = dup(r9) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, &(0x7f0000000280)="f2c33500000000440f090f08f30fc776c4b805000000b9009000000f01c136470ff4d966baf80cb839dd1f8cef66bafc0cecb9d20200000f32470f07", 0x3c}], 0x1, 0x19, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000740)={&(0x7f0000000340)=@l2tp6={0xa, 0x0, 0x64c, @mcast1, 0x14, 0x3}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000440)="7634880b99cc1acc2732cf639b7d2d088d7375decadc39a7fd5c47ef0bd90591eeb97222baecb978b5e2366e91e352ae409c9c59b4d73f457c2e4930791a2d2d51e427b81179073153e0e18f8909a0c218bf7396c6b05ee11f580281e4812b87f13dd93867539eca1469eab93eb35d7bf7a4292a5a1066885901", 0x7a}, {&(0x7f0000000780)="1e9f08065c92749a9daf52a96ae1f2b6a6bf2efc3b72bb6d97153e0505428ee02523cde7a214e8d3d364faf3d782afff116ed026", 0x34}, {&(0x7f00000004c0)="cd99a08023e0cd15c3f402b4a153cbc868df04e891793b1503df028714a09346372ced6502447f70389969ac7fbfd7f67226d07e6f33bfbb8509b58c5660a915acf068030eeab6ae81a615967661639206c4c0f97647edba3d2fa7c3cb9edfb0f44084af52214e061ef6a4d74d83684d87252ecb5f40ab25", 0x78}, {&(0x7f0000000600)="5d5379c79c2ce910a7727e42dc59ebe044ab357be00f1e88ada47977ded42aa136b021932237a2b7ecea6c6fce002c7757a3392bb9d284d219b5ce7ab49661d817f3cadb99f88f1b2699b0a341493309ada18a45b17a4725", 0x58}, {&(0x7f0000000540)="989881f3b8bcc8766f616c59bfe466494b71cb97e8ea41d5010ea0203b06a14f6ae09d887d236a1cc0e2af2d895197e96027", 0x32}, {&(0x7f00000007c0)="da53b9285092891685c7527145fd5c07418693f773a64afb3f1cf1bfc354205cacb2c6af459ce38188e9699ead9fc5f6d355118eb0a85dd89bb26c823f93092333eb0b257abbfca28414807942f33c512713858b1be0b4ea014f05652da9acf2657df33cde3cc0b908ac66b3ea60c953460ff92749ffd4d155590541f0c567c5850c2d1be726ecdb9d18e398ba88dd1d9b072ee6193c5ef2a9b2d9bc3afb2ee3e73c0a3062", 0xa5}], 0x6}, 0x4c889) ioctl$KVM_RUN(r11, 0xae80, 0x0) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@caif=@rfm={0x25, 0x4, "88980b251525c6e730ff6005fcc3622f"}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@txtime={{0x18}}], 0x18}, 0x10) 4.594469797s ago: executing program 1 (id=506): r0 = socket$inet6(0xa, 0x80002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r5) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r6}, &(0x7f0000000000), &(0x7f0000000080)=r5}, 0x20) r7 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r7, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0xf00, @rand_addr=0xac1414bb}, 0x3804, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000180)={0x2, 0x0, @remote}, 0x69, &(0x7f0000000400)=[{&(0x7f0000000240)="b9", 0x26892}], 0xbb}}], 0x2, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000900)}, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x56800, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r0, &(0x7f0000002140)={0xa, 0x4e20, 0xb3, @mcast2, 0x7}, 0xffffffffffffffb8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in6, @in6=@dev}}, {{@in=@loopback}, 0x0, @in6=@initdev}}, &(0x7f00000001c0)=0xe8) 3.53800135s ago: executing program 1 (id=508): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000001000000000000080000095"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x4a, 0x0, &(0x7f0000000440)) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x31e}) eventfd2(0x8, 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r3 = getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x401, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x44f81}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r8}, @IFLA_HSR_SLAVE1={0x8, 0x1, r7}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x80c0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x69, 0x4, 0x7d, 0x8, 0xabf, 0x3370, 0x30e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xb5, 0xbc, 0x65}}]}}]}}, 0x0) 3.276167481s ago: executing program 4 (id=510): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='limits\x00') preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000200)=""/46, 0x2e}], 0x1, 0xf44, 0x2) r1 = socket(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xb, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000020000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='kfree\x00', r2}, 0x18) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x468, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x43c, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0x5ec888eb7598db49}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x8, 0x2, 0xff, 0x7}, {0x4, 0x0, 0x3, 0xa159, 0x1000, 0x7}, 0x3, 0x8, 0x41e}}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x2, 0x8, 0xfff, 0x0, 0x8ba, 0xa1, 0x4d91, 0x7fffffff, 0x63e4, 0x0, 0x8000, 0x8, 0x255, 0x6, 0x6, 0xd81, 0x3, 0xa, 0xa, 0x7, 0x6, 0x2, 0x200, 0x1, 0x5, 0xb96, 0x7, 0x0, 0xffffffff, 0x200, 0x3, 0x3, 0x7c, 0xfffffffc, 0x5, 0x1, 0x2, 0x8, 0x6, 0x1, 0xd, 0x80, 0xe, 0x80, 0x90000000, 0x3800000, 0x0, 0xfffff30b, 0x0, 0xf5, 0x81, 0xfffffffa, 0x80, 0x101, 0x3f, 0xfffffbff, 0x36a5, 0x4, 0x6, 0x200, 0x1ba, 0x9, 0xab, 0x6, 0xfffffff7, 0x6, 0x0, 0x3, 0x1, 0x963, 0x1ff, 0x2, 0xfffffffd, 0x6, 0x9, 0x0, 0x3, 0x0, 0xb09, 0x3ff, 0x7, 0x8000, 0x4, 0x8, 0x1000, 0x101, 0x5, 0x3, 0x6, 0x9, 0x3, 0x1, 0x8762, 0x8e, 0x5, 0xfffff76b, 0x0, 0x4, 0x4275c4e9, 0x8, 0x5, 0x800, 0x0, 0x955, 0x5, 0x6cdf13a0, 0x9, 0x3, 0x5, 0x10001, 0x80000001, 0x80000001, 0xed2, 0x1, 0xfffffffa, 0x2, 0x18d1, 0xfcf9, 0x3, 0x9486, 0x80, 0x2, 0x80000000, 0xdb, 0x3, 0x80, 0xffff8000, 0x5, 0x8, 0x7, 0x1, 0x2, 0x8, 0x2, 0x0, 0x2, 0x7e, 0x3, 0x1, 0x6bf, 0x7, 0xea, 0x4, 0xc1, 0x9, 0x1, 0x5, 0x283, 0xb, 0x4, 0x40, 0x7, 0x4, 0x7, 0xff, 0x400, 0x8, 0x7fffffff, 0xfffffff8, 0x8, 0xfffffff4, 0x8, 0xc, 0x96, 0x6, 0x4, 0x62cc, 0x2, 0x7, 0x2eb7, 0x10001, 0xcbf, 0x10000, 0x101, 0x9, 0xfffffffa, 0x1, 0x8, 0x800, 0x8001, 0xf, 0x5, 0x8, 0x8d, 0xffffffff, 0x2, 0x7, 0x1, 0x61, 0xffffffff, 0x494, 0xb, 0x1, 0x1, 0xd1, 0xd, 0x9, 0x1002, 0xffffffff, 0x6, 0x3, 0xfffffffb, 0xffff, 0xff, 0x5, 0xe, 0x401, 0x2, 0x8cc5, 0x8, 0x159, 0xfffffff7, 0x81, 0x382ae49b, 0x9, 0xffffffff, 0xffff, 0xdf3b, 0xfffffffb, 0x6, 0xfffffeff, 0x8dc3, 0x20000001, 0x5, 0x9, 0x2, 0xfffff801, 0x0, 0x5, 0x5, 0x7, 0x7, 0x7f, 0x7, 0x1, 0x0, 0xffffffff, 0xdfed, 0xb, 0x77, 0x101, 0xff, 0xb331, 0x9, 0x6, 0x9, 0x7, 0x5, 0x400, 0x10001, 0x1, 0x800, 0x6000, 0xfe000000, 0xfffffffd]}]}}]}, 0x468}}, 0x0) 3.097641099s ago: executing program 3 (id=512): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r0) mount$tmpfs(0x0, 0x0, 0x0, 0x10a40a2, &(0x7f0000000040)=ANY=[@ANYBLOB="f4697a653d"]) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="8802", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.048549629s ago: executing program 3 (id=513): syz_open_dev$vim2m(&(0x7f0000000200), 0x4000004, 0x2) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x4000, &(0x7f00000000c0)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 2.830062193s ago: executing program 4 (id=514): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000380)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000300", 0x40, 0x3a, 0x0, @local, @mcast2, {[], @param_prob={0x4, 0x2, 0x0, 0x0, {0x0, 0x6, "4aa198", 0x0, 0x3c, 0x0, @remote, @empty, [@srh={0x2f, 0x0, 0x4, 0x0, 0x4, 0x0, 0x3}, @fragment={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}]}}}}}}}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r2 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmat(r2, &(0x7f0000ff1000/0x3000)=nil, 0x400c) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000080)={0x18, 0x0, {0x4, @local, 'bridge_slave_1\x00'}}, 0x1e) connect$pppoe(r5, &(0x7f00000000c0)={0x18, 0x0, {0x4, @random="09583ade49d9", 'bond0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r5, 0x4008b100, &(0x7f0000000040)={0x18, 0x0, {0x4, @local, 'bridge_slave_1\x00'}}) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x0) r6 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) r8 = openat$cgroup_subtree(r7, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000040)={[{0x2b, 'rdma'}, {0x2b, 'cpuset'}]}, 0xe) 2.828930314s ago: executing program 3 (id=515): openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_off}, {@upperdir={'upperdir', 0x3d, './file1'}}], [{@subj_user={'subj_user', 0x3d, 'metacopy=off'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'upperdir'}}, {@euid_lt}]}) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r0, 0x0, 0x0, 0x20004041, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x0, 0x4001) recvmmsg(r2, &(0x7f0000003f00)=[{{&(0x7f0000000280)=@nfc_llcp, 0x80, &(0x7f0000000800)=[{&(0x7f0000000900)=""/219}], 0x0, &(0x7f0000000a00)=""/57, 0x2f}, 0x7fffffff}, {{0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000003080)=""/58, 0x3a}, {&(0x7f0000003d40)=""/243, 0xf3}, {&(0x7f0000004a80)=""/4085, 0xff5}, {&(0x7f0000001c00)=""/182, 0xb6}, {&(0x7f0000001cc0)=""/228, 0xe4}, {&(0x7f0000000b40)=""/91, 0x5b}], 0x6}, 0x1}, {{0x0, 0x0, &(0x7f0000000740), 0xc}, 0x3}, {{&(0x7f0000003340)=@ax25={{0x3, @rose}, [@default, @netrom, @netrom, @netrom, @bcast, @default, @rose, @netrom]}, 0x80, &(0x7f0000003900)=[{&(0x7f00000033c0)=""/190, 0xbe}, {&(0x7f00000034c0)=""/200, 0xc8}, {&(0x7f0000000840)=""/156, 0x9c}, {&(0x7f0000003680)=""/137, 0x89}, {&(0x7f0000003080)}, {&(0x7f0000003780)=""/178, 0xb2}, {&(0x7f0000003840)=""/155, 0x9b}], 0x7, &(0x7f0000003980)=""/235, 0xeb}, 0x10}, {{&(0x7f0000001dc0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x80, &(0x7f0000003b40), 0x0, &(0x7f0000003b80)=""/87, 0x57}, 0x40000001}], 0x5, 0x40010103, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_int(r0, 0x6, 0x6, &(0x7f0000000080)=0x2, 0x4) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r4 = socket(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0xf0fe, @ipv4={'\x00', '\xff\xff', @remote}, 0x9}, 0x1c) setsockopt$inet6_udp_int(r4, 0x11, 0x1, &(0x7f0000000040)=0x1, 0x4) sendmmsg$inet6(r4, &(0x7f0000004a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) close(0x3) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x34c0e0, 0x0) 2.430697531s ago: executing program 3 (id=516): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x1800, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x379}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0xffffffffffffffff, 0x0}) io_uring_enter(r3, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MTU={0x8, 0x4, 0xffe1}]}, 0x3c}}, 0x0) 2.020072067s ago: executing program 2 (id=517): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') r0 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = open(&(0x7f0000000100)='.\x00', 0x4fc082, 0x49a) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)=0x0) syz_open_procfs$pagemap(r2, &(0x7f0000000040)) 1.826150834s ago: executing program 2 (id=518): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuacct.usage_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x2010, r0, 0x8e014000) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000040)={r4, r3}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) write$binfmt_format(r7, &(0x7f0000000100)='-1\x00', 0x2) close_range(r7, 0xffffffffffffffff, 0x0) getsockopt$inet_buf(r6, 0x0, 0x41, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=0x28) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$TIPC_CMD_DISABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_FLUSH(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x800) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x0, 0x0, 0x130, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x3001}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 1.124453095s ago: executing program 2 (id=519): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f000072c000/0x4000)=nil, 0x4000, 0xb635773f07ebbee4, 0x8031, 0xffffffffffffffff, 0xffffe000) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = open(0x0, 0x400, 0x43) linkat(r4, 0x0, 0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_int(r4, 0x0, 0x15, &(0x7f0000000100)=0x571, 0x4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b7"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r8, r6}, 0x14) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r7}, &(0x7f0000000400), &(0x7f0000000440)=r8}, 0x20) syz_emit_ethernet(0x4a, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6056040000140600fe8000000000000000000000000000aafe8000000000000000000000a660c4cb148a7512", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5003000090780004"], 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)={0x30, r9, 0x1, 0xffffffff, 0x0, {{}, {}, {0x14, 0x19, {0xfffffffe, 0x9}}}}, 0x30}}, 0x0) 1.120552343s ago: executing program 4 (id=520): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x2000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x280) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x8000000000000001, 0x35b8329, 0x99, 0x2, 0x4, 0x4d, 0x3}, &(0x7f0000000200)={0x9, 0x358, 0x5, 0xfff, 0x3, 0x3, 0x0, 0x8000000000000000}, 0x0, 0x0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xb, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0xa1b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0xfeffff, 0xffffff69, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) openat$rtc(0xffffffffffffff9c, 0x0, 0x100, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES8=r0, @ANYRES64=r1], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$kcm(0x29, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc49b0710007e570966f4366ec9d41a51c37bf21e5b8953a4db3b9150cbeaba1d1f339f4d5cb25aa730312ffd0147bfd40518c668ad3fd5ef743ccccf48e48de176cec6ef92985d72e7989bb0aa6cbb22f6ee7c09450c684779449e0a84c25ba08d51b9c991bb8a7d5af1bb1a94d81a95234050c3bfab59b802ba7190b2539c7ef2995967ff39ca3c745e32f69d2bf8ecbb327144300bfc5e772fb6a0"], 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f0000000000)={0x3}) socket$packet(0x11, 0x3, 0x300) eventfd2(0x6, 0x80000) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f0000000040)={0x8}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="295233b35ed384e679d1f85cb1af7102f0e66fc209cb2451dc0d5b4a02e3f111880f818387555b48942c52a2b10f51151170d25d94ba89910c6f8f772b2958002fdcf8893a921ffd26021980674785ad52d5f52d9c7cebc0a2452fdc8c112aa0ed681af288b8b63e6b6354925747cb32c99bbc5c60240c6a954750242f3531e0e202f862fc76d12bfe99a7e452bf4bb7ce8dc2b2339076f0a4f2b5f96db64bc832dee9bf6d647093b10caf61a8cefdaf70040853321d1591dd4212c2807953e9bb591359bc174c052bf0915b52cd9382fc94e3e221aaca412579a759d5b8dedb656c", @ANYRES32=r5, @ANYRESDEC, @ANYRES32=0x0, @ANYRES16=0x0, @ANYRES32=r3, @ANYRES64=r2], 0x30}}, 0x20000000) recvmmsg$unix(r4, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) 1.11437231s ago: executing program 3 (id=521): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000850}, 0x20084084) socket$nl_route(0x10, 0x3, 0x0) 1.030156222s ago: executing program 0 (id=522): r0 = epoll_create1(0x80000) mknod(&(0x7f0000000480)='./bus\x00', 0x10, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f0000000000)) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[], 0x48) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x400000000a882, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180100"/16, @ANYRES64=r4, @ANYRESHEX=r2, @ANYRES64=r3, @ANYRES16=r3, @ANYRES64=r2], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000080)='htcp', 0x4) shutdown(0xffffffffffffffff, 0x1) setresgid(0x0, 0xee01, 0xffffffffffffffff) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x1b, &(0x7f0000000040)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x1, 0x0, 0xb, 0xc, 0xfffd}, 0x20) r10 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r10, 0xc10c5541, &(0x7f0000000280)={0x0, 0x4}) mount$9p_fd(0x0, &(0x7f00000001c0)='./bus\x00', &(0x7f0000000240), 0x2, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}}) 516.689121ms ago: executing program 2 (id=523): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r0) mount$tmpfs(0x0, 0x0, 0x0, 0x10a40a2, &(0x7f0000000040)=ANY=[@ANYBLOB="f4697a653d"]) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="8802", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 450.582672ms ago: executing program 4 (id=524): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000b40)='neigh_create\x00'}, 0x18) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0xd) ioctl$KVM_HYPERV_EVENTFD(r3, 0x4018aebd, &(0x7f00000002c0)={0x2}) close_range(r0, 0xffffffffffffffff, 0x0) 450.294437ms ago: executing program 3 (id=525): r0 = syz_io_uring_setup(0x231, &(0x7f0000000180)={0x0, 0x2d37, 0x800}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r0, 0x7a98, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) r2 = socket(0x10, 0x80002, 0x0) getsockopt$sock_buf(r2, 0x1, 0x19, 0x0, &(0x7f0000000380)) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) syz_io_uring_setup(0x231, &(0x7f0000000180)={0x0, 0x2d37, 0x800}, &(0x7f0000000100), &(0x7f0000000140)) (async) io_uring_enter(r0, 0x7a98, 0x0, 0x0, 0x0, 0x0) (async) socket$inet6(0xa, 0x2, 0x0) (async) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) (async) socket(0x10, 0x80002, 0x0) (async) getsockopt$sock_buf(r2, 0x1, 0x19, 0x0, &(0x7f0000000380)) (async) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) (async) 449.692062ms ago: executing program 2 (id=526): r0 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="100000005304"], 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xc076) msgctl$MSG_INFO(0xffffffffffffffff, 0xc, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$null(0xffffffffffffff9c, 0x0, 0x1, 0x103) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000280), r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRES16], 0x7c}, 0x1, 0x0, 0x0, 0x44095}, 0x0) mlock(&(0x7f00007fe000/0x800000)=nil, 0x800000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f0000b72000/0x400000)=nil, 