last executing test programs: 4.586862981s ago: executing program 4 (id=193): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc12, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000280)={0x0, 0x0, 0x5, {0x2}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 3.761864619s ago: executing program 0 (id=204): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e71, 0x170e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) 3.647881669s ago: executing program 2 (id=205): syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000400)=""/195) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x50483}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0), 0xc) getpid() newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x4000) getresgid(&(0x7f000000c8c0), &(0x7f000000c900), &(0x7f000000c940)) sendto$packet(r4, &(0x7f0000000180)="1bf22b3ee27fabb94357b62376bb", 0xe, 0x4004081, &(0x7f0000000100)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="2ab50e65cd6b"}, 0x14) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=@newlink={0x5c, 0x10, 0x401, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, 0x6003, 0x5000}, [@IFLA_CARRIER_CHANGES={0x8, 0x23, 0x3}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x8}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0xfffffffa, 0x85a}}]}, {0x4}]}, @IFLA_IFALIAS={0x14, 0x14, 'netpci0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000881}, 0x10000800) 3.465119878s ago: executing program 2 (id=207): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100626f5c64000000000c000280060019"], 0x3c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010005f3f770005000000000000000000", @ANYRES32=0x0, @ANYBLOB="fd00000000000000280012800a00010076786c616e"], 0x3}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) 3.324117508s ago: executing program 1 (id=208): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f00000002c0)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000180)=""/32, 0x20, 0x6, 0x3, 0x3, 0x0, 0xa0}}, 0x120) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000500)=""/4096, 0x1000}], 0x1) write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4) 2.483554956s ago: executing program 2 (id=213): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x4, 0x24, &(0x7f0000000140)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x41015500, 0x0) 1.667997804s ago: executing program 4 (id=215): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x8040001) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000001c0)) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000005c0)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000003c0)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/62, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/73, &(0x7f0000000880)=""/72}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000140)=0x0) 1.592619254s ago: executing program 4 (id=216): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$inet(0x2, 0xa, 0x5) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) 1.592018314s ago: executing program 0 (id=218): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/43}) 1.583260344s ago: executing program 3 (id=219): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x1000}, 0x4) dup3(r0, r1, 0x0) 1.578239654s ago: executing program 0 (id=220): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x10b441, 0x63) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f00000002c0), 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ed5000/0x3000)=nil, 0x3000}, 0x3}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0xd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2, 0x300}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) 1.424037684s ago: executing program 3 (id=221): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001540)=@newtaction={0x68, 0x30, 0x829, 0x0, 0x2, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x2275}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) 1.423045664s ago: executing program 3 (id=222): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001740)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x0, 0x200000, 0x0, 0x0, 0xffffffff, 0x8003}, [@TCA_NETEM_LOSS={0x4}, @TCA_NETEM_CORR={0x10, 0x1, {0x70, 0x1, 0x80000001}}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0x16d70000, 0x10000}}]}}}]}, 0x6c}}, 0x4000844) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x1b, 0x0, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x1c, 0x0, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) sendmsg$inet(r1, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) 1.042785123s ago: executing program 2 (id=223): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) userfaultfd(0x801) 1.029140102s ago: executing program 1 (id=224): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x110000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000001840)="f3470fbc06c74424000600007848b800280000000000000f23c00f21f835030004000f23f8c7442406000000000f0114246aa2450f0012124424001afa0000c744240216383d27c7442406000000000f011c2466b8f0000f00d0400f060f00e4c4a1c1edba2500000066baa00066b8000066ef66b82f008ed0", 0x79}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_XEN_HVM(r1, 0x4068aea3, &(0x7f0000000040)={0x26, 0x0, 0x3c}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 943.899772ms ago: executing program 2 (id=225): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000004f4b000000000000000000180100002020702000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fdffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x8000000000080001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.current\x00', 0x275a, 0x0) preadv2(r6, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x20) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r7) sendmsg$IEEE802154_START_REQ(r5, 0x0, 0x20000080) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) fstat(r1, &(0x7f0000000180)) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000000a004204ffffffffff0100000000000000000000000000017ad500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000affd562b1ab3b40022a42eec7c3f00000000000000000000000000000000000000000001000000000000000000000000000000000000000000e222afbce4638f912b30124d95b2534553c62a6ac3f7685defa288e65336"], 0x90) r8 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r8, 0x541e, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/43}) 866.807892ms ago: executing program 1 (id=226): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000), 0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 831.009432ms ago: executing program 1 (id=227): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="41000000010001", 0x7) 442.568351ms ago: executing program 0 (id=228): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000d00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) close(0xffffffffffffffff) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x48000}, 0x40000c0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) 422.514081ms ago: executing program 1 (id=229): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') creat(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40080, 0x0) io_setup(0x4, &(0x7f0000010440)=0x0) io_submit(r1, 0x1, &(0x7f00000019c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0xfdfe}]) 279.558621ms ago: executing program 4 (id=230): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in=@loopback, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2, 0x0, 0x0, 0x0, 0xa, 0xa0, 0x0, 0x2c}, {0xfffffffffffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0xd8}, {0x0, 0x8, 0x0, 0x4}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}}}, 0xe8) 208.008731ms ago: executing program 3 (id=231): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') pwritev(r1, &(0x7f0000000100), 0x0, 0x80, 0x0) 207.628931ms ago: executing program 4 (id=232): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) 207.340681ms ago: executing program 1 (id=233): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_control_io$hid(r0, 0x0, 0x0) 207.193321ms ago: executing program 3 (id=234): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000002ac0)={'sit0\x00', 0x0}) 206.991951ms ago: executing program 0 (id=235): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000010000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r0}, 0x10) r1 = epoll_create(0x917) epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x9) 167.48206ms ago: executing program 3 (id=236): socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x20000000, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x10000, 0x0) 162.9953ms ago: executing program 0 (id=237): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c01e25405e04f40051d5000000010b0212"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000480)=ANY=[@ANYRES32=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x541c, &(0x7f0000000000)) 74.29142ms ago: executing program 2 (id=238): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='contention_end\x00', r2}, 0x18) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r1, 0xf50f, 0x0) 0s ago: executing program 4 (id=239): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x5, 0x1, 0x8005, 0x401}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts. [ 21.603217][ T24] audit: type=1400 audit(1736870040.920:66): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.604698][ T273] cgroup: Unknown subsys name 'net' [ 21.625725][ T24] audit: type=1400 audit(1736870040.920:67): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.652597][ T24] audit: type=1400 audit(1736870040.950:68): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.653067][ T273] cgroup: Unknown subsys name 'devices' [ 21.796032][ T273] cgroup: Unknown subsys name 'hugetlb' [ 21.801714][ T273] cgroup: Unknown subsys name 'rlimit' [ 21.973334][ T24] audit: type=1400 audit(1736870041.290:69): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.996383][ T24] audit: type=1400 audit(1736870041.290:70): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.021068][ T24] audit: type=1400 audit(1736870041.290:71): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.028542][ T277] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.053089][ T24] audit: type=1400 audit(1736870041.380:72): avc: denied { relabelto } for pid=277 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.078725][ T24] audit: type=1400 audit(1736870041.380:73): avc: denied { write } for pid=277 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.109782][ T24] audit: type=1400 audit(1736870041.430:74): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.135281][ T24] audit: type=1400 audit(1736870041.430:75): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.161572][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.967241][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.974158][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.981324][ T284] device bridge_slave_0 entered promiscuous mode [ 22.988313][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.995296][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.002615][ T284] device bridge_slave_1 entered promiscuous mode [ 23.059496][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.066470][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.074047][ T286] device bridge_slave_0 entered promiscuous mode [ 23.082268][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.089216][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.096583][ T286] device bridge_slave_1 entered promiscuous mode [ 23.135743][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.142594][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.149985][ T285] device bridge_slave_0 entered promiscuous mode [ 23.156705][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.163734][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.171229][ T285] device bridge_slave_1 entered promiscuous mode [ 23.210681][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.217590][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.225086][ T287] device bridge_slave_0 entered promiscuous mode [ 23.231574][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.238464][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.245718][ T288] device bridge_slave_0 entered promiscuous mode [ 23.253722][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.260600][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.267858][ T288] device bridge_slave_1 entered promiscuous mode [ 23.284542][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.291402][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.298745][ T287] device bridge_slave_1 entered promiscuous mode [ 