0x400000}, 0x1}) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x19) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000001200)={0x50, 0x0, 0x0, {0x7, 0x27, 0x0, 0x500000}}, 0x50) lgetxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) ptrace$peekuser(0x3, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000100), 0x4000) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={0x0, &(0x7f0000000100)}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net/raw\x00') mount(0x0, 0x0, &(0x7f0000000300)='sockfs\x00', 0x2a02896, 0x0) 127.083348ms ago: executing program 0 (id=527): sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, 0x0, 0x4000000) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f0000000180)={'pcl816\x00', [0x4f27, 0x6, 0x3, 0x4, 0x5, 0xcc9, 0xf, 0x4, 0xa, 0xfffffffc, 0x2, 0x3, 0xfffffffe, 0x1, 0x7, 0x101, 0x0, 0x1a449, 0x3, 0x40000003, 0x2, 0xcaa7, 0x0, 0x20001e58, 0x7, 0x63e, 0x3c, 0x8, 0xfffffffe, 0x0, 0xfffffff8]}) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r8, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000240)={0x0, 0x300, 0x8, 0x5, 0x200, &(0x7f0000003c40)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d152a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5c0000430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd48ae4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b16fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c921fbffffffffffff1499012d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00', @ANYRES16, @ANYBLOB="010c25bd7000ffdbdf251400000008001d00", @ANYRES32, @ANYBLOB="080003"], 0x24}, 0x1, 0x0, 0x0, 0x20040801}, 0x20000004) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 4 (id=528): syz_usb_connect(0x5, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000fc0)='afs_sent_data\x00', r0, 0x0, 0x8000000000000001}, 0xfffffffffffffe5a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60242, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, 0xffffffffffffffff, r4) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x15, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x1e}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x1a}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x6}, 0x33) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) r7 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r6, 0x4004af07, &(0x7f0000000240)=r7) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, &(0x7f0000000040)={0x1, r7}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000540)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/57, 0xd000}) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000004c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) write$P9_RSTATu(r5, &(0x7f00000004c0)={0x224, 0x7d, 0x0, {{0x500, 0xe3, 0x0, 0x4, {0x0, 0x40000, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x1f, ' nodev{cvfox\x92\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05\xf7\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x47, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\a\x00\x00\x00\x00\x00\x00\x00\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x224) kernel console output (not intermixed with test programs): 9.758132][ T6171] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f9fa3f8df90 [ 89.758138][ T6171] RDX: 0000000000000002 RSI: 00007f9fa4d82c10 RDI: 00000000ffffff9c [ 89.758143][ T6171] RBP: 00007f9fa4d82c10 R08: 0000000000000000 R09: 00236f656469762f [ 89.758149][ T6171] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 89.758155][ T6171] R13: 00007f9fa41e6128 R14: 00007f9fa41e6090 R15: 00007fffee82e2f8 [ 89.758172][ T6171] [ 90.396856][ T6166] bond0: entered promiscuous mode [ 90.401974][ T6166] bond_slave_0: entered promiscuous mode [ 90.407709][ T6166] bond_slave_1: entered promiscuous mode [ 90.414309][ T6166] dummy0: entered promiscuous mode [ 90.420223][ T6166] hsr1: entered promiscuous mode [ 90.425173][ T6166] hsr1: entered allmulticast mode [ 90.431195][ T6166] bond0: entered allmulticast mode [ 90.436324][ T6166] bond_slave_0: entered allmulticast mode [ 90.442044][ T6166] bond_slave_1: entered allmulticast mode [ 90.447765][ T6166] dummy0: entered allmulticast mode [ 90.660041][ T5916] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 91.591260][ T6174] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 91.597387][ T6174] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 91.603877][ T6174] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 91.609858][ T6174] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 91.616259][ T6174] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 91.690383][ T5916] usb 4-1: Using ep0 maxpacket: 8 [ 91.715928][ T5916] usb 4-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 91.743499][ T5916] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.766647][ T5916] usb 4-1: config 0 descriptor?? [ 91.828917][ T5916] usb 4-1: USB disconnect, device number 2 [ 92.049955][ T5973] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 92.172464][ T6184] overlayfs: failed to resolve './file1': -2 [ 92.178473][ T30] audit: type=1400 audit(1766171842.455:208): avc: denied { mounton } for pid=6183 comm="syz.3.66" path="/14/bus" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 92.229957][ T5973] usb 3-1: Using ep0 maxpacket: 16 [ 92.241400][ T6186] CIFS: Unable to determine destination address [ 92.269341][ T5973] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 92.312520][ T5973] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 92.340732][ T5973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.348745][ T5973] usb 3-1: Product: syz [ 92.409979][ T5973] usb 3-1: Manufacturer: syz [ 92.414605][ T5973] usb 3-1: SerialNumber: syz [ 92.436416][ T5973] usb 3-1: config 0 descriptor?? [ 92.487991][ T5973] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 92.510775][ T5973] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 92.559483][ T6194] ======================================================= [ 92.559483][ T6194] WARNING: The mand mount option has been deprecated and [ 92.559483][ T6194] and is ignored by this kernel. Remove the mand [ 92.559483][ T6194] option from the mount to silence this warning. [ 92.559483][ T6194] ======================================================= [ 92.596031][ T30] audit: type=1400 audit(1766171842.875:209): avc: denied { mount } for pid=6190 comm="syz.4.61" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 92.653719][ T6187] overlayfs: missing 'lowerdir' [ 93.117898][ T5813] Bluetooth: hci0: command 0x0c1a tx timeout [ 93.189964][ T30] audit: type=1400 audit(1766171842.905:210): avc: denied { mounton } for pid=6190 comm="syz.4.61" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 93.245416][ T30] audit: type=1400 audit(1766171842.905:211): avc: denied { mount } for pid=6190 comm="syz.4.61" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 93.329040][ T30] audit: type=1400 audit(1766171842.935:212): avc: denied { mounton } for pid=6183 comm="syz.3.66" path="/14/bus/bus" dev="tmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 93.506932][ T30] audit: type=1400 audit(1766171843.605:213): avc: denied { create } for pid=6197 comm="syz.1.69" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 93.555622][ T30] audit: type=1400 audit(1766171843.645:214): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 93.556639][ T5973] em28xx 3-1:0.0: chip ID is em2765 [ 93.589523][ T6200] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 93.689964][ T5815] Bluetooth: hci3: command 0x0c1a tx timeout [ 93.696078][ T5813] Bluetooth: hci4: command 0x0c1a tx timeout [ 93.702167][ T5813] Bluetooth: hci2: command 0x0c1a tx timeout [ 93.709024][ T5815] Bluetooth: hci1: command 0x0c1a tx timeout [ 94.329617][ T30] audit: type=1400 audit(1766171843.755:215): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 94.381092][ T30] audit: type=1400 audit(1766171843.935:216): avc: denied { create } for pid=6197 comm="syz.1.69" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 94.424155][ T5973] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 94.440528][ T5973] em28xx 3-1:0.0: board has no eeprom [ 94.445978][ T30] audit: type=1400 audit(1766171843.935:217): avc: denied { connect } for pid=6203 comm="syz.4.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.568371][ T5916] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 94.748035][ T5916] usb 5-1: New USB device found, idVendor=2040, idProduct=c603, bcdDevice= 1.8e [ 95.408393][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.512340][ T6219] bridge0: entered promiscuous mode [ 95.705692][ T6182] em28xx 3-1:0.0: reading from i2c device at 0xfffe failed (error=-5) [ 95.714788][ T5916] usb 5-1: config 0 descriptor?? [ 95.726543][ T5916] usb 5-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC+' in warm state [ 95.779924][ T5973] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 95.788549][ T6211] bridge0: left promiscuous mode [ 95.793735][ T5973] em28xx 3-1:0.0: dvb set to bulk mode. [ 95.800190][ T5916] usb 5-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 95.836529][ T10] em28xx 3-1:0.0: Binding DVB extension [ 95.863022][ T5973] usb 3-1: USB disconnect, device number 3 [ 95.882067][ T5973] em28xx 3-1:0.0: Disconnecting em28xx [ 95.913665][ T6222] team0: No ports can be present during mode change [ 95.949426][ T6222] bridge0: entered promiscuous mode [ 96.016677][ T10] em28xx 3-1:0.0: Registering input extension [ 96.053236][ T5973] em28xx 3-1:0.0: Closing input extension [ 96.133141][ T5973] em28xx 3-1:0.0: Freeing device [ 97.028710][ T5861] usb 5-1: USB disconnect, device number 3 [ 97.324460][ T6227] team0: No ports can be present during mode change [ 97.379182][ T6230] bridge0: entered promiscuous mode [ 97.427054][ T6239] CIFS: Unable to determine destination address [ 97.622364][ T6220] bridge0: left promiscuous mode [ 98.210707][ T6225] bridge0: left promiscuous mode [ 98.564390][ T6256] overlayfs: failed to resolve './file1': -2 [ 98.570485][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 98.570496][ T30] audit: type=1400 audit(1766171848.835:226): avc: denied { name_bind } for pid=6254 comm="syz.1.82" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 98.700189][ T6259] overlayfs: missing 'lowerdir' [ 98.895612][ T30] audit: type=1400 audit(1766171848.845:227): avc: denied { name_connect } for pid=6254 comm="syz.1.82" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 99.642862][ T30] audit: type=1326 audit(1766171849.915:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6261 comm="syz.0.85" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f28aff8f749 code=0x0 [ 99.879852][ T6274] FAULT_INJECTION: forcing a failure. [ 99.879852][ T6274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.895301][ T6274] CPU: 1 UID: 0 PID: 6274 Comm: syz.4.86 Tainted: G L syzkaller #0 PREEMPT(full) [ 99.895318][ T6274] Tainted: [L]=SOFTLOCKUP [ 99.895321][ T6274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 99.895327][ T6274] Call Trace: [ 99.895331][ T6274] [ 99.895335][ T6274] dump_stack_lvl+0x16c/0x1f0 [ 99.895353][ T6274] should_fail_ex+0x512/0x640 [ 99.895371][ T6274] _copy_from_user+0x2e/0xd0 [ 99.895388][ T6274] snd_seq_write+0x3ed/0x6d0 [ 99.895406][ T6274] ? __pfx_snd_seq_write+0x10/0x10 [ 99.895421][ T6274] ? bpf_lsm_file_permission+0x9/0x10 [ 99.895431][ T6274] ? security_file_permission+0x71/0x210 [ 99.895446][ T6274] ? rw_verify_area+0xcf/0x6c0 [ 99.895458][ T6274] ? __pfx_snd_seq_write+0x10/0x10 [ 99.895470][ T6274] vfs_write+0x2a0/0x11d0 [ 99.895486][ T6274] ? __pfx_vfs_write+0x10/0x10 [ 99.895498][ T6274] ? find_held_lock+0x2b/0x80 [ 99.895514][ T6274] ? __fget_files+0x204/0x3c0 [ 99.895531][ T6274] ? __fget_files+0x20e/0x3c0 [ 99.895549][ T6274] ksys_write+0x1f8/0x250 [ 99.895563][ T6274] ? __pfx_ksys_write+0x10/0x10 [ 99.895580][ T6274] do_syscall_64+0xcd/0xf80 [ 99.895594][ T6274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.895605][ T6274] RIP: 0033:0x7f9fa3f8f749 [ 99.895613][ T6274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 99.895622][ T6274] RSP: 002b:00007f9fa4da4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.895632][ T6274] RAX: ffffffffffffffda RBX: 00007f9fa41e5fa0 RCX: 00007f9fa3f8f749 [ 99.895638][ T6274] RDX: 000000000000ffc8 RSI: 0000200000000000 RDI: 0000000000000005 [ 99.895644][ T6274] RBP: 00007f9fa4da4090 R08: 0000000000000000 R09: 0000000000000000 [ 99.895649][ T6274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.895655][ T6274] R13: 00007f9fa41e6038 R14: 00007f9fa41e5fa0 R15: 00007fffee82e2f8 [ 99.895668][ T6274] [ 101.375291][ T2032] Bluetooth: hci5: Frame reassembly failed (-84) [ 101.395345][ T30] audit: type=1400 audit(1766171851.675:229): avc: denied { view } for pid=6293 comm="syz.4.90" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 101.447243][ T2032] Bluetooth: hci5: Frame reassembly failed (-84) [ 101.801155][ T30] audit: type=1400 audit(1766171852.075:230): avc: denied { mount } for pid=6275 comm="syz.1.87" name="/" dev="ramfs" ino=8815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 102.299456][ T5815] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 103.051664][ T5815] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 103.055518][ T30] audit: type=1400 audit(1766171853.335:231): avc: denied { mounton } for pid=6314 comm="syz.2.97" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 103.088324][ T6315] gfs2: not a GFS2 filesystem [ 103.421124][ T5815] Bluetooth: hci5: command 0x1003 tx timeout [ 103.427501][ T5136] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 103.664879][ T5973] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 103.819914][ T5973] usb 4-1: Using ep0 maxpacket: 8 [ 103.846158][ T5973] usb 4-1: unable to get BOS descriptor or descriptor too short [ 103.855727][ T5973] usb 4-1: config 8 has an invalid interface number: 255 but max is 0 [ 103.871563][ T5973] usb 4-1: config 8 has no interface number 0 [ 103.877863][ T5973] usb 4-1: config 8 interface 255 has no altsetting 0 [ 103.968495][ T5973] usb 4-1: string descriptor 0 read error: -22 [ 104.021819][ T5973] usb 4-1: New USB device found, idVendor=0423, idProduct=000c, bcdDevice=2e.bf [ 104.126716][ T30] audit: type=1400 audit(1766171854.345:232): avc: denied { mount } for pid=6327 comm="syz.4.101" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 104.128044][ T5973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.290112][ T30] audit: type=1400 audit(1766171854.405:233): avc: denied { create } for pid=6324 comm="syz.1.100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 105.914598][ T30] audit: type=1400 audit(1766171856.195:234): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 105.935793][ T6108] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 106.058633][ T30] audit: type=1400 audit(1766171856.335:235): avc: denied { create } for pid=6347 comm="syz.2.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 106.130450][ T6108] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 106.147913][ T30] audit: type=1400 audit(1766171856.365:236): avc: denied { write } for pid=6349 comm="syz.4.104" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 106.171933][ T6108] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.191316][ T6108] usb 2-1: Product: syz [ 106.196144][ T6108] usb 2-1: Manufacturer: syz [ 106.209943][ T6108] usb 2-1: SerialNumber: syz [ 106.218153][ T6108] usb 2-1: config 0 descriptor?? [ 106.244685][ T6108] hub 2-1:0.0: bad descriptor, ignoring hub [ 106.259977][ T6108] hub 2-1:0.0: probe with driver hub failed with error -5 [ 106.377524][ T5973] eth%d: CATC EL1210A NetMate USB Ethernet at usb-dummy_hcd.3-1, 00:00:00:00:00:00. [ 106.387126][ T5915] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 106.565492][ T30] audit: type=1400 audit(1766171856.805:237): avc: denied { create } for pid=6353 comm="syz.0.106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 106.655406][ T6108] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 106.657102][ T5973] usb 4-1: USB disconnect, device number 3 [ 106.670001][ T5915] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 106.681737][ T5915] usb 5-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 106.692525][ T6108] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 106.697189][ T30] audit: type=1400 audit(1766171856.975:238): avc: denied { search } for pid=5481 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.724388][ T6356] team0: No ports can be present during mode change [ 106.730868][ T5915] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 106.742436][ T5915] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 107.602004][ T30] audit: type=1400 audit(1766171857.005:239): avc: denied { search } for pid=5481 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.624963][ T30] audit: type=1400 audit(1766171857.005:240): avc: denied { search } for pid=5481 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.652699][ T5915] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 107.664807][ T5915] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 107.672939][ T5915] usb 5-1: Product: syz [ 107.677111][ T5915] usb 5-1: Manufacturer: syz [ 107.683555][ T30] audit: type=1400 audit(1766171857.005:241): avc: denied { read } for pid=5481 comm="dhcpcd" name="n100" dev="tmpfs" ino=2372 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 107.717394][ T6108] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 107.719911][ T5915] cdc_wdm 5-1:1.0: skipping garbage [ 107.801517][ T5915] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 107.848900][ T6108] usb 2-1: media controller created [ 107.874118][ T6108] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 107.927975][ T9] usb 5-1: USB disconnect, device number 4 [ 107.957390][ T6356] bridge0: entered promiscuous mode [ 108.010526][ T6353] bridge0: left promiscuous mode [ 108.024759][ T6108] DVB: Unable to find symbol dib7000p_attach() [ 108.051891][ T6108] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 108.100242][ T5916] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 108.140830][ T6108] rc_core: IR keymap rc-dib0700-rc5 not found [ 108.247125][ T6108] Registered IR keymap rc-empty [ 108.254164][ T6108] dvb-usb: could not initialize remote control. [ 108.275870][ T6108] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 108.313281][ T5916] usb 3-1: Using ep0 maxpacket: 32 [ 108.325918][ T5916] usb 3-1: config 0 has an invalid interface number: 176 but max is 0 [ 108.336712][ T6108] usb 2-1: USB disconnect, device number 2 [ 108.351068][ T5916] usb 3-1: config 0 has no interface number 0 [ 108.386903][ T5916] usb 3-1: New USB device found, idVendor=1a0a, idProduct=0108, bcdDevice=ef.d2 [ 108.425150][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.440425][ T6108] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 108.459924][ T5916] usb 3-1: Product: syz [ 108.464166][ T5916] usb 3-1: Manufacturer: syz [ 108.468749][ T5916] usb 3-1: SerialNumber: syz [ 108.507068][ T5916] usb 3-1: config 0 descriptor?? [ 108.540228][ T5916] usb_ehset_test 3-1:0.176: probe with driver usb_ehset_test failed with error -32 [ 108.756112][ T5973] usb 3-1: USB disconnect, device number 4 [ 108.816801][ T6383] fuse: Unknown parameter '' [ 109.668656][ T6409] team0: No ports can be present during mode change [ 109.690450][ T6409] bridge0: entered promiscuous mode [ 109.857885][ T6411] netlink: 'syz.2.116': attribute type 1 has an invalid length. [ 109.998067][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 109.998081][ T30] audit: type=1400 audit(1766171860.275:255): avc: denied { connect } for pid=6401 comm="syz.3.