23.405697][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.412566][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.447704][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.454576][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.461681][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.468523][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.486554][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.493453][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.500565][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.507558][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.524073][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.530930][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.538342][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.545190][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.556281][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.563389][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.570566][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.577850][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.585176][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.592887][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.600091][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.607826][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.615210][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.638304][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.646939][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.655219][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.662048][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.679159][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.687413][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.694264][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.709502][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.718694][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.726791][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.733623][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.765242][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.773014][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.781627][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.789960][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.796844][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.804074][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.812028][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.818894][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.826088][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.834130][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.841237][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.848592][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.856475][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.864470][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.888342][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.896952][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.905253][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.912189][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.920071][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.930054][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.936942][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.944286][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.952356][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.959219][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.967686][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.975756][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.982583][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.989897][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.997701][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.005994][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.020779][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.028753][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.037150][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.045650][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.062576][ T285] device veth0_vlan entered promiscuous mode [ 24.075038][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.082999][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.091215][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.099366][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.108397][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.116626][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.124595][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.132582][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.140443][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.148434][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.156718][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.165064][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.174528][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.182157][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.197544][ T288] device veth0_vlan entered promiscuous mode [ 24.204612][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.212784][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.221308][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.229611][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.237678][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.245090][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.256555][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.264457][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.279314][ T288] device veth1_macvtap entered promiscuous mode [ 24.287984][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.295818][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.303182][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.311596][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.320559][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.328231][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.336280][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.347910][ T284] device veth0_vlan entered promiscuous mode [ 24.356393][ T285] device veth1_macvtap entered promiscuous mode [ 24.367752][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.375399][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.383505][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.391982][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.400927][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.418669][ T287] device veth0_vlan entered promiscuous mode [ 24.425615][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.433438][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.441693][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.450304][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.458795][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.467022][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.475258][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.482667][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.491694][ T284] device veth1_macvtap entered promiscuous mode [ 24.504463][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.512250][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.520639][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.529157][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.537674][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.546124][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.554430][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.575694][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.583852][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.584201][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 24.592607][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.607110][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.615178][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.622467][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.631838][ T287] device veth1_macvtap entered promiscuous mode [ 24.640793][ T285] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.644376][ T286] device veth0_vlan entered promiscuous mode [ 24.657489][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.665769][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.674344][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.699367][ T286] device veth1_macvtap entered promiscuous mode [ 24.709066][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.717596][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.726041][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.734755][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.743116][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.752139][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.761201][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.775135][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.787572][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.810662][ T310] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 24.839675][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.881246][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.890058][ T310] EXT4-fs error (device loop4): ext4_get_journal_inode:5243: inode #32: comm syz.4.5: iget: special inode unallocated [ 24.903069][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.911387][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.925333][ T310] EXT4-fs (loop4): no journal found [ 24.930381][ T310] EXT4-fs (loop4): can't get journal size [ 24.960701][ T310] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,noblock_validity,nodelalloc,,errors=continue [ 25.104911][ T323] EXT4-fs (loop2): Ignoring removed orlov option [ 25.111857][ T323] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 25.120314][ T323] EXT4-fs (loop2): orphan cleanup on readonly fs [ 25.127889][ T323] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 25.137714][ T323] EXT4-fs error (device loop2): ext4_dirty_inode:6110: inode #3: comm syz.2.3: mark_inode_dirty error [ 25.149484][ T323] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.3: Invalid block bitmap block 3 in block_group 0 [ 25.163073][ T323] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 25.173299][ T323] EXT4-fs error (device loop2): ext4_dirty_inode:6110: inode #3: comm syz.2.3: mark_inode_dirty error [ 25.185705][ T323] EXT4-fs error (device loop2): ext4_map_blocks:629: inode #3: block 1: comm syz.2.3: lblock 6 mapped to illegal pblock 1 (length 1) [ 25.209278][ T324] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.221832][ T323] EXT4-fs error (device loop2): ext4_map_blocks:629: inode #3: block 48: comm syz.2.3: lblock 0 mapped to illegal pblock 48 (length 1) [ 25.254193][ T323] EXT4-fs error (device loop2): ext4_acquire_dquot:6219: comm syz.2.3: Failed to acquire dquot type 0 [ 25.284951][ T323] EXT4-fs error (device loop2): ext4_map_blocks:629: inode #3: block 49: comm syz.2.3: lblock 1 mapped to illegal pblock 49 (length 1) [ 25.299270][ T323] EXT4-fs error (device loop2): ext4_acquire_dquot:6219: comm syz.2.3: Failed to acquire dquot type 0 [ 25.311538][ T323] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 25.322127][ T323] EXT4-fs error (device loop2): ext4_evict_inode:283: inode #15: comm syz.2.3: mark_inode_dirty error [ 25.333617][ T323] EXT4-fs warning (device loop2): ext4_evict_inode:286: couldn't mark inode dirty (err -117) [ 25.344045][ T323] EXT4-fs (loop2): 1 orphan inode deleted [ 25.349720][ T323] EXT4-fs (loop2): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000000008,data_err=abort,minixdf,orlov,abort,noblock_validity,barrier,journal_dev=0x0000000000000f35,,errors=continue [ 25.461509][ T334] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 25.714617][ T334] ====================================================== [ 25.714617][ T334] WARNING: the mand mount option is being deprecated and [ 25.714617][ T334] will be removed in v5.15! [ 25.714617][ T334] ====================================================== [ 25.966483][ T334] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 25.977385][ T334] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 26.024478][ T334] F2FS-fs (loop1): invalid crc value [ 26.115653][ T334] F2FS-fs (loop1): Found nat_bits in checkpoint [ 26.543491][ T334] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 26.551414][ T334] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 26.626734][ T24] kauditd_printk_skb: 121 callbacks suppressed [ 26.626748][ T24] audit: type=1400 audit(1736870045.950:191): avc: denied { write } for pid=327 comm="syz.1.6" name="/" dev="loop1" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.693942][ T24] audit: type=1400 audit(1736870045.950:192): avc: denied { add_name } for pid=327 comm="syz.1.6" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.738401][ T24] audit: type=1400 audit(1736870045.950:193): avc: denied { create } for pid=327 comm="syz.1.6" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 26.796330][ T24] audit: type=1400 audit(1736870045.950:194): avc: denied { read write open } for pid=327 comm="syz.1.6" path="/1/file0/bus" dev="loop1" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 26.865194][ T24] audit: type=1400 audit(1736870045.960:195): avc: denied { create } for pid=361 comm="syz.2.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 26.893322][ T24] audit: type=1400 audit(1736870045.960:196): avc: denied { ioctl } for pid=361 comm="syz.2.12" path="socket:[15125]" dev="sockfs" ino=15125 ioctlcmd=0x8912 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 26.946535][ T24] audit: type=1400 audit(1736870045.980:197): avc: denied { create } for pid=361 comm="syz.2.