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 110.699079][ T6406] netlink: 28 bytes leftover after parsing attributes in process `syz.2.116'. [ 110.731630][ T9] IPVS: starting estimator thread 0... [ 110.860063][ T6422] IPVS: using max 76 ests per chain, 182400 per kthread [ 110.900746][ T6411] 8021q: adding VLAN 0 to HW filter on device bond1 [ 110.911370][ T6421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.117'. [ 110.935000][ T6403] bridge0: left promiscuous mode [ 110.994381][ T6421] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.007861][ T6421] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 111.025711][ T6421] FAULT_INJECTION: forcing a failure. [ 111.025711][ T6421] name failslab, interval 1, probability 0, space 0, times 0 [ 111.063903][ T6421] CPU: 1 UID: 0 PID: 6421 Comm: syz.0.117 Tainted: G L syzkaller #0 PREEMPT(full) [ 111.063931][ T6421] Tainted: [L]=SOFTLOCKUP [ 111.063936][ T6421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 111.063945][ T6421] Call Trace: [ 111.063950][ T6421] [ 111.063956][ T6421] dump_stack_lvl+0x16c/0x1f0 [ 111.063980][ T6421] should_fail_ex+0x512/0x640 [ 111.064005][ T6421] should_failslab+0xc2/0x120 [ 111.064024][ T6421] kmem_cache_alloc_node_noprof+0x86/0x800 [ 111.064040][ T6421] ? __alloc_skb+0x156/0x410 [ 111.064066][ T6421] ? __alloc_skb+0x156/0x410 [ 111.064086][ T6421] __alloc_skb+0x156/0x410 [ 111.064106][ T6421] ? __alloc_skb+0x35d/0x410 [ 111.064132][ T6421] ? __pfx___alloc_skb+0x10/0x10 [ 111.064151][ T6421] ? finish_task_switch.isra.0+0x2e0/0xbd0 [ 111.064183][ T6421] arp_create+0x1ef/0xa10 [ 111.064196][ T6421] ? __pfx_arp_create+0x10/0x10 [ 111.064204][ T6421] ? batadv_primary_if_get_selected+0x223/0x440 [ 111.064221][ T6421] ? __lock_acquire+0x12c2/0x2890 [ 111.064237][ T6421] batadv_bla_send_claim+0x157/0xdf0 [ 111.064255][ T6421] ? do_raw_spin_lock+0x12c/0x2b0 [ 111.064269][ T6421] ? __pfx_batadv_bla_send_claim+0x10/0x10 [ 111.064286][ T6421] ? __local_bh_enable_ip+0xa4/0x120 [ 111.064303][ T6421] batadv_bla_send_announce+0x12d/0x180 [ 111.064319][ T6421] ? __pfx_batadv_bla_send_announce+0x10/0x10 [ 111.064337][ T6421] ? batadv_bla_update_orig_address+0x47b/0x760 [ 111.064356][ T6421] batadv_bla_update_orig_address+0x41b/0x760 [ 111.064377][ T6421] batadv_primary_if_update_addr+0x272/0x370 [ 111.064391][ T6421] batadv_primary_if_select+0x15b/0x3a0 [ 111.064405][ T6421] batadv_hardif_disable_interface+0xafe/0xe70 [ 111.064422][ T6421] ? __pfx_batadv_hardif_disable_interface+0x10/0x10 [ 111.064435][ T6421] ? finish_task_switch.isra.0+0x207/0xbd0 [ 111.064460][ T6421] batadv_meshif_destroy_netlink+0x79/0x150 [ 111.064476][ T6421] rtnl_dellink+0x44e/0xad0 [ 111.064486][ T6421] ? __pfx_batadv_meshif_destroy_netlink+0x10/0x10 [ 111.064501][ T6421] ? __lock_acquire+0x436/0x2890 [ 111.064514][ T6421] ? __pfx_rtnl_dellink+0x10/0x10 [ 111.064552][ T6421] ? find_held_lock+0x2b/0x80 [ 111.064568][ T6421] ? rcu_is_watching+0x12/0xc0 [ 111.064577][ T6421] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 111.064589][ T6421] ? lockdep_hardirqs_on+0x7c/0x110 [ 111.064602][ T6421] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 111.064613][ T6421] ? rcu_preempt_deferred_qs_irqrestore+0x500/0xbc0 [ 111.064632][ T6421] ? __pfx_rtnl_dellink+0x10/0x10 [ 111.064642][ T6421] rtnetlink_rcv_msg+0x95e/0xe90 [ 111.064655][ T6421] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 111.064666][ T6421] ? __lock_acquire+0x436/0x2890 [ 111.064681][ T6421] ? ref_tracker_free+0x37c/0x830 [ 111.064699][ T6421] netlink_rcv_skb+0x158/0x420 [ 111.064711][ T6421] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 111.064724][ T6421] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 111.064745][ T6421] netlink_unicast+0x5aa/0x870 [ 111.064760][ T6421] ? __pfx_netlink_unicast+0x10/0x10 [ 111.064778][ T6421] netlink_sendmsg+0x8c8/0xdd0 [ 111.064795][ T6421] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.064813][ T6421] ____sys_sendmsg+0xa5d/0xc30 [ 111.064827][ T6421] ? copy_msghdr_from_user+0x10a/0x160 [ 111.064837][ T6421] ? __pfx_____sys_sendmsg+0x10/0x10 [ 111.064857][ T6421] ___sys_sendmsg+0x134/0x1d0 [ 111.064870][ T6421] ? __pfx____sys_sendmsg+0x10/0x10 [ 111.064897][ T6421] __sys_sendmsg+0x16d/0x220 [ 111.064908][ T6421] ? __pfx___sys_sendmsg+0x10/0x10 [ 111.064927][ T6421] do_syscall_64+0xcd/0xf80 [ 111.064941][ T6421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.064952][ T6421] RIP: 0033:0x7f28aff8f749 [ 111.064960][ T6421] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 111.064969][ T6421] RSP: 002b:00007f28b0dc1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.064980][ T6421] RAX: ffffffffffffffda RBX: 00007f28b01e5fa0 RCX: 00007f28aff8f749 [ 111.064986][ T6421] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000009 [ 111.064992][ T6421] RBP: 00007f28b0dc1090 R08: 0000000000000000 R09: 0000000000000000 [ 111.064997][ T6421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.065003][ T6421] R13: 00007f28b01e6038 R14: 00007f28b01e5fa0 R15: 00007ffc72f19258 [ 111.065017][ T6421] [ 111.499007][ T6421] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.506486][ T6421] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 111.775443][ T30] audit: type=1400 audit(1766171862.055:256): avc: denied { bind } for pid=6430 comm="syz.1.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 111.800820][ T6432] atomic_op ffff8880533a8198 conn xmit_atomic 0000000000000000 [ 111.875995][ T30] audit: type=1400 audit(1766171862.085:257): avc: denied { write } for pid=6430 comm="syz.1.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 112.054194][ T6437] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 112.080650][ T30] audit: type=1400 audit(1766171862.365:258): avc: denied { ioctl } for pid=6434 comm="syz.0.121" path="socket:[10478]" dev="sockfs" ino=10478 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 112.309692][ T6435] netlink: 'syz.2.119': attribute type 10 has an invalid length. [ 113.438911][ T6435] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.446302][ T6435] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.464341][ T6435] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.471431][ T6435] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.478719][ T6435] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.485834][ T6435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.537363][ T6435] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 113.579047][ T30] audit: type=1400 audit(1766171863.855:259): avc: denied { read } for pid=6448 comm="syz.3.124" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 113.656102][ T30] audit: type=1400 audit(1766171863.885:260): avc: denied { open } for pid=6448 comm="syz.3.124" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 113.682804][ T30] audit: type=1400 audit(1766171863.885:261): avc: denied { ioctl } for pid=6448 comm="syz.3.124" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 113.709694][ T30] audit: type=1400 audit(1766171863.885:262): avc: denied { ioctl } for pid=6448 comm="syz.3.124" path="socket:[10489]" dev="sockfs" ino=10489 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 114.060530][ T6108] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 114.280035][ T6108] usb 1-1: Using ep0 maxpacket: 16 [ 114.297087][ T6108] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.373744][ T6108] usb 1-1: config 0 interface 0 has no altsetting 0 [ 114.389978][ T5916] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 114.407705][ T6108] usb 1-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 114.431480][ T6108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.450955][ T6108] usb 1-1: config 0 descriptor?? [ 114.540024][ T5916] usb 4-1: Using ep0 maxpacket: 8 [ 114.546847][ T5916] usb 4-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 114.563252][ T5916] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.596649][ T5916] usb 4-1: config 0 descriptor?? [ 115.663950][ T30] audit: type=1400 audit(1766171865.505:263): avc: denied { write } for pid=6459 comm="syz.4.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 115.795212][ T6108] cougar 0003:060B:500A.0001: unexpected long global item [ 115.834727][ T6108] cougar 0003:060B:500A.0001: parse failed [ 115.863948][ T6108] cougar 0003:060B:500A.0001: probe with driver cougar failed with error -22 [ 116.117412][ T30] audit: type=1400 audit(1766171866.395:264): avc: denied { shutdown } for pid=6470 comm="syz.4.130" lport=57497 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 116.735521][ T30] audit: type=1400 audit(1766171866.565:265): avc: denied { create } for pid=6475 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 116.756480][ T30] audit: type=1400 audit(1766171866.645:266): avc: denied { getopt } for pid=6475 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 116.796571][ T9] usb 4-1: USB disconnect, device number 4 [ 116.923595][ T6108] usb 1-1: USB disconnect, device number 2 [ 116.989961][ T30] audit: type=1400 audit(1766171867.245:267): avc: denied { create } for pid=6481 comm="syz.3.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 117.100134][ T30] audit: type=1400 audit(1766171867.245:268): avc: denied { setopt } for pid=6481 comm="syz.3.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 117.185174][ T30] audit: type=1400 audit(1766171867.255:269): avc: denied { create } for pid=6481 comm="syz.3.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 117.232012][ T6494] netlink: 24 bytes leftover after parsing attributes in process `syz.2.136'. [ 117.378187][ T30] audit: type=1400 audit(1766171867.435:270): avc: denied { create } for pid=6483 comm="syz.2.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 117.414959][ T6494] overlayfs: missing 'lowerdir' [ 118.300181][ T30] audit: type=1400 audit(1766171867.445:271): avc: denied { read } for pid=6483 comm="syz.2.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 118.320050][ T30] audit: type=1400 audit(1766171867.495:272): avc: denied { sqpoll } for pid=6483 comm="syz.2.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 118.986963][ T6519] team0: No ports can be present during mode change [ 119.022522][ T6519] bridge0: entered promiscuous mode [ 119.209821][ T6512] bridge0: left promiscuous mode [ 119.620591][ T6529] input: syz1 as /devices/virtual/input/input8 [ 119.830123][ T5801] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 120.187809][ T6535] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 120.970764][ T5801] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.980730][ T5801] usb 2-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 120.990777][ T5801] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.054803][ T5801] usb 2-1: config 0 descriptor?? [ 122.605479][ T6530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.652316][ T6530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.686941][ T5801] nintendo 0003:057E:200E.0002: hidraw0: USB HID v80.00 Device [HID 057e:200e] on usb-dummy_hcd.1-1/input0 [ 122.827822][ T5801] nintendo 0003:057E:200E.0002: Failed charging grip handshake [ 122.869678][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 122.869692][ T30] audit: type=1400 audit(1766171873.145:276): avc: denied { create } for pid=6528 comm="syz.1.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 122.900783][ T5801] nintendo 0003:057E:200E.0002: Failed to initialize controller; ret=-110 [ 122.917355][ T30] audit: type=1400 audit(1766171873.185:277): avc: denied { ioctl } for pid=6528 comm="syz.1.144" path="socket:[10947]" dev="sockfs" ino=10947 ioctlcmd=0x52c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 122.951256][ T30] audit: type=1400 audit(1766171873.225:278): avc: denied { bind } for pid=6555 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 122.973680][ T30] audit: type=1400 audit(1766171873.225:279): avc: denied { setopt } for pid=6555 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 123.002789][ T5801] nintendo 0003:057E:200E.0002: probe - fail = -110 [ 123.138567][ T5801] nintendo 0003:057E:200E.0002: probe with driver nintendo failed with error -110 [ 123.152892][ T30] audit: type=1400 audit(1766171873.345:280): avc: denied { override_creds } for pid=6555 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 123.190125][ T5801] usb 2-1: USB disconnect, device number 3 [ 123.457623][ T30] audit: type=1400 audit(1766171873.345:281): avc: denied { read } for pid=6555 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 123.524300][ T6567] syz_tun: entered allmulticast mode [ 123.553698][ T30] audit: type=1400 audit(1766171873.805:282): avc: denied { map } for pid=6559 comm="syz.0.152" path="socket:[10965]" dev="sockfs" ino=10965 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 123.620596][ T30] audit: type=1400 audit(1766171873.805:283): avc: denied { setopt } for pid=6559 comm="syz.0.152" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 123.764830][ T30] audit: type=1400 audit(1766171874.045:284): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 124.160281][ T30] audit: type=1400 audit(1766171874.435:285): avc: denied { ioctl } for pid=6571 comm="syz.1.154" path="socket:[10978]" dev="sockfs" ino=10978 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 124.184969][ T6572] netlink: 44 bytes leftover after parsing attributes in process `syz.1.154'. [ 124.278832][ T6572] block device autoloading is deprecated and will be removed. [ 125.374164][ T10] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 125.416341][ T10] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 126.728843][ T6594] fido_id[6594]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 126.879629][ T6601] CIFS: Unable to determine destination address [ 127.029934][ T6542] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 127.208346][ T6542] usb 4-1: Using ep0 maxpacket: 32 [ 127.222047][ T6542] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 127.238851][ T6542] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.250155][ T6542] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 127.301336][ T6542] usb 4-1: config 0 interface 0 has no altsetting 0 [ 127.350347][ T6542] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 127.440984][ T6542] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.826851][ T6542] usb 4-1: config 0 descriptor?? [ 128.071034][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 128.071047][ T30] audit: type=1400 audit(1766171878.335:293): avc: denied { map } for pid=6596 comm="syz.3.160" path="socket:[11357]" dev="sockfs" ino=11357 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 128.159527][ T30] audit: type=1400 audit(1766171878.335:294): avc: denied { read } for pid=6596 comm="syz.3.160" path="socket:[11357]" dev="sockfs" ino=11357 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 128.745279][ T6617] netlink: 620 bytes leftover after parsing attributes in process `syz.2.165'. [ 129.194551][ T30] audit: type=1400 audit(1766171879.475:295): avc: denied { accept } for pid=6623 comm="syz.4.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 129.194788][ T6624] netlink: 'syz.4.167': attribute type 12 has an invalid length. [ 129.250310][ T6621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.260996][ T6621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.166887][ T6542] usbhid 4-1:0.0: can't add hid device: -71 [ 132.166939][ T6542] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 132.169785][ T6542] usb 4-1: USB disconnect, device number 5 [ 132.618718][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.618799][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.731379][ T6647] team0: No ports can be present during mode change [ 132.742989][ T6647] bridge0: entered promiscuous mode [ 133.081414][ T6640] bridge0: left promiscuous mode [ 133.523648][ T6665] FAULT_INJECTION: forcing a failure. [ 133.523648][ T6665] name failslab, interval 1, probability 0, space 0, times 0 [ 133.537626][ T6665] CPU: 0 UID: 0 PID: 6665 Comm: syz.4.178 Tainted: G L syzkaller #0 PREEMPT(full) [ 133.537651][ T6665] Tainted: [L]=SOFTLOCKUP [ 133.537656][ T6665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 133.537665][ T6665] Call Trace: [ 133.537670][ T6665] [ 133.537677][ T6665] dump_stack_lvl+0x16c/0x1f0 [ 133.537702][ T6665] should_fail_ex+0x512/0x640 [ 133.537726][ T6665] ? fs_reclaim_acquire+0xae/0x150 [ 133.537750][ T6665] should_failslab+0xc2/0x120 [ 133.537771][ T6665] __kmalloc_noprof+0xeb/0x910 [ 133.537792][ T6665] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 133.537819][ T6665] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 133.537838][ T6665] tomoyo_realpath_from_path+0xc2/0x6e0 [ 133.537862][ T6665] ? tomoyo_profile+0x47/0x60 [ 133.537888][ T6665] tomoyo_path_number_perm+0x245/0x580 [ 133.537906][ T6665] ? tomoyo_path_number_perm+0x237/0x580 [ 133.537925][ T6665] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 133.537942][ T6665] ? find_held_lock+0x2b/0x80 [ 133.537979][ T6665] ? find_held_lock+0x2b/0x80 [ 133.538001][ T6665] ? hook_file_ioctl_common+0x144/0x410 [ 133.538037][ T6665] ? __fget_files+0x20e/0x3c0 [ 133.538063][ T6665] security_file_ioctl+0x9b/0x240 [ 133.538083][ T6665] __x64_sys_ioctl+0xb7/0x210 [ 133.538103][ T6665] do_syscall_64+0xcd/0xf80 [ 133.538125][ T6665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.538141][ T6665] RIP: 0033:0x7f9fa3f8f749 [ 133.538155][ T6665] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 133.538169][ T6665] RSP: 002b:00007f9fa4da4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 133.538184][ T6665] RAX: ffffffffffffffda RBX: 00007f9fa41e5fa0 RCX: 00007f9fa3f8f749 [ 133.538194][ T6665] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 133.538203][ T6665] RBP: 00007f9fa4da4090 R08: 0000000000000000 R09: 0000000000000000 [ 133.538212][ T6665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 133.538221][ T6665] R13: 00007f9fa41e6038 R14: 00007f9fa41e5fa0 R15: 00007fffee82e2f8 [ 133.538245][ T6665] [ 133.538252][ T6665] ERROR: Out of memory at tomoyo_realpath_from_path. [ 133.847888][ T6666] syz.2.177 uses obsolete (PF_INET,SOCK_PACKET) [ 133.951411][ T30] audit: type=1400 audit(1766171884.235:296): avc: denied { ioctl } for pid=6657 comm="syz.2.177" path="socket:[11571]" dev="sockfs" ino=11571 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 134.072600][ T30] audit: type=1400 audit(1766171884.355:297): avc: denied { create } for pid=6672 comm="syz.4.179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.199794][ T6675] netlink: 'syz.4.181': attribute type 12 has an invalid length. [ 136.941323][ T6700] team0: No ports can be present during mode change [ 137.050633][ T6699] bridge0: entered promiscuous mode [ 137.253285][ T6697] bridge0: left promiscuous mode [ 138.182618][ T30] audit: type=1400 audit(1766171888.465:298): avc: denied { getopt } for pid=6713 comm="syz.3.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 138.739996][ T30] audit: type=1400 audit(1766171888.585:299): avc: denied { read write } for pid=6709 comm="syz.2.190" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 138.886073][ T30] audit: type=1400 audit(1766171888.585:300): avc: denied { open } for pid=6709 comm="syz.2.190" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 139.093872][ T6726] netlink: 'syz.3.194': attribute type 12 has an invalid length. [ 141.555202][ T30] audit: type=1400 audit(1766171891.835:301): avc: denied { read write } for pid=6739 comm="syz.1.197" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 142.680212][ T30] audit: type=1400 audit(1766171891.835:302): avc: denied { open } for pid=6739 comm="syz.1.197" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 142.711476][ T30] audit: type=1400 audit(1766171892.175:303): avc: denied { ioctl } for pid=6739 comm="syz.1.197" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 143.525166][ T6756] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 143.753808][ T30] audit: type=1326 audit(1766171894.035:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6736 comm="syz.2.195" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f552e38f749 code=0x0 [ 143.908983][ T6761] team0: No ports can be present during mode change [ 143.929588][ T6761] bridge0: entered promiscuous mode [ 144.090859][ T6738] netlink: 24 bytes leftover after parsing attributes in process `syz.2.195'. [ 144.130561][ T6759] bridge0: left promiscuous mode [ 144.687666][ T6768] bridge1: entered promiscuous mode [ 144.853815][ T6777] team0: No ports can be present during mode change [ 144.883547][ T6777] bridge0: entered promiscuous mode [ 145.082042][ T6772] bridge0: left promiscuous mode [ 145.201951][ T6781] netlink: 8 bytes leftover after parsing attributes in process `syz.2.207'. [ 145.246541][ T30] audit: type=1400 audit(1766171895.525:305): avc: denied { bind } for pid=6782 comm="syz.3.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 145.349977][ T30] audit: type=1400 audit(1766171895.525:306): avc: denied { node_bind } for pid=6782 comm="syz.3.208" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 147.400221][ T6805] team0: No ports can be present during mode change [ 147.410421][ T6806] bridge0: entered promiscuous mode [ 147.442612][ T6803] bridge0: left promiscuous mode [ 147.660212][ T30] audit: type=1400 audit(1766171897.945:307): avc: denied { read } for pid=6814 comm="syz.1.215" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 147.834758][ T6819] netlink: 32 bytes leftover after parsing attributes in process `syz.3.214'. [ 147.844114][ T30] audit: type=1400 audit(1766171897.965:308): avc: denied { open } for pid=6814 comm="syz.1.215" path="/42/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 148.006901][ T6819] netlink: 32 bytes leftover after parsing attributes in process `syz.3.214'. [ 148.151381][ T30] audit: type=1326 audit(1766171898.425:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6820 comm="syz.4.218" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9fa3f8f749 code=0x0 [ 148.245294][ T6829] netlink: 'syz.1.217': attribute type 10 has an invalid length. [ 148.254559][ T6829] bridge0: port 3(dummy0) entered disabled state [ 148.261891][ T6829] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.270173][ T6829] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.624184][ T30] audit: type=1400 audit(1766171898.905:310): avc: denied { watch watch_reads } for pid=6811 comm="syz.3.214" path="/45/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 148.960246][ T6835] team0: No ports can be present during mode change [ 149.389092][ T6838] netlink: 'syz.0.219': attribute type 10 has an invalid length. [ 149.399144][ T6838] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.406746][ T6838] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.543160][ T6838] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.550446][ T6838] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.558016][ T6838] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.565214][ T6838] bridge0: port 1(bridge_slave_0) entered forwarding state [ 149.614250][ T6838] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.621719][ T6838] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.934159][ T6849] netlink: 'syz.2.224': attribute type 2 has an invalid length. [ 149.975839][ T6849] netlink: 119 bytes leftover after parsing attributes in process `syz.2.224'. [ 150.032143][ T6849] netlink: 12 bytes leftover after parsing attributes in process `syz.2.224'. [ 150.215751][ T30] audit: type=1400 audit(1766171900.495:311): avc: denied { write } for pid=6851 comm="syz.0.226" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 150.219345][ T6852] ***************************************************** [ 150.294733][ C1] sd 0:0:1:0: [sda] tag#4202 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 150.305184][ C1] sd 0:0:1:0: [sda] tag#4202 CDB: Write(6) 0a 00 00 00 05 00 00 00 02 00 00 00 [ 150.509896][ T6852] ORANGEFS Device Error: You cannot open the device file [ 150.509907][ T6852] [ 150.509907][ T6852] /dev/pvfs2-req more than once. Please make sure that [ 150.509907][ T6852] there are no [ 150.509917][ T6852] instances of a program using this device [ 150.509917][ T6852] currently running. (You must verify this!) [ 150.509926][ T6852] For example, you can use the lsof program as follows: [ 150.509932][ T6852] 'lsof | grep pvfs2-req' (run this as root) [ 150.509940][ T6852] open_access_count = 1 [ 150.509948][ T6852] ***************************************************** [ 150.720439][ T5882] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 150.869915][ T5882] usb 4-1: Using ep0 maxpacket: 8 [ 150.879168][ T5882] usb 4-1: config 0 has an invalid interface number: 129 but max is 0 [ 150.898349][ T30] audit: type=1400 audit(1766171901.175:312): avc: denied { audit_write } for pid=6872 comm="syz.1.233" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 150.924598][ T5882] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 151.060211][ T5882] usb 4-1: config 0 has no interface number 1 [ 151.066308][ T5882] usb 4-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 151.309925][ T5882] usb 4-1: config 0 interface 0 has no altsetting 0 [ 151.317806][ T5882] usb 4-1: config 0 interface 129 has no altsetting 0 [ 151.357935][ T5882] usb 4-1: New USB device found, idVendor=20a0, idProduct=4287, bcdDevice= 0.00 [ 151.388579][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.456356][ T5882] usb 4-1: config 0 descriptor?? [ 151.478081][ T5882] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 151.639065][ T5882] cdc_acm 4-1:0.129: Zero length descriptor references [ 151.656095][ T5882] cdc_acm 4-1:0.129: probe with driver cdc_acm failed with error -22 [ 151.748364][ T30] audit: type=1400 audit(1766171902.005:313): avc: denied { ioctl } for pid=6872 comm="syz.1.233" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=13416 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 153.596579][ T5915] usb 4-1: USB disconnect, device number 6 [ 153.679698][ T30] audit: type=1400 audit(1766171903.955:314): avc: denied { map } for pid=6907 comm="syz.3.240" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 153.825367][ T6896] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 153.831685][ T6896] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 153.837640][ T6896] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 153.843602][ T6896] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 153.849561][ T6896] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 154.089940][ T30] audit: type=1400 audit(1766171903.985:315): avc: denied { execute } for pid=6907 comm="syz.3.240" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 154.191567][ T30] audit: type=1400 audit(1766171903.995:316): avc: denied { ioctl } for pid=6907 comm="syz.3.240" path="socket:[12936]" dev="sockfs" ino=12936 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 154.238011][ T6915] netlink: 4 bytes leftover after parsing attributes in process `syz.4.243'. [ 154.259959][ T30] audit: type=1400 audit(1766171904.515:317): avc: denied { bind } for pid=6910 comm="syz.4.243" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 154.320022][ T6911] netlink: 4 bytes leftover after parsing attributes in process `syz.4.243'. [ 154.430037][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 154.599909][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 154.624407][ T9] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 154.643152][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.660966][ T9] usb 2-1: Product: syz [ 154.669884][ T9] usb 2-1: Manufacturer: syz [ 154.681561][ T9] usb 2-1: SerialNumber: syz [ 154.898672][ T9] usb 2-1: config 0 descriptor?? [ 155.052710][ T9] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 155.105771][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 155.181895][ T6940] bond0: entered promiscuous mode [ 155.186969][ T6940] bond_slave_0: entered promiscuous mode [ 155.193207][ T6940] bond_slave_1: entered promiscuous mode [ 155.203556][ T6940] dummy0: entered promiscuous mode [ 155.211167][ T6940] debugfs: 'hsr1' already exists in 'hsr' [ 155.223002][ T6940] Cannot create hsr debugfs directory [ 155.228903][ T6940] hsr1: entered promiscuous mode [ 155.233930][ T6940] hsr1: entered allmulticast mode [ 155.238966][ T6940] bond0: entered allmulticast mode [ 155.244130][ T6940] bond_slave_0: entered allmulticast mode [ 155.250912][ T6940] bond_slave_1: entered allmulticast mode [ 155.256671][ T6940] dummy0: entered allmulticast mode [ 155.882819][ T5882] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 155.900164][ T5813] Bluetooth: hci3: command 0x0c1a tx timeout [ 155.906401][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 155.912516][ T5815] Bluetooth: hci4: command 0x0c1a tx timeout [ 155.918525][ T5136] Bluetooth: hci2: command 0x0c1a tx timeout [ 156.080044][ T5882] usb 1-1: Using ep0 maxpacket: 8 [ 156.089985][ T5882] usb 1-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 156.116875][ T5882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.149382][ T5882] usb 1-1: config 0 descriptor?? [ 156.217827][ T30] audit: type=1400 audit(1766171906.495:318): avc: denied { map } for pid=6945 comm="syz.2.250" path="socket:[13776]" dev="sockfs" ino=13776 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 156.275940][ T30] audit: type=1400 audit(1766171906.495:319): avc: denied { read accept } for pid=6945 comm="syz.2.250" path="socket:[13776]" dev="sockfs" ino=13776 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 156.513991][ T6956] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 156.723134][ T6955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.253'. [ 157.899388][ T5915] usb 1-1: USB disconnect, device number 3 [ 157.911909][ T5882] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 158.119938][ T5882] usb 5-1: Using ep0 maxpacket: 32 [ 158.131706][ T5882] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 158.145281][ T5882] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 158.155812][ T5882] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 158.165688][ T5882] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.177495][ T5882] usb 5-1: config 0 descriptor?? [ 158.192570][ T5882] hub 5-1:0.0: USB hub found [ 158.391803][ T5882] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 158.583502][ T6982] netlink: 16 bytes leftover after parsing attributes in process `syz.2.259'. [ 158.594728][ T6982] IPVS: sh: FWM 3 0x00000003 - no destination available [ 158.617048][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 158.641372][ T5801] IPVS: starting estimator thread 0... [ 158.730321][ T6983] IPVS: using max 39 ests per chain, 93600 per kthread [ 158.860835][ T9] gspca_stk1135: reg_w 0x352 err -71 [ 158.867161][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 158.874695][ T9] gspca_stk1135: Sensor write failed [ 158.880071][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 158.903717][ T9] gspca_stk1135: Sensor write failed [ 158.909834][ T5882] hid-generic 0003:046D:C31C.0004: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 158.929908][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 158.949902][ T9] gspca_stk1135: Sensor read failed [ 158.955122][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 158.986919][ T9] gspca_stk1135: Sensor read failed [ 159.001619][ T9] gspca_stk1135: Detected sensor type unknown (0x0) [ 159.020650][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 159.039076][ T9] gspca_stk1135: Sensor read failed [ 159.126578][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 159.141270][ T9] gspca_stk1135: Sensor read failed [ 159.420716][ T6992] FAULT_INJECTION: forcing a failure. [ 159.420716][ T6992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.583436][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 159.589787][ T9] gspca_stk1135: Sensor write failed [ 159.599896][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 159.606239][ T9] gspca_stk1135: Sensor write failed [ 159.612219][ T9] stk1135 2-1:0.0: probe with driver stk1135 failed with error -71 [ 159.620428][ T6992] CPU: 0 UID: 0 PID: 6992 Comm: syz.4.255 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.620452][ T6992] Tainted: [L]=SOFTLOCKUP [ 159.620458][ T6992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 159.620466][ T6992] Call Trace: [ 159.620472][ T6992] [ 159.620478][ T6992] dump_stack_lvl+0x16c/0x1f0 [ 159.620504][ T6992] should_fail_ex+0x512/0x640 [ 159.620539][ T6992] _copy_to_user+0x32/0xd0 [ 159.620566][ T6992] simple_read_from_buffer+0xcb/0x170 [ 159.620591][ T6992] proc_fail_nth_read+0x197/0x240 [ 159.620610][ T6992] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.620629][ T6992] ? rw_verify_area+0xcf/0x6c0 [ 159.620647][ T6992] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.620664][ T6992] vfs_read+0x1e4/0xcf0 [ 159.620686][ T6992] ? __pfx___mutex_lock+0x10/0x10 [ 159.620711][ T6992] ? __pfx_vfs_read+0x10/0x10 [ 159.620739][ T6992] ? __fget_files+0x20e/0x3c0 [ 159.620760][ T6992] ? lockdep_hardirqs_on+0x10/0x110 [ 159.620787][ T6992] ksys_read+0x12a/0x250 [ 159.620808][ T6992] ? __pfx_ksys_read+0x10/0x10 [ 159.620836][ T6992] do_syscall_64+0xcd/0xf80 [ 159.620859][ T6992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.620876][ T6992] RIP: 0033:0x7f9fa3f8e15c [ 159.620890][ T6992] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 159.620905][ T6992] RSP: 002b:00007f9fa4d83030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 159.620921][ T6992] RAX: ffffffffffffffda RBX: 00007f9fa41e6090 RCX: 00007f9fa3f8e15c [ 159.620931][ T6992] RDX: 000000000000000f RSI: 00007f9fa4d830a0 RDI: 0000000000000005 [ 159.620941][ T6992] RBP: 00007f9fa4d83090 R08: 0000000000000000 R09: 0023776172646968 [ 159.620950][ T6992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.620960][ T6992] R13: 00007f9fa41e6128 R14: 00007f9fa41e6090 R15: 00007fffee82e2f8 [ 159.620985][ T6992] [ 159.827752][ T9] usb 2-1: USB disconnect, device number 4 [ 159.909445][ T5882] usb 5-1: USB disconnect, device number 5 [ 160.451885][ T7002] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.263'. [ 161.069939][ T30] audit: type=1326 audit(1766171911.345:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.209607][ T30] audit: type=1326 audit(1766171911.345:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.279782][ T30] audit: type=1326 audit(1766171911.345:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.305453][ T30] audit: type=1326 audit(1766171911.345:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.328908][ T30] audit: type=1326 audit(1766171911.345:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=244 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.356554][ T30] audit: type=1326 audit(1766171911.405:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.414442][ T30] audit: type=1326 audit(1766171911.405:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.478383][ T30] audit: type=1326 audit(1766171911.405:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.553637][ T30] audit: type=1326 audit(1766171911.405:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6993 comm="syz.0.262" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f28aff8f749 code=0x7ffc0000 [ 161.653070][ T30] audit: type=1400 audit(1766171911.405:329): avc: denied { bind } for pid=6993 comm="syz.0.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 161.799831][ T7009] netlink: 8 bytes leftover after parsing attributes in process `syz.4.266'. [ 162.988254][ T7029] bond0: entered promiscuous mode [ 162.993505][ T7029] bond_slave_0: entered promiscuous mode [ 162.999969][ T7029] bond_slave_1: entered promiscuous mode [ 163.006256][ T7029] bridge0: entered promiscuous mode [ 163.025400][ T7029] dummy0: entered promiscuous mode [ 163.034158][ T7029] debugfs: 'hsr1' already exists in 'hsr' [ 163.040012][ T7029] Cannot create hsr debugfs directory [ 163.046188][ T7029] hsr1: entered promiscuous mode [ 163.051220][ T7029] hsr1: entered allmulticast mode [ 163.056259][ T7029] bond0: entered allmulticast mode [ 163.061509][ T7029] bond_slave_0: entered allmulticast mode [ 163.067248][ T7029] bond_slave_1: entered allmulticast mode [ 163.073030][ T7029] bridge0: entered allmulticast mode [ 163.078357][ T7029] dummy0: entered allmulticast mode [ 163.349408][ T7027] netlink: 'syz.0.269': attribute type 12 has an invalid length. [ 163.380075][ T5801] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 163.741466][ T7036] team0: No ports can be present during mode change [ 163.790162][ T7036] bridge0: entered promiscuous mode [ 164.941606][ T5801] usb 3-1: Using ep0 maxpacket: 8 [ 164.985227][ T5801] usb 3-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 164.999619][ T5801] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.088384][ T5801] usb 3-1: config 0 descriptor?? [ 165.172356][ T5801] usb 3-1: USB disconnect, device number 5 [ 165.202312][ T7034] bridge0: left promiscuous mode [ 166.396120][ T7058] netlink: 'syz.3.277': attribute type 12 has an invalid length. [ 167.403994][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 167.404004][ T30] audit: type=1400 audit(1766171917.685:391): avc: denied { write } for pid=7068 comm="syz.3.280" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 167.556191][ T30] audit: type=1400 audit(1766171917.715:392): avc: denied { open } for pid=7068 comm="syz.3.280" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 167.948849][ T30] audit: type=1400 audit(1766171918.195:393): avc: denied { name_connect } for pid=7076 comm="syz.1.282" dest=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 168.041559][ T30] audit: type=1400 audit(1766171918.225:394): avc: denied { cmd } for pid=7076 comm="syz.1.282" path="socket:[14029]" dev="sockfs" ino=14029 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 170.320050][ T48] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 170.529954][ T48] usb 3-1: Using ep0 maxpacket: 8 [ 170.551800][ T48] usb 3-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 170.570130][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.590845][ T48] usb 3-1: config 0 descriptor?? [ 170.760689][ T7107] netlink: 556 bytes leftover after parsing attributes in process `syz.3.290'. [ 171.680152][ T7115] netlink: 'syz.3.293': attribute type 12 has an invalid length. [ 172.146612][ T7123] team0: No ports can be present during mode change [ 172.175848][ T7123] bridge0: entered promiscuous mode [ 172.377910][ T30] audit: type=1326 audit(1766171922.655:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7116 comm="syz.4.295" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9fa3f8f749 code=0x0 [ 172.478256][ T7121] bridge0: left promiscuous mode [ 172.790518][ T5882] usb 3-1: USB disconnect, device number 6 [ 173.148063][ T7127] team0: No ports can be present during mode change [ 173.156056][ T7127] bridge0: entered promiscuous mode [ 173.175223][ T7126] bridge0: left promiscuous mode [ 173.308976][ T30] audit: type=1400 audit(1766171923.585:396): avc: denied { getopt } for pid=7132 comm="syz.0.299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 173.530572][ T7140] netlink: 'syz.2.301': attribute type 10 has an invalid length. [ 173.539246][ T7140] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.546888][ T7140] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.791704][ T7139] netlink: 556 bytes leftover after parsing attributes in process `syz.3.302'. [ 174.927053][ T7158] overlayfs: missing 'lowerdir' [ 176.729923][ T5882] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 177.079544][ T30] audit: type=1400 audit(1766171927.025:397): avc: denied { ioctl } for pid=7176 comm="syz.4.314" path="socket:[14931]" dev="sockfs" ino=14931 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 177.155772][ T30] audit: type=1400 audit(1766171927.075:398): avc: denied { create } for pid=7176 comm="syz.4.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 177.189650][ T30] audit: type=1400 audit(1766171927.085:399): avc: denied { listen } for pid=7176 comm="syz.4.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 177.209297][ T30] audit: type=1400 audit(1766171927.085:400): avc: denied { accept } for pid=7176 comm="syz.4.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 177.261489][ T5882] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 177.271193][ T5882] usb 1-1: config 1 has no interface number 0 [ 177.280198][ T5882] usb 1-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 177.294557][ T7182] netlink: 556 bytes leftover after parsing attributes in process `syz.2.315'. [ 177.301384][ T5882] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 177.314249][ T5882] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 177.327422][ T5882] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 177.340501][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.351030][ T5882] usb 1-1: Product: syz [ 177.355796][ T5882] usb 1-1: Manufacturer: syz [ 177.415057][ T5882] usb 1-1: SerialNumber: syz [ 177.422661][ T7173] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 177.922948][ T7190] overlay: Unknown parameter 'func' [ 179.361356][ T7194] team0: No ports can be present during mode change [ 179.990313][ T7198] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 180.058050][ T30] audit: type=1400 audit(1766171930.325:401): avc: denied { unlink } for pid=7196 comm="syz.2.318" name="#1" dev="tmpfs" ino=393 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 181.455549][ T7210] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 181.461717][ T7210] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 181.468503][ T7210] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 181.474532][ T7210] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 181.480531][ T7210] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 181.662338][ T7226] capability: warning: `syz.1.325' uses 32-bit capabilities (legacy support in use) [ 181.701731][ T5882] usb 1-1: Incompatible driver and firmware versions [ 181.721655][ T5882] usb 1-1: USB disconnect, device number 4 [ 181.739952][ T5915] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 181.788623][ T7228] bridge_slave_0: left allmulticast mode [ 181.802974][ T7230] netlink: 568 bytes leftover after parsing attributes in process `syz.3.326'. [ 181.815760][ T7228] bridge_slave_0: left promiscuous mode [ 181.822732][ T7228] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.851144][ T7228] bridge_slave_1: left allmulticast mode [ 181.857068][ T7228] bridge_slave_1: left promiscuous mode [ 181.870309][ T7228] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.889687][ T7228] bond0: (slave bond_slave_0): Releasing backup interface [ 181.896917][ T5915] usb 3-1: Using ep0 maxpacket: 32 [ 181.918359][ T5915] usb 3-1: unable to get BOS descriptor or descriptor too short [ 181.933193][ T5915] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 181.961606][ T7228] bond0: (slave bond_slave_1): Releasing backup interface [ 181.977846][ T5915] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 181.992362][ T5915] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.036143][ T5915] usb 3-1: Product: syz [ 182.044148][ T7228] team0: Port device team_slave_0 removed [ 182.049970][ T5915] usb 3-1: Manufacturer: syz [ 182.054728][ T5915] usb 3-1: SerialNumber: syz [ 182.072564][ T7228] team0: Port device team_slave_1 removed [ 182.092738][ T7228] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.102155][ T7228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.192700][ T7239] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 182.213913][ T7228] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.236418][ T7228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 182.324934][ T7228] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 182.427842][ T30] audit: type=1400 audit(1766171932.705:402): avc: denied { write } for pid=7214 comm="syz.2.323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 182.472238][ T7233] team0: Mode changed to "loadbalance" [ 182.600594][ T30] audit: type=1400 audit(1766171932.885:403): avc: denied { read } for pid=7241 comm="syz.3.330" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 182.631014][ T30] audit: type=1400 audit(1766171932.915:404): avc: denied { name_bind 0x1000000 } for pid=7241 comm="syz.3.330" path="socket:[15061]" dev="sockfs" ino=15061 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 182.659563][ T5915] usb 3-1: Cannot retrieve CPort count: -71 [ 182.672276][ T5915] usb 3-1: Cannot retrieve CPort count: -71 [ 182.678290][ T5915] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -71 [ 182.704298][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 182.730772][ T5915] usb 3-1: USB disconnect, device number 7 [ 182.743387][ T30] audit: type=1400 audit(1766171932.955:405): avc: denied { ioctl } for pid=7241 comm="syz.3.330" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x700a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 182.961297][ T30] audit: type=1400 audit(1766171933.245:406): avc: denied { bind } for pid=7247 comm="syz.3.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 182.988737][ T7248] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 183.005967][ T7248] xt_TCPMSS: Only works on TCP SYN packets [ 183.016603][ T30] audit: type=1400 audit(1766171933.265:407): avc: denied { listen } for pid=7247 comm="syz.3.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 183.069433][ T30] audit: type=1400 audit(1766171933.265:408): avc: denied { getopt } for pid=7247 comm="syz.3.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 183.123042][ T30] audit: type=1400 audit(1766171933.265:409): avc: denied { append } for pid=7247 comm="syz.3.333" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 183.167811][ T30] audit: type=1400 audit(1766171933.285:410): avc: denied { setopt } for pid=7247 comm="syz.3.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 183.258242][ T7258] netlink: 'syz.4.332': attribute type 1 has an invalid length. [ 183.502636][ T5813] Bluetooth: hci2: command 0x0c1a tx timeout [ 183.508863][ T5136] Bluetooth: hci3: command 0x0c1a tx timeout [ 183.529071][ T7261] netlink: 28 bytes leftover after parsing attributes in process `syz.4.332'. [ 183.529645][ T5815] Bluetooth: hci4: command 0x0c1a tx timeout [ 183.544241][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 183.646550][ T7258] 8021q: adding VLAN 0 to HW filter on device bond1 [ 183.878223][ T7263] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 183.915132][ T7263] bond1: (slave wlan0): Enslaving as an active interface with a down link [ 184.756950][ T7272] netlink: 568 bytes leftover after parsing attributes in process `syz.4.340'. [ 184.790563][ T5918] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 184.896125][ T7278] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 184.927287][ T7274] FAULT_INJECTION: forcing a failure. [ 184.927287][ T7274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.943004][ T7274] CPU: 0 UID: 0 PID: 7274 Comm: syz.1.341 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.943028][ T7274] Tainted: [L]=SOFTLOCKUP [ 184.943033][ T7274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 184.943042][ T7274] Call Trace: [ 184.943047][ T7274] [ 184.943054][ T7274] dump_stack_lvl+0x16c/0x1f0 [ 184.943079][ T7274] should_fail_ex+0x512/0x640 [ 184.943106][ T7274] _copy_from_user+0x2e/0xd0 [ 184.943131][ T7274] __sys_bpf+0x248/0x4980 [ 184.943158][ T7274] ? __pfx___sys_bpf+0x10/0x10 [ 184.943179][ T7274] ? find_held_lock+0x2b/0x80 [ 184.943209][ T7274] ? find_held_lock+0x2b/0x80 [ 184.943239][ T7274] ? __mutex_unlock_slowpath+0x161/0x790 [ 184.943276][ T7274] ? fput+0x70/0xf0 [ 184.943290][ T7274] ? arch_syscall_is_vdso_sigreturn+0xb6/0x230 [ 184.943318][ T7274] ? syscall_user_dispatch+0x78/0x140 [ 184.943346][ T7274] __x64_sys_bpf+0x78/0xc0 [ 184.943370][ T7274] do_syscall_64+0xcd/0xf80 [ 184.943392][ T7274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.943409][ T7274] RIP: 0033:0x7f1ea398f749 [ 184.943422][ T7274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 184.943437][ T7274] RSP: 002b:00007f1ea480e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 184.943454][ T7274] RAX: ffffffffffffffda RBX: 00007f1ea3be5fa0 RCX: 00007f1ea398f749 [ 184.943465][ T7274] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 184.943474][ T7274] RBP: 00007f1ea480e090 R08: 0000000000000000 R09: 0000000000000000 [ 184.943484][ T7274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.943493][ T7274] R13: 00007f1ea3be6038 R14: 00007f1ea3be5fa0 R15: 00007ffc46600958 [ 184.943517][ T7274] [ 185.304380][ T5918] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 185.371875][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.650789][ T5918] usb 3-1: config 0 descriptor?? [ 185.678192][ T5918] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 185.696855][ T7286] netlink: 24 bytes leftover after parsing attributes in process `syz.3.344'. [ 185.840576][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 185.840590][ T30] audit: type=1400 audit(1766171936.125:412): avc: denied { append } for pid=7292 comm="syz.3.346" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 185.889511][ T30] audit: type=1400 audit(1766171936.165:413): avc: denied { map } for pid=7292 comm="syz.3.346" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 185.914824][ T30] audit: type=1400 audit(1766171936.165:414): avc: denied { execute } for pid=7292 comm="syz.3.346" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 185.995789][ T30] audit: type=1326 audit(1766171936.275:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7287 comm="syz.0.345" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f28aff8f749 code=0x0 [ 186.187201][ T7301] team0: No ports can be present during mode change [ 186.198378][ T7301] bridge0: entered promiscuous mode [ 186.359771][ T5918] gp8psk: usb in 137 operation failed. [ 186.366477][ T5918] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 186.467814][ T52] Bluetooth: hci1: unexpected event for opcode 0x1405 [ 186.477069][ T7296] bridge0: left promiscuous mode [ 186.489804][ T5918] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 187.007004][ T30] audit: type=1326 audit(1766171937.275:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7306 comm="syz.1.351" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1ea398f749 code=0x0 [ 187.015105][ T5918] usb 3-1: USB disconnect, device number 8 [ 187.063586][ T7311] netlink: 568 bytes leftover after parsing attributes in process `syz.2.352'. [ 187.528910][ C1] hrtimer: interrupt took 40632 ns [ 187.543636][ T30] audit: type=1400 audit(1766171937.825:417): avc: denied { write } for pid=7314 comm="syz.4.353" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 187.567254][ T7315] random: crng reseeded on system resumption [ 188.421871][ T30] audit: type=1400 audit(1766171937.885:418): avc: denied { bind } for pid=7314 comm="syz.4.353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 188.447581][ T30] audit: type=1400 audit(1766171937.885:419): avc: denied { connect } for pid=7314 comm="syz.4.353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 189.081759][ T7326] mac80211_hwsim hwsim10 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 190.240341][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 190.400601][ T7343] team0: Unable to change to the same mode the team is in [ 190.427493][ T7343] bridge0: entered promiscuous mode [ 190.557713][ T7341] bridge0: left promiscuous mode [ 190.610115][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 190.616764][ T9] usb 2-1: config 0 has an invalid interface number: 193 but max is 1 [ 190.625526][ T9] usb 2-1: config 0 has an invalid interface number: 4 but max is 1 [ 190.635673][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.658603][ T9] usb 2-1: config 0 has no interface number 0 [ 190.671685][ T9] usb 2-1: config 0 has no interface number 1 [ 190.687058][ T9] usb 2-1: config 0 interface 193 altsetting 147 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 190.703866][ T9] usb 2-1: config 0 interface 4 altsetting 2 endpoint 0x6 has invalid wMaxPacketSize 0 [ 190.714158][ T9] usb 2-1: config 0 interface 4 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 190.727279][ T9] usb 2-1: config 0 interface 193 has no altsetting 0 [ 190.740133][ T9] usb 2-1: config 0 interface 4 has no altsetting 0 [ 190.758208][ T9] usb 2-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=7d.6a [ 190.772959][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.784448][ T9] usb 2-1: Product: syz [ 190.790248][ T30] audit: type=1400 audit(1766171941.065:420): avc: denied { create } for pid=7350 comm="syz.3.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 190.811732][ T9] usb 2-1: Manufacturer: syz [ 190.816322][ T9] usb 2-1: SerialNumber: syz [ 190.823007][ T9] usb 2-1: config 0 descriptor?? [ 190.849573][ T7353] netlink: 620 bytes leftover after parsing attributes in process `syz.4.364'. [ 190.996128][ T30] audit: type=1400 audit(1766171941.275:421): avc: denied { read } for pid=7355 comm="syz.4.365" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 191.018908][ T30] audit: type=1400 audit(1766171941.275:422): avc: denied { open } for pid=7355 comm="syz.4.365" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 191.071015][ T7357] input: syz1 as /devices/virtual/input/input9 [ 191.386297][ T7359] bond0: entered promiscuous mode [ 191.392149][ T7359] dummy0: entered promiscuous mode [ 191.398198][ T7359] debugfs: 'hsr1' already exists in 'hsr' [ 191.403942][ T7359] Cannot create hsr debugfs directory [ 191.409366][ T7359] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 191.419209][ T7359] hsr1: entered promiscuous mode [ 191.433579][ T7359] hsr1: entered allmulticast mode [ 191.438602][ T7359] bond0: entered allmulticast mode [ 191.443699][ T7359] dummy0: entered allmulticast mode [ 191.990501][ T7360] FAULT_INJECTION: forcing a failure. [ 191.990501][ T7360] name failslab, interval 1, probability 0, space 0, times 0 [ 192.003339][ T7360] CPU: 1 UID: 0 PID: 7360 Comm: syz.0.366 Tainted: G L syzkaller #0 PREEMPT(full) [ 192.003368][ T7360] Tainted: [L]=SOFTLOCKUP [ 192.003373][ T7360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 192.003381][ T7360] Call Trace: [ 192.003385][ T7360] [ 192.003389][ T7360] dump_stack_lvl+0x16c/0x1f0 [ 192.003406][ T7360] should_fail_ex+0x512/0x640 [ 192.003422][ T7360] ? kmem_cache_alloc_lru_noprof+0x66/0x770 [ 192.003435][ T7360] should_failslab+0xc2/0x120 [ 192.003456][ T7360] kmem_cache_alloc_lru_noprof+0x87/0x770 [ 192.003471][ T7360] ? __d_lookup+0x25c/0x4a0 [ 192.003489][ T7360] ? __d_alloc+0x35/0xa80 [ 192.003507][ T7360] ? __d_alloc+0x35/0xa80 [ 192.003518][ T7360] __d_alloc+0x35/0xa80 [ 192.003530][ T7360] d_alloc+0x4a/0x1e0 [ 192.003539][ T7360] lookup_one_qstr_excl+0x175/0x250 [ 192.003551][ T7360] start_dirop+0x59/0xb0 [ 192.003565][ T7360] simple_start_creating+0xf4/0x100 [ 192.003580][ T7360] ? __pfx_simple_start_creating+0x10/0x10 [ 192.003597][ T7360] ? do_raw_spin_unlock+0x172/0x230 [ 192.003620][ T7360] ? simple_pin_fs+0xa3/0x190 [ 192.003639][ T7360] debugfs_start_creating.part.0+0x86/0x1c0 [ 192.003656][ T7360] __debugfs_create_file+0xb3/0x530 [ 192.003672][ T7360] debugfs_create_file_full+0x41/0x60 [ 192.003683][ T7360] ? __pfx_tun_setup+0x10/0x10 [ 192.003696][ T7360] ref_tracker_dir_debugfs+0x19d/0x2f0 [ 192.003712][ T7360] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 192.003747][ T7360] ? avc_has_perm+0x144/0x1f0 [ 192.003769][ T7360] ? alloc_netdev_mqs+0xd7/0x1550 [ 192.003787][ T7360] ? lockdep_init_map_type+0x5c/0x270 [ 192.003808][ T7360] alloc_netdev_mqs+0x314/0x1550 [ 192.003824][ T7360] __tun_chr_ioctl+0x193e/0x4880 [ 192.003838][ T7360] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 192.003852][ T7360] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 192.003868][ T7360] ? hook_file_ioctl_common+0x144/0x410 [ 192.003896][ T7360] ? selinux_file_ioctl+0x180/0x270 [ 192.003915][ T7360] ? selinux_file_ioctl+0xb4/0x270 [ 192.003935][ T7360] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 192.003956][ T7360] __x64_sys_ioctl+0x18e/0x210 [ 192.003969][ T7360] do_syscall_64+0xcd/0xf80 [ 192.003984][ T7360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.003994][ T7360] RIP: 0033:0x7f28aff8f749 [ 192.004003][ T7360] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 192.004012][ T7360] RSP: 002b:00007f28b0dc1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 192.004025][ T7360] RAX: ffffffffffffffda RBX: 00007f28b01e5fa0 RCX: 00007f28aff8f749 [ 192.004035][ T7360] RDX: 00002000000000c0 RSI: 00000000400454ca RDI: 0000000000000009 [ 192.004045][ T7360] RBP: 00007f28b0dc1090 R08: 0000000000000000 R09: 0000000000000000 [ 192.004053][ T7360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.004062][ T7360] R13: 00007f28b01e6038 R14: 00007f28b01e5fa0 R15: 00007ffc72f19258 [ 192.004085][ T7360] [ 192.472624][ T9] usb 2-1: unknown interface protocol 0x4f, assuming v1 [ 192.479711][ T9] usb 2-1: 193:2 : does not exist [ 192.493315][ T30] audit: type=1400 audit(1766171941.285:423): avc: denied { ioctl } for pid=7355 comm="syz.4.365" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 192.532651][ T3533] wlan1: Trigger new scan to find an IBSS to join [ 192.540755][ T9] usb 2-1: unknown interface protocol 0x5, assuming v1 [ 192.547586][ T9] usb 2-1: 4:2 : does not exist [ 192.645024][ T9] usb 2-1: USB disconnect, device number 5 [ 192.774862][ T30] audit: type=1400 audit(1766171943.055:424): avc: denied { write } for pid=7350 comm="syz.3.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 192.795876][ T5882] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 192.833358][ T7357] gretap1: entered allmulticast mode [ 192.953968][ T5882] usb 5-1: Using ep0 maxpacket: 8 [ 192.960638][ T5882] usb 5-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 192.969717][ T5882] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.088703][ T5882] usb 5-1: config 0 descriptor?? [ 193.280085][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 193.492354][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.509704][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 193.769825][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.776481][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.921347][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 193.931153][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 194.012216][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 194.060083][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.098099][ T7384] netlink: 'syz.3.372': attribute type 10 has an invalid length. [ 194.106753][ T7384] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.114065][ T7384] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.143802][ T7384] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.150939][ T7384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.158281][ T7384] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.165382][ T7384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.186369][ T9] usb 2-1: config 0 descriptor?? [ 194.248113][ T7384] bridge0: entered promiscuous mode [ 194.255159][ T7384] bridge0: entered allmulticast mode [ 194.268223][ T7384] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 194.452429][ T5916] usb 5-1: USB disconnect, device number 6 [ 194.667724][ T30] audit: type=1400 audit(1766171944.945:425): avc: denied { create } for pid=7371 comm="syz.2.369" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 195.298948][ T793] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 195.448277][ T7396] netlink: 620 bytes leftover after parsing attributes in process `syz.3.375'. [ 195.473895][ T793] usb 1-1: Using ep0 maxpacket: 32 [ 195.493650][ T793] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 195.516368][ T793] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 195.709990][ T793] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 195.719993][ T793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.727994][ T793] usb 1-1: Product: syz [ 195.744939][ T793] usb 1-1: Manufacturer: syz [ 195.754466][ T793] usb 1-1: SerialNumber: syz [ 195.759454][ T30] audit: type=1400 audit(1766171946.035:426): avc: denied { create } for pid=7398 comm="syz.3.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 195.786096][ T793] usb 1-1: config 0 descriptor?? [ 195.796612][ T7399] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.820159][ T30] audit: type=1400 audit(1766171946.065:427): avc: denied { ioctl } for pid=7398 comm="syz.3.376" path="socket:[16304]" dev="sockfs" ino=16304 ioctlcmd=0x8990 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 196.052246][ T7399] bond0: (slave rose0): Enslaving as an active interface with an up link [ 196.103878][ T30] audit: type=1400 audit(1766171946.385:428): avc: denied { bind } for pid=7398 comm="syz.3.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 196.192601][ T793] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 196.193649][ T7368] usb 1-1: Failed to submit usb control message: -71 [ 196.232501][ T7368] usb 1-1: unable to send the bmi data to the device: -71 [ 196.239622][ T7368] usb 1-1: unable to get target info from device [ 196.249931][ T7368] usb 1-1: could not get target info (-71) [ 196.256344][ T7368] usb 1-1: could not probe fw (-71) [ 196.300030][ T793] usb 1-1: USB disconnect, device number 5 [ 196.307553][ T7381] usb 2-1: USB disconnect, device number 6 [ 196.315142][ T30] audit: type=1400 audit(1766171946.515:429): avc: denied { connect } for pid=7398 comm="syz.3.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 196.316653][ T4302] wlan1: Trigger new scan to find an IBSS to join [ 196.442452][ T30] audit: type=1400 audit(1766171946.515:430): avc: denied { write } for pid=7398 comm="syz.3.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 196.589525][ T30] audit: type=1400 audit(1766171946.865:431): avc: denied { unlink } for pid=5811 comm="syz-executor" name="file0" dev="tmpfs" ino=433 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 196.734109][ T7423] fuse: Unknown parameter 'gsoupidc00000000000000000000' [ 197.263330][ T793] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 197.566879][ T30] audit: type=1400 audit(1766171947.845:432): avc: denied { ioctl } for pid=7436 comm="syz.3.384" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 197.698942][ T793] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.737371][ T793] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.757527][ T30] audit: type=1400 audit(1766171948.035:433): avc: denied { lock } for pid=7397 comm="syz.4.377" path="socket:[16539]" dev="sockfs" ino=16539 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 197.786122][ T793] usb 3-1: New USB device found, idVendor=1b1c, idProduct=0a14, bcdDevice= 0.00 [ 197.796359][ T793] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.816593][ T7368] wlan1: Creating new IBSS network, BSSID aa:a8:54:fd:ee:3b [ 197.854123][ T793] usb 3-1: config 0 descriptor?? [ 198.065221][ T30] audit: type=1400 audit(1766171948.345:434): avc: denied { mounton } for pid=7397 comm="syz.4.377" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 198.090045][ T7400] /dev/sg0: Can't lookup blockdev [ 198.449318][ T793] hid-corsair-void 0003:1B1C:0A14.0005: hidraw0: USB HID v0.00 Device [HID 1b1c:0a14] on usb-dummy_hcd.2-1/input0 [ 198.752840][ T7381] hid-corsair-void 0003:1B1C:0A14.0005: failed to request battery (reason: -71) [ 198.753083][ T6542] usb 3-1: USB disconnect, device number 9 [ 198.762254][ T793] hid-corsair-void 0003:1B1C:0A14.0005: failed to request firmware (reason: -71) [ 199.404341][ T7459] netlink: 620 bytes leftover after parsing attributes in process `syz.0.386'. [ 199.750703][ T30] audit: type=1326 audit(1766171950.035:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7464 comm="syz.4.389" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9fa3f8f749 code=0x0 [ 199.799498][ T30] audit: type=1400 audit(1766171950.075:436): avc: denied { write } for pid=7469 comm="syz.2.388" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 200.651603][ T30] audit: type=1400 audit(1766171950.935:437): avc: denied { append } for pid=7487 comm="syz.4.393" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 201.241692][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 201.241706][ T30] audit: type=1400 audit(1766171951.525:441): avc: denied { write } for pid=7497 comm="syz.2.395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 201.340060][ T5918] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 201.519977][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 201.651255][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.660558][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 203.509098][ T5918] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 203.654995][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.754610][ T5918] usb 2-1: config 0 descriptor?? [ 203.798987][ T5918] hub 2-1:0.0: USB hub found [ 203.885755][ T7525] process 'syz.2.399' launched './file0' with NULL argv: empty string added [ 203.912709][ T30] audit: type=1400 audit(1766171954.195:442): avc: denied { execute_no_trans } for pid=7523 comm="syz.2.399" path="/78/file0" dev="tmpfs" ino=464 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 204.030288][ T5918] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 204.070549][ T5918] usbhid 2-1:0.0: can't add hid device: -71 [ 204.268193][ T5918] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 204.316498][ T5918] usb 2-1: USB disconnect, device number 7 [ 204.578461][ T7546] batadv_slave_0: entered promiscuous mode [ 204.617679][ T7546] batman_adv: batadv0: Adding interface: macvtap1 [ 204.639440][ T7546] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 204.769973][ T7546] batman_adv: batadv0: Interface activated: macvtap1 [ 205.141817][ T30] audit: type=1400 audit(1766171955.425:443): avc: denied { connect } for pid=7554 comm="syz.0.411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 205.196803][ T7563] netlink: 36 bytes leftover after parsing attributes in process `syz.4.412'. [ 205.274789][ T7563] netlink: 16 bytes leftover after parsing attributes in process `syz.4.412'. [ 205.329740][ T7563] netlink: 36 bytes leftover after parsing attributes in process `syz.4.412'. [ 205.486083][ T7563] netlink: 36 bytes leftover after parsing attributes in process `syz.4.412'. [ 205.921518][ T793] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 206.069921][ T793] usb 1-1: device descriptor read/64, error -71 [ 206.389913][ T793] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 207.360700][ T793] usb 1-1: device descriptor read/64, error -71 [ 207.470274][ T793] usb usb1-port1: attempt power cycle [ 207.509907][ T6108] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 207.689915][ T6108] usb 4-1: Using ep0 maxpacket: 8 [ 207.696488][ T6108] usb 4-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 207.708613][ T6108] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.731882][ T6108] usb 4-1: config 0 descriptor?? [ 207.889900][ T793] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 208.262284][ T793] usb 1-1: device not accepting address 8, error -71 [ 208.388882][ T7597] Bluetooth: MGMT ver 1.23 [ 208.610746][ T7601] team0: No ports can be present during mode change [ 209.526169][ T10] usb 4-1: USB disconnect, device number 7 [ 209.657615][ T7615] netlink: 'syz.4.426': attribute type 10 has an invalid length. [ 209.667720][ T7615] netlink: 40 bytes leftover after parsing attributes in process `syz.4.426'. [ 209.685105][ T7615] batadv0: entered promiscuous mode [ 209.788378][ T7615] batadv0: entered allmulticast mode [ 209.978981][ T7615] bridge0: port 1(batadv0) entered blocking state [ 210.002497][ T30] audit: type=1400 audit(1766171960.275:444): avc: denied { read write } for pid=7616 comm="syz.3.427" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 210.064841][ T7615] bridge0: port 1(batadv0) entered disabled state [ 210.116883][ T30] audit: type=1400 audit(1766171960.305:445): avc: denied { open } for pid=7616 comm="syz.3.427" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 210.119824][ T7615] bridge0: port 1(batadv0) entered blocking state [ 210.148494][ T7615] bridge0: port 1(batadv0) entered forwarding state [ 210.381793][ T49] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 210.391266][ T49] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 210.427256][ T7625] Unsupported ieee802154 address type: 0 [ 212.392611][ T6542] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 212.541153][ T30] audit: type=1400 audit(1766171962.825:446): avc: denied { ioctl } for pid=7647 comm="syz.1.436" path="/dev/input/mouse0" dev="devtmpfs" ino=1017 ioctlcmd=0xaf02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 212.580080][ T6542] usb 5-1: Using ep0 maxpacket: 8 [ 212.597438][ T6542] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 212.619434][ T6542] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 212.680180][ T6542] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 212.726682][ T6542] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 212.747771][ T6542] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 212.801707][ T6542] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 213.450781][ T6542] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.709049][ T6542] usb 5-1: GET_CAPABILITIES returned 0 [ 213.726657][ T6542] usbtmc 5-1:16.0: can't read capabilities [ 215.370448][ T7667] team0: No ports can be present during mode change [ 216.270253][ T7684] CIFS: Unable to determine destination address [ 216.386163][ T5882] usb 5-1: USB disconnect, device number 7 [ 217.273630][ T30] audit: type=1400 audit(1766171967.545:447): avc: denied { write } for pid=7703 comm="syz.3.449" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 217.671384][ T30] audit: type=1400 audit(1766171967.555:448): avc: denied { read } for pid=7703 comm="syz.3.449" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 217.813444][ T30] audit: type=1400 audit(1766171967.555:449): avc: denied { open } for pid=7703 comm="syz.3.449" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 217.942149][ T30] audit: type=1400 audit(1766171967.835:450): avc: denied { mounton } for pid=7705 comm="syz.4.448" path="/95/bus" dev="tmpfs" ino=528 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 218.031428][ T30] audit: type=1400 audit(1766171967.835:451): avc: denied { unlink } for pid=7705 comm="syz.4.448" name="#3" dev="tmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 218.089922][ T30] audit: type=1400 audit(1766171967.835:452): avc: denied { mount } for pid=7705 comm="syz.4.448" name="/" dev="overlay" ino=527 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 218.137775][ T30] audit: type=1400 audit(1766171967.905:453): avc: denied { read write } for pid=7705 comm="syz.4.448" name="vhost-net" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 223.396815][ T30] audit: type=1400 audit(1766171967.915:454): avc: denied { open } for pid=7705 comm="syz.4.448" path="/dev/vhost-net" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 223.423324][ T30] audit: type=1400 audit(1766171967.915:455): avc: denied { ioctl } for pid=7705 comm="syz.4.448" path="/dev/vhost-net" dev="devtmpfs" ino=1274 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 223.450070][ T30] audit: type=1400 audit(1766171968.045:456): avc: denied { ioctl } for pid=7698 comm="syz.0.445" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=17843 ioctlcmd=0xaa06 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 223.476672][ T30] audit: type=1400 audit(1766171968.055:457): avc: denied { search } for pid=7707 comm="rm" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.497930][ T30] audit: type=1400 audit(1766171968.055:458): avc: denied { search } for pid=7707 comm="rm" name="dhcpcd" dev="tmpfs" ino=1831 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.519719][ T30] audit: type=1400 audit(1766171968.055:459): avc: denied { search } for pid=7707 comm="rm" name="hook-state" dev="tmpfs" ino=1835 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.619162][ T30] audit: type=1400 audit(1766171968.055:460): avc: denied { getattr } for pid=7707 comm="rm" path="/run/dhcpcd/hook-state/resolv.conf.bond0.ipv4ll" dev="tmpfs" ino=3484 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 223.689272][ T30] audit: type=1400 audit(1766171968.065:461): avc: denied { remove_name } for pid=7707 comm="rm" name="resolv.conf.bond0.ipv4ll" dev="tmpfs" ino=3484 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.718398][ T7740] syzkaller0: entered promiscuous mode [ 223.723868][ T7740] syzkaller0: entered allmulticast mode [ 223.731512][ T7740] 0: reclassify loop, rule prio 0, protocol 700 [ 223.743445][ T30] audit: type=1400 audit(1766171968.065:462): avc: denied { unlink } for pid=7707 comm="rm" name="resolv.conf.bond0.ipv4ll" dev="tmpfs" ino=3484 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 223.768774][ T30] audit: type=1400 audit(1766171968.075:463): avc: denied { write } for pid=7698 comm="syz.0.445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 223.827023][ T7381] libceph: connect (1)[c::]:6789 error -101 [ 223.837072][ T7381] libceph: mon0 (1)[c::]:6789 connect error [ 223.960575][ T7381] libceph: connect (1)[c::]:6789 error -101 [ 223.966707][ T7381] libceph: mon0 (1)[c::]:6789 connect error [ 223.980174][ T793] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 224.081158][ T7743] ceph: No mds server is up or the cluster is laggy [ 224.139963][ T793] usb 2-1: device descriptor read/64, error -71 [ 224.240918][ T10] libceph: connect (1)[c::]:6789 error -101 [ 224.247595][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 224.352523][ T7381] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 224.492951][ T793] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 224.520336][ T7381] usb 4-1: Using ep0 maxpacket: 8 [ 224.528113][ T7381] usb 4-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 224.600806][ T7758] IPVS: set_ctl: invalid protocol: 135 172.20.20.45:21 [ 224.615770][ T7758] IPVS: set_ctl: invalid protocol: 33 224.0.0.1:20000 [ 225.022703][ T793] usb 2-1: device descriptor read/64, error -71 [ 225.049474][ T7381] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.386774][ T793] usb usb2-port1: attempt power cycle [ 225.565848][ T7381] usb 4-1: config 0 descriptor?? [ 225.820354][ T793] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 225.922769][ T793] usb 2-1: device descriptor read/8, error -71 [ 225.943044][ T7757] team0: No ports can be present during mode change [ 226.289944][ T793] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 226.310301][ T793] usb 2-1: device descriptor read/8, error -71 [ 226.420424][ T793] usb usb2-port1: unable to enumerate USB device [ 226.449905][ T7381] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 226.622838][ T7381] usb 3-1: config 27 interface 0 altsetting 0 has an endpoint descriptor with address 0x98, changing to 0x88 [ 226.634476][ T7381] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 226.645583][ T7381] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x88 has invalid maxpacket 127, setting to 64 [ 226.662728][ T7381] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 10 [ 226.686735][ T7381] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 255, setting to 64 [ 226.705251][ T7381] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 226.714367][ T7381] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.726862][ T7773] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 226.734386][ T7773] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 226.744981][ T7381] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 226.851506][ T7381] usb 4-1: USB disconnect, device number 8 [ 227.216786][ T5916] usb 3-1: USB disconnect, device number 10 [ 227.229934][ T7777] team0: No ports can be present during mode change [ 227.874400][ T7789] CIFS: Unable to determine destination address [ 227.880863][ T7789] FAULT_INJECTION: forcing a failure. [ 227.880863][ T7789] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 227.894995][ T7789] CPU: 0 UID: 0 PID: 7789 Comm: syz.1.470 Tainted: G L syzkaller #0 PREEMPT(full) [ 227.895017][ T7789] Tainted: [L]=SOFTLOCKUP [ 227.895022][ T7789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 227.895031][ T7789] Call Trace: [ 227.895036][ T7789] [ 227.895042][ T7789] dump_stack_lvl+0x16c/0x1f0 [ 227.895067][ T7789] should_fail_ex+0x512/0x640 [ 227.895096][ T7789] _copy_to_user+0x32/0xd0 [ 227.895128][ T7789] simple_read_from_buffer+0xcb/0x170 [ 227.895152][ T7789] proc_fail_nth_read+0x197/0x240 [ 227.895168][ T7789] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 227.895185][ T7789] ? rw_verify_area+0xcf/0x6c0 [ 227.895201][ T7789] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 227.895216][ T7789] vfs_read+0x1e4/0xcf0 [ 227.895235][ T7789] ? __pfx___mutex_lock+0x10/0x10 [ 227.895258][ T7789] ? __pfx_vfs_read+0x10/0x10 [ 227.895282][ T7789] ? __fget_files+0x20e/0x3c0 [ 227.895312][ T7789] ksys_read+0x12a/0x250 [ 227.895332][ T7789] ? __pfx_ksys_read+0x10/0x10 [ 227.895359][ T7789] do_syscall_64+0xcd/0xf80 [ 227.895380][ T7789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.895397][ T7789] RIP: 0033:0x7f1ea398e15c [ 227.895411][ T7789] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 227.895426][ T7789] RSP: 002b:00007f1ea47ed030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 227.895442][ T7789] RAX: ffffffffffffffda RBX: 00007f1ea3be6090 RCX: 00007f1ea398e15c [ 227.895452][ T7789] RDX: 000000000000000f RSI: 00007f1ea47ed0a0 RDI: 0000000000000006 [ 227.895462][ T7789] RBP: 00007f1ea47ed090 R08: 0000000000000000 R09: 0000000000000000 [ 227.895471][ T7789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 227.895481][ T7789] R13: 00007f1ea3be6128 R14: 00007f1ea3be6090 R15: 00007ffc46600958 [ 227.895505][ T7789] [ 228.356061][ T7381] libceph: connect (1)[c::]:6789 error -101 [ 228.363170][ T7381] libceph: mon0 (1)[c::]:6789 connect error [ 228.435334][ T30] kauditd_printk_skb: 71 callbacks suppressed [ 228.435349][ T30] audit: type=1400 audit(1766171978.715:535): avc: denied { map } for pid=7794 comm="syz.3.471" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 228.480350][ T7796] ceph: No mds server is up or the cluster is laggy [ 228.539958][ T30] audit: type=1400 audit(1766171978.745:536): avc: denied { write } for pid=7794 comm="syz.3.471" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 228.651242][ T30] audit: type=1400 audit(1766171978.935:537): avc: denied { create } for pid=7812 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 228.678255][ T30] audit: type=1400 audit(1766171978.955:538): avc: denied { connect } for pid=7812 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 228.678936][ T30] audit: type=1400 audit(1766171978.955:539): avc: denied { setopt } for pid=7812 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 228.679483][ T30] audit: type=1400 audit(1766171978.955:540): avc: denied { create } for pid=7812 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 228.683671][ T30] audit: type=1400 audit(1766171978.965:541): avc: denied { create } for pid=7812 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 229.631432][ T30] audit: type=1400 audit(1766171979.905:542): avc: denied { map } for pid=7820 comm="syz.1.478" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 229.690776][ T30] audit: type=1400 audit(1766171979.905:543): avc: denied { execute } for pid=7820 comm="syz.1.478" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 229.836456][ T30] audit: type=1400 audit(1766171979.905:544): avc: denied { create } for pid=7820 comm="syz.1.478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 230.018444][ T7833] ip6gretap0: entered promiscuous mode [ 230.024212][ T7833] vlan2: entered promiscuous mode [ 230.673406][ T7836] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nullb0": -EINTR [ 230.935375][ T7826] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.473'. [ 231.018992][ T49] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 231.695711][ T7854] team0: No ports can be present during mode change [ 233.485027][ T7893] FAULT_INJECTION: forcing a failure. [ 233.485027][ T7893] name failslab, interval 1, probability 0, space 0, times 0 [ 233.490860][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 233.490872][ T30] audit: type=1400 audit(1766171983.775:580): avc: denied { add_name } for pid=7861 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 233.534740][ T7893] CPU: 0 UID: 0 PID: 7893 Comm: syz.4.491 Tainted: G L syzkaller #0 PREEMPT(full) [ 233.534766][ T7893] Tainted: [L]=SOFTLOCKUP [ 233.534773][ T7893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 233.534783][ T7893] Call Trace: [ 233.534788][ T7893] [ 233.534795][ T7893] dump_stack_lvl+0x16c/0x1f0 [ 233.534821][ T7893] should_fail_ex+0x512/0x640 [ 233.534843][ T7893] ? kmem_cache_alloc_node_noprof+0x65/0x800 [ 233.534863][ T7893] should_failslab+0xc2/0x120 [ 233.534886][ T7893] kmem_cache_alloc_node_noprof+0x86/0x800 [ 233.534904][ T7893] ? __alloc_skb+0x156/0x410 [ 233.534933][ T7893] ? __alloc_skb+0x156/0x410 [ 233.534955][ T7893] __alloc_skb+0x156/0x410 [ 233.534977][ T7893] ? __alloc_skb+0x35d/0x410 [ 233.534999][ T7893] ? __pfx___alloc_skb+0x10/0x10 [ 233.535024][ T7893] ? netlink_autobind.isra.0+0x158/0x370 [ 233.535052][ T7893] netlink_alloc_large_skb+0x69/0x140 [ 233.535073][ T7893] netlink_sendmsg+0x698/0xdd0 [ 233.535097][ T7893] ? __pfx_netlink_sendmsg+0x10/0x10 [ 233.535126][ T7893] ____sys_sendmsg+0xa5d/0xc30 [ 233.535148][ T7893] ? copy_msghdr_from_user+0x10a/0x160 [ 233.535164][ T7893] ? __pfx_____sys_sendmsg+0x10/0x10 [ 233.535196][ T7893] ___sys_sendmsg+0x134/0x1d0 [ 233.535214][ T7893] ? __pfx____sys_sendmsg+0x10/0x10 [ 233.535260][ T7893] __sys_sendmsg+0x16d/0x220 [ 233.535278][ T7893] ? __pfx___sys_sendmsg+0x10/0x10 [ 233.535310][ T7893] do_syscall_64+0xcd/0xf80 [ 233.535333][ T7893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.535356][ T7893] RIP: 0033:0x7f9fa3f8f749 [ 233.535369][ T7893] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 233.535385][ T7893] RSP: 002b:00007f9fa4da4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 233.535401][ T7893] RAX: ffffffffffffffda RBX: 00007f9fa41e5fa0 RCX: 00007f9fa3f8f749 [ 233.535412][ T7893] RDX: 0000000020004800 RSI: 0000200000006040 RDI: 0000000000000006 [ 233.535421][ T7893] RBP: 00007f9fa4da4090 R08: 0000000000000000 R09: 0000000000000000 [ 233.535431][ T7893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.535440][ T7893] R13: 00007f9fa41e6038 R14: 00007f9fa41e5fa0 R15: 00007fffee82e2f8 [ 233.535463][ T7893] [ 233.779898][ T30] audit: type=1400 audit(1766171983.805:581): avc: denied { create } for pid=7861 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 233.812646][ T30] audit: type=1400 audit(1766171983.805:582): avc: denied { write } for pid=7861 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.sl0.link" dev="tmpfs" ino=3591 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 233.839247][ T30] audit: type=1400 audit(1766171983.805:583): avc: denied { append } for pid=7861 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" dev="tmpfs" ino=3591 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 233.863934][ T30] audit: type=1400 audit(1766171983.805:584): avc: denied { ioctl } for pid=7889 comm="syz.1.492" path="socket:[18249]" dev="sockfs" ino=18249 ioctlcmd=0x943d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 233.893024][ T7894] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 233.902581][ T7894] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 233.930011][ T30] audit: type=1400 audit(1766171984.185:585): avc: denied { firmware_load } for pid=7889 comm="syz.1.492" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 234.077469][ T7902] netlink: 'syz.2.494': attribute type 10 has an invalid length. [ 234.589112][ T30] audit: type=1400 audit(1766171984.865:586): avc: denied { getopt } for pid=7906 comm="syz.4.496" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 234.626520][ T10] libceph: connect (1)[c::]:6789 error -101 [ 234.632548][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 234.660031][ T7905] netlink: 'syz.1.497': attribute type 10 has an invalid length. [ 234.704147][ T7908] ceph: No mds server is up or the cluster is laggy [ 234.887024][ T30] audit: type=1400 audit(1766171985.165:587): avc: denied { create } for pid=7924 comm="syz.2.498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 235.916621][ T30] audit: type=1400 audit(1766171985.415:588): avc: denied { read } for pid=7923 comm="syz.1.500" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 236.049940][ T30] audit: type=1400 audit(1766171985.415:589): avc: denied { open } for pid=7923 comm="syz.1.500" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 236.511232][ T10] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 236.712584][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 236.720694][ T10] usb 3-1: config 0 has no interface number 0 [ 236.726876][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 236.738281][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.592446][ T10] usb 3-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 237.601533][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.612199][ T10] usb 3-1: config 0 descriptor?? [ 237.822155][ T7955] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 237.828298][ T7955] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 237.834375][ T7955] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 237.840460][ T7955] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 237.846466][ T7955] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 237.950032][ T7962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.509'. [ 238.027666][ T7964] FAULT_INJECTION: forcing a failure. [ 238.027666][ T7964] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 238.054773][ T7964] CPU: 1 UID: 0 PID: 7964 Comm: syz.3.511 Tainted: G L syzkaller #0 PREEMPT(full) [ 238.054801][ T7964] Tainted: [L]=SOFTLOCKUP [ 238.054806][ T7964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 238.054816][ T7964] Call Trace: [ 238.054822][ T7964] [ 238.054830][ T7964] dump_stack_lvl+0x16c/0x1f0 [ 238.054856][ T7964] should_fail_ex+0x512/0x640 [ 238.054885][ T7964] _copy_from_iter+0x2a4/0x16c0 [ 238.054916][ T7964] ? __pfx__copy_from_iter+0x10/0x10 [ 238.054940][ T7964] ? rcu_is_watching+0x12/0xc0 [ 238.054957][ T7964] ? trace_kmalloc+0x2b/0xb0 [ 238.054977][ T7964] ? __kmalloc_noprof+0x35d/0x910 [ 238.055003][ T7964] ? kernfs_fop_write_iter+0x237/0x570 [ 238.055034][ T7964] kernfs_fop_write_iter+0x19a/0x570 [ 238.055062][ T7964] vfs_write+0x7d3/0x11d0 [ 238.055085][ T7964] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 238.055113][ T7964] ? __pfx_vfs_write+0x10/0x10 [ 238.055150][ T7964] ksys_write+0x12a/0x250 [ 238.055176][ T7964] ? __pfx_ksys_write+0x10/0x10 [ 238.055204][ T7964] do_syscall_64+0xcd/0xf80 [ 238.055227][ T7964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.055244][ T7964] RIP: 0033:0x7f2dc018f749 [ 238.055257][ T7964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 238.055273][ T7964] RSP: 002b:00007f2dc104f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 238.055290][ T7964] RAX: ffffffffffffffda RBX: 00007f2dc03e5fa0 RCX: 00007f2dc018f749 [ 238.055301][ T7964] RDX: 000000000000006a RSI: 00002000000000c0 RDI: 0000000000000005 [ 238.055311][ T7964] RBP: 00007f2dc104f090 R08: 0000000000000000 R09: 0000000000000000 [ 238.055321][ T7964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.055330][ T7964] R13: 00007f2dc03e6038 R14: 00007f2dc03e5fa0 R15: 00007ffce82460b8 [ 238.055356][ T7964] [ 238.057418][ T7966] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 238.263708][ T10] usbhid 3-1:0.1: can't add hid device: -71 [ 238.269661][ T10] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 238.302025][ T10] usb 3-1: USB disconnect, device number 11 [ 238.457505][ T7976] overlayfs: failed to resolve './file1': -2 [ 239.000510][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 239.000525][ T30] audit: type=1400 audit(1766171989.285:595): avc: denied { connect } for pid=7974 comm="syz.4.514" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 239.059892][ T5881] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 239.172550][ T7989] geneve2: entered promiscuous mode [ 239.198706][ T30] audit: type=1400 audit(1766171989.305:596): avc: denied { ioctl } for pid=7974 comm="syz.4.514" path="socket:[19116]" dev="sockfs" ino=19116 ioctlcmd=0xb100 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 239.288155][ T30] audit: type=1400 audit(1766171989.305:597): avc: denied { map } for pid=7974 comm="syz.4.514" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 239.364262][ T5881] usb 2-1: Using ep0 maxpacket: 8 [ 239.378077][ T5881] usb 2-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 239.387449][ T5881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.672414][ T5881] usb 2-1: config 0 descriptor?? [ 239.743577][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 239.903123][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 239.903173][ T5136] Bluetooth: hci4: command 0x0c1a tx timeout [ 239.910650][ T5813] Bluetooth: hci3: command 0x0c1a tx timeout [ 239.915338][ T5815] Bluetooth: hci2: command 0x0c1a tx timeout [ 240.562508][ T7997] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 240.569285][ T7997] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 240.575326][ T7997] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 240.581366][ T7997] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 240.587360][ T7997] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 241.060346][ T5881] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 241.272925][ T5881] usb 4-1: device descriptor read/64, error -71 [ 241.476907][ T90] usb 2-1: USB disconnect, device number 12 [ 242.329932][ T5881] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 242.389966][ T5813] Bluetooth: hci0: command 0x0c1a tx timeout [ 242.479930][ T5881] usb 4-1: device descriptor read/64, error -71 [ 242.559996][ T30] audit: type=1400 audit(1766171992.835:598): avc: denied { append } for pid=8022 comm="syz.0.527" name="comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 242.801147][ T5815] Bluetooth: hci4: command 0x0c1a tx timeout [ 243.261156][ T5815] Bluetooth: hci3: command 0x0c1a tx timeout [ 243.261191][ T5815] Bluetooth: hci2: command 0x0c1a tx timeout [ 243.261214][ T5815] Bluetooth: hci1: command 0x0c1a tx timeout [ 243.263086][ T5881] usb usb4-port1: attempt power cycle [ 243.349930][ T30] audit: type=1400 audit(1766171993.255:599): avc: denied { create } for pid=8022 comm="syz.0.527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 243.349978][ T30] audit: type=1400 audit(1766171993.385:600): avc: denied { connect } for pid=8022 comm="syz.0.527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 243.635911][ T5881] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 243.652439][ T5881] usb 4-1: device descriptor read/8, error -71 [ 352.469884][ C0] ------------[ cut here ]------------ [ 352.475997][ C0] WARNING: kernel/rcu/tree_stall.h:1049 at rcu_check_gp_start_stall.part.0+0x1c4/0x4b0, CPU#0: vhost-8027/8031 [ 352.487700][ C0] Modules linked in: [ 352.491834][ C0] CPU: 0 UID: 0 PID: 8031 Comm: vhost-8027 Tainted: G L syzkaller #0 PREEMPT(full) [ 352.502662][ C0] Tainted: [L]=SOFTLOCKUP [ 352.506954][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 352.516977][ C0] RIP: 0010:rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 352.523912][ C0] Code: 88 61 01 00 00 be 04 00 00 00 48 c7 c7 c0 52 c2 9a e8 b0 3a 85 00 b8 01 00 00 00 87 05 05 c5 1e 19 85 c0 0f 85 3d 01 00 00 90 <0f> 0b 90 48 c7 c3 74 e4 88 90 48 81 fd 00 46 3d 8e 74 5a 48 b8 00 [ 352.543485][ C0] RSP: 0018:ffffc90000007df0 EFLAGS: 00010046 [ 352.549520][ C0] RAX: 0000000000000000 RBX: 0000000000002904 RCX: ffffffff81a38db0 [ 352.557459][ C0] RDX: fffffbfff3584a58 RSI: 0000000000000004 RDI: ffffffff9ac252c0 [ 352.565395][ C0] RBP: ffffffff8e3d4600 R08: 0000000000000001 R09: fffffbfff3584a58 [ 352.573334][ C0] R10: 0000000000000003 R11: ffff88807e42aff0 R12: 1ffffffff1c02250 [ 352.581273][ C0] R13: 0000000000000246 R14: ffffffff8e3d4600 R15: ffff8880b843bc52 [ 352.589221][ C0] FS: 00007f9fa4d836c0(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 [ 352.598117][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 352.604677][ C0] CR2: 0000001b302f9ff8 CR3: 000000007b72a000 CR4: 00000000003526f0 [ 352.612626][ C0] Call Trace: [ 352.615897][ C0] [ 352.618726][ C0] rcu_core+0x4cf/0x15f0 [ 352.622948][ C0] ? sched_clock+0x38/0x60 [ 352.627339][ C0] ? sched_clock_cpu+0x6c/0x530 [ 352.632161][ C0] ? clockevents_program_event+0x151/0x370 [ 352.637950][ C0] ? __pfx_rcu_core+0x10/0x10 [ 352.642605][ C0] ? read_tsc+0x9/0x20 [ 352.646656][ C0] ? ktime_get+0x1a7/0x310 [ 352.651064][ C0] ? find_held_lock+0x2b/0x80 [ 352.655737][ C0] ? mark_held_locks+0x49/0x80 [ 352.660478][ C0] handle_softirqs+0x219/0x950 [ 352.665227][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 352.670513][ C0] __irq_exit_rcu+0x109/0x170 [ 352.675166][ C0] irq_exit_rcu+0x9/0x30 [ 352.679379][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 352.684983][ C0] [ 352.687884][ C0] [ 352.690785][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 352.696733][ C0] RIP: 0010:lock_acquire+0x62/0x330 [ 352.701899][ C0] Code: b4 18 12 83 f8 07 0f 87 a2 02 00 00 89 c0 48 0f a3 05 72 b8 ee 0e 0f 82 74 02 00 00 8b 35 0a e9 ee 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 89 b4 18 12 0f 85 ad 02 00 00 48 83 c4 [ 352.721492][ C0] RSP: 0018:ffffc9001c36f3a0 EFLAGS: 00000206 [ 352.727537][ C0] RAX: 0000000000000046 RBX: ffffffff8e3c9620 RCX: 00000000654d142b [ 352.735477][ C0] RDX: 0000000000000000 RSI: ffffffff8daa7d80 RDI: ffffffff8bf2b380 [ 352.743414][ C0] RBP: 0000000000000002 R08: 00000000623d3099 R09: 000000009623d309 [ 352.751352][ C0] R10: 0000000000000002 R11: ffff88807e42aff0 R12: 0000000000000000 [ 352.759291][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 352.767238][ C0] ? mt_find+0x749/0xa20 [ 352.771458][ C0] mt_find+0x14f/0xa20 [ 352.775497][ C0] ? mt_find+0x13e/0xa20 [ 352.779709][ C0] ? __pfx_mt_find+0x10/0x10 [ 352.784275][ C0] find_vma+0xbf/0x140 [ 352.788325][ C0] ? __pfx_find_vma+0x10/0x10 [ 352.792982][ C0] gup_vma_lookup+0x24/0x220 [ 352.797566][ C0] __get_user_pages+0x241/0x3590 [ 352.802491][ C0] ? down_read_killable+0x313/0x4c0 [ 352.807663][ C0] ? __pfx___up_read+0x10/0x10 [ 352.812404][ C0] ? __pfx___get_user_pages+0x10/0x10 [ 352.817755][ C0] ? __gup_longterm_locked+0x1171/0x17e0 [ 352.823383][ C0] __gup_longterm_locked+0xa92/0x17e0 [ 352.828821][ C0] ? __pfx___gup_longterm_locked+0x10/0x10 [ 352.834614][ C0] ? find_held_lock+0x2b/0x80 [ 352.839280][ C0] ? sanity_check_pinned_pages+0x23/0x11d0 [ 352.845060][ C0] gup_fast_fallback+0xf5f/0x2350 [ 352.850064][ C0] ? __pfx_gup_fast_fallback+0x10/0x10 [ 352.855504][ C0] ? lock_acquire+0x179/0x330 [ 352.860152][ C0] pin_user_pages_fast+0xa7/0xf0 [ 352.865057][ C0] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 352.870660][ C0] ? __mutex_lock+0x27b/0x1ca0 [ 352.875393][ C0] ? find_held_lock+0x2b/0x80 [ 352.880040][ C0] log_write+0x267/0x320 [ 352.884255][ C0] ? __pfx_log_write+0x10/0x10 [ 352.888989][ C0] ? __mutex_unlock_slowpath+0x161/0x790 [ 352.894590][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 352.900365][ C0] log_used.isra.0+0x170/0x1e0 [ 352.905096][ C0] vhost_update_used_flags+0x2ff/0x3d0 [ 352.910523][ C0] vhost_disable_notify+0xba/0x1b0 [ 352.915617][ C0] vhost_vsock_handle_tx_kick+0x18e/0xdb0 [ 352.921308][ C0] ? __pfx_vhost_vsock_handle_tx_kick+0x10/0x10 [ 352.927687][ C0] ? find_held_lock+0x2b/0x80 [ 352.932335][ C0] ? find_held_lock+0x2b/0x80 [ 352.936994][ C0] ? rcu_is_watching+0x12/0xc0 [ 352.941724][ C0] ? kcov_remote_start+0x399/0x680 [ 352.946802][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 352.951972][ C0] vhost_run_work_list+0x18b/0x230 [ 352.957054][ C0] vhost_task_fn+0x165/0x460 [ 352.961615][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 352.966695][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 352.971690][ C0] ? find_held_lock+0x2b/0x80 [ 352.976338][ C0] ? rcu_is_watching+0x12/0xc0 [ 352.981069][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 352.986161][ C0] ret_from_fork+0x983/0xb10 [ 352.990738][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 352.995816][ C0] ? rcu_is_watching+0x12/0xc0 [ 353.000545][ C0] ? __switch_to+0x7af/0x10d0 [ 353.005199][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 353.010282][ C0] ret_from_fork_asm+0x1a/0x30 [ 353.015024][ C0] [ 353.018015][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 353.025264][ C0] CPU: 0 UID: 0 PID: 8031 Comm: vhost-8027 Tainted: G L syzkaller #0 PREEMPT(full) [ 353.036074][ C0] Tainted: [L]=SOFTLOCKUP [ 353.040374][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 353.050395][ C0] Call Trace: [ 353.053645][ C0] [ 353.056462][ C0] dump_stack_lvl+0x3d/0x1f0 [ 353.061024][ C0] vpanic+0x640/0x6f0 [ 353.064982][ C0] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 353.071285][ C0] panic+0xca/0xd0 [ 353.074974][ C0] ? __pfx_panic+0x10/0x10 [ 353.079372][ C0] ? check_panic_on_warn+0x1f/0xb0 [ 353.084452][ C0] check_panic_on_warn+0xab/0xb0 [ 353.089356][ C0] __warn+0x108/0x3c0 [ 353.093318][ C0] __report_bug+0x2a0/0x520 [ 353.097786][ C0] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 353.104083][ C0] ? __pfx___report_bug+0x10/0x10 [ 353.109085][ C0] ? __pfx_run_posix_cpu_timers+0x10/0x10 [ 353.114776][ C0] ? __lock_acquire+0x436/0x2890 [ 353.119691][ C0] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 353.125987][ C0] report_bug+0xb2/0x220 [ 353.130206][ C0] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 353.136516][ C0] handle_bug+0x127/0x260 [ 353.140825][ C0] exc_invalid_op+0x17/0x50 [ 353.145307][ C0] asm_exc_invalid_op+0x1a/0x20 [ 353.150126][ C0] RIP: 0010:rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 353.157029][ C0] Code: 88 61 01 00 00 be 04 00 00 00 48 c7 c7 c0 52 c2 9a e8 b0 3a 85 00 b8 01 00 00 00 87 05 05 c5 1e 19 85 c0 0f 85 3d 01 00 00 90 <0f> 0b 90 48 c7 c3 74 e4 88 90 48 81 fd 00 46 3d 8e 74 5a 48 b8 00 [ 353.176604][ C0] RSP: 0018:ffffc90000007df0 EFLAGS: 00010046 [ 353.182639][ C0] RAX: 0000000000000000 RBX: 0000000000002904 RCX: ffffffff81a38db0 [ 353.190930][ C0] RDX: fffffbfff3584a58 RSI: 0000000000000004 RDI: ffffffff9ac252c0 [ 353.198868][ C0] RBP: ffffffff8e3d4600 R08: 0000000000000001 R09: fffffbfff3584a58 [ 353.206806][ C0] R10: 0000000000000003 R11: ffff88807e42aff0 R12: 1ffffffff1c02250 [ 353.214752][ C0] R13: 0000000000000246 R14: ffffffff8e3d4600 R15: ffff8880b843bc52 [ 353.222695][ C0] ? rcu_check_gp_start_stall.part.0+0x1b0/0x4b0 [ 353.228995][ C0] rcu_core+0x4cf/0x15f0 [ 353.233208][ C0] ? sched_clock+0x38/0x60 [ 353.237603][ C0] ? sched_clock_cpu+0x6c/0x530 [ 353.242421][ C0] ? clockevents_program_event+0x151/0x370 [ 353.248210][ C0] ? __pfx_rcu_core+0x10/0x10 [ 353.252856][ C0] ? read_tsc+0x9/0x20 [ 353.256895][ C0] ? ktime_get+0x1a7/0x310 [ 353.261279][ C0] ? find_held_lock+0x2b/0x80 [ 353.265930][ C0] ? mark_held_locks+0x49/0x80 [ 353.270664][ C0] handle_softirqs+0x219/0x950 [ 353.275413][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 353.280673][ C0] __irq_exit_rcu+0x109/0x170 [ 353.285320][ C0] irq_exit_rcu+0x9/0x30 [ 353.289534][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 353.295134][ C0] [ 353.298035][ C0] [ 353.300935][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 353.306880][ C0] RIP: 0010:lock_acquire+0x62/0x330 [ 353.312045][ C0] Code: b4 18 12 83 f8 07 0f 87 a2 02 00 00 89 c0 48 0f a3 05 72 b8 ee 0e 0f 82 74 02 00 00 8b 35 0a e9 ee 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 89 b4 18 12 0f 85 ad 02 00 00 48 83 c4 [ 353.331618][ C0] RSP: 0018:ffffc9001c36f3a0 EFLAGS: 00000206 [ 353.337652][ C0] RAX: 0000000000000046 RBX: ffffffff8e3c9620 RCX: 00000000654d142b [ 353.345589][ C0] RDX: 0000000000000000 RSI: ffffffff8daa7d80 RDI: ffffffff8bf2b380 [ 353.353527][ C0] RBP: 0000000000000002 R08: 00000000623d3099 R09: 000000009623d309 [ 353.361475][ C0] R10: 0000000000000002 R11: ffff88807e42aff0 R12: 0000000000000000 [ 353.369411][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 353.377373][ C0] ? mt_find+0x749/0xa20 [ 353.381608][ C0] mt_find+0x14f/0xa20 [ 353.385647][ C0] ? mt_find+0x13e/0xa20 [ 353.389862][ C0] ? __pfx_mt_find+0x10/0x10 [ 353.394431][ C0] find_vma+0xbf/0x140 [ 353.398483][ C0] ? __pfx_find_vma+0x10/0x10 [ 353.403135][ C0] gup_vma_lookup+0x24/0x220 [ 353.407698][ C0] __get_user_pages+0x241/0x3590 [ 353.412611][ C0] ? down_read_killable+0x313/0x4c0 [ 353.417787][ C0] ? __pfx___up_read+0x10/0x10 [ 353.422536][ C0] ? __pfx___get_user_pages+0x10/0x10 [ 353.427906][ C0] ? __gup_longterm_locked+0x1171/0x17e0 [ 353.433549][ C0] __gup_longterm_locked+0xa92/0x17e0 [ 353.438916][ C0] ? __pfx___gup_longterm_locked+0x10/0x10 [ 353.444709][ C0] ? find_held_lock+0x2b/0x80 [ 353.449363][ C0] ? sanity_check_pinned_pages+0x23/0x11d0 [ 353.455150][ C0] gup_fast_fallback+0xf5f/0x2350 [ 353.460155][ C0] ? __pfx_gup_fast_fallback+0x10/0x10 [ 353.465597][ C0] ? lock_acquire+0x179/0x330 [ 353.470255][ C0] pin_user_pages_fast+0xa7/0xf0 [ 353.475164][ C0] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 353.480766][ C0] ? __mutex_lock+0x27b/0x1ca0 [ 353.485499][ C0] ? find_held_lock+0x2b/0x80 [ 353.490148][ C0] log_write+0x267/0x320 [ 353.494362][ C0] ? __pfx_log_write+0x10/0x10 [ 353.499101][ C0] ? __mutex_unlock_slowpath+0x161/0x790 [ 353.504704][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 353.510478][ C0] log_used.isra.0+0x170/0x1e0 [ 353.515210][ C0] vhost_update_used_flags+0x2ff/0x3d0 [ 353.520648][ C0] vhost_disable_notify+0xba/0x1b0 [ 353.525748][ C0] vhost_vsock_handle_tx_kick+0x18e/0xdb0 [ 353.531458][ C0] ? __pfx_vhost_vsock_handle_tx_kick+0x10/0x10 [ 353.537674][ C0] ? find_held_lock+0x2b/0x80 [ 353.542334][ C0] ? find_held_lock+0x2b/0x80 [ 353.546998][ C0] ? rcu_is_watching+0x12/0xc0 [ 353.551738][ C0] ? kcov_remote_start+0x399/0x680 [ 353.556845][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 353.562025][ C0] vhost_run_work_list+0x18b/0x230 [ 353.567117][ C0] vhost_task_fn+0x165/0x460 [ 353.571692][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 353.576794][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 353.581837][ C0] ? find_held_lock+0x2b/0x80 [ 353.586489][ C0] ? rcu_is_watching+0x12/0xc0 [ 353.591220][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 353.596317][ C0] ret_from_fork+0x983/0xb10 [ 353.600935][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 353.606020][ C0] ? rcu_is_watching+0x12/0xc0 [ 353.610759][ C0] ? __switch_to+0x7af/0x10d0 [ 353.615408][ C0] ? __pfx_vhost_task_fn+0x10/0x10 [ 353.620510][ C0] ret_from_fork_asm+0x1a/0x30 [ 353.625253][ C0] [ 354.680812][ C0] Shutting down cpus with NMI [ 354.685710][ C0] Kernel Offset: disabled [ 354.690008][ C0] Rebooting in 86400 seconds..