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.995580][ T24] audit: type=1400 audit(1736870046.310:198): avc: denied { create } for pid=362 comm="syz.3.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.015440][ T24] audit: type=1400 audit(1736870046.320:199): avc: denied { ioctl } for pid=362 comm="syz.3.11" path="socket:[15732]" dev="sockfs" ino=15732 ioctlcmd=0x48d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.059669][ T24] audit: type=1400 audit(1736870046.380:200): avc: denied { write } for pid=367 comm="syz.4.13" name="attr" dev="proc" ino=15140 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 27.425318][ T376] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 27.432450][ T376] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.454259][ T376] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 27.485761][ T376] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2806: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 27.514149][ T376] EXT4-fs (loop0): 1 truncate cleaned up [ 27.519646][ T376] EXT4-fs (loop0): mounted filesystem without journal. Opts: i_version,mblk_io_submit,debug_want_extra_isize=0x0000000000000068,lazytime,block_validity,data_err=abort,barrier,,errors=continue [ 27.694973][ T382] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 27.706121][ T387] netlink: 12 bytes leftover after parsing attributes in process `syz.3.18'. [ 27.729888][ T387] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18'. [ 27.740647][ T384] EXT4-fs (loop2): mounted filesystem without journal. Opts: usrquota,grpjquota=,nodelalloc,,errors=continue [ 27.750717][ T387] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18'. [ 27.822131][ T392] netlink: 'syz.0.15': attribute type 4 has an invalid length. [ 27.849919][ T392] netlink: 'syz.0.15': attribute type 4 has an invalid length. [ 27.963016][ T384] ext4 filesystem being mounted at /3/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.829774][ T382] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 28.868955][ T382] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 28.898848][ T410] SELinux: Context @ is not valid (left unmapped). [ 28.913097][ T382] F2FS-fs (loop4): invalid crc value [ 28.971939][ T382] F2FS-fs (loop4): Found nat_bits in checkpoint [ 29.092663][ T408] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 29.110637][ T382] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 29.123975][ T382] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 29.190393][ T426] EXT4-fs (loop1): Ignoring removed orlov option [ 29.214624][ T426] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 29.248158][ T426] EXT4-fs (loop1): orphan cleanup on readonly fs [ 29.278606][ T426] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 29.322097][ T426] EXT4-fs error (device loop1): ext4_dirty_inode:6110: inode #3: comm syz.1.24: mark_inode_dirty error [ 29.361922][ T429] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 29.382853][ T426] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.24: Invalid block bitmap block 3 in block_group 0 [ 29.424195][ T426] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 29.445067][ T426] EXT4-fs error (device loop1): ext4_dirty_inode:6110: inode #3: comm syz.1.24: mark_inode_dirty error [ 29.490087][ T426] EXT4-fs error (device loop1): ext4_map_blocks:629: inode #3: block 1: comm syz.1.24: lblock 6 mapped to illegal pblock 1 (length 1) [ 29.549039][ T426] EXT4-fs error (device loop1): ext4_map_blocks:629: inode #3: block 48: comm syz.1.24: lblock 0 mapped to illegal pblock 48 (length 1) [ 29.581356][ T426] EXT4-fs error (device loop1): ext4_acquire_dquot:6219: comm syz.1.24: Failed to acquire dquot type 0 [ 29.611422][ T426] EXT4-fs error (device loop1): ext4_map_blocks:629: inode #3: block 49: comm syz.1.24: lblock 1 mapped to illegal pblock 49 (length 1) [ 29.644190][ T426] EXT4-fs error (device loop1): ext4_acquire_dquot:6219: comm syz.1.24: Failed to acquire dquot type 0 [ 29.683991][ T426] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5900: Corrupt filesystem [ 29.707359][ T426] EXT4-fs error (device loop1): ext4_evict_inode:283: inode #15: comm syz.1.24: mark_inode_dirty error [ 29.747254][ T426] EXT4-fs warning (device loop1): ext4_evict_inode:286: couldn't mark inode dirty (err -117) [ 29.777064][ T426] EXT4-fs (loop1): 1 orphan inode deleted [ 29.784384][ T426] EXT4-fs (loop1): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000000008,data_err=abort,minixdf,orlov,abort,noblock_validity,barrier,journal_dev=0x0000000000000f35,,errors=continue [ 29.959390][ T429] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 29.970895][ T429] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 29.993167][ T408] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 30.035712][ T429] F2FS-fs (loop2): invalid crc value [ 30.045313][ T408] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 30.072216][ T408] F2FS-fs (loop3): invalid crc value [ 30.090318][ T429] F2FS-fs (loop2): Found nat_bits in checkpoint [ 30.140414][ T408] F2FS-fs (loop3): Found nat_bits in checkpoint [ 30.302471][ T429] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 30.314158][ T429] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 30.397271][ T408] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 30.409592][ T408] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 31.424459][ T478] process 'syz.1.38' launched './file1' with NULL argv: empty string added [ 31.558771][ T429] F2FS-fs (loop2): Start checkpoint disabled! [ 31.740115][ T24] kauditd_printk_skb: 65 callbacks suppressed [ 31.740129][ T24] audit: type=1400 audit(1736870051.060:260): avc: denied { relabelfrom } for pid=487 comm="syz.0.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 31.783176][ T24] audit: type=1400 audit(1736870051.060:261): avc: denied { relabelto } for pid=487 comm="syz.0.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 31.803013][ T24] audit: type=1400 audit(1736870051.060:262): avc: denied { attach_queue } for pid=487 comm="syz.0.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 31.843964][ T15] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 31.950038][ T24] audit: type=1400 audit(1736870051.270:263): avc: denied { read write } for pid=499 comm="syz.0.47" name="uhid" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 31.974417][ T24] audit: type=1400 audit(1736870051.270:264): avc: denied { open } for pid=499 comm="syz.0.47" path="/dev/uhid" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 32.014994][ T335] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 32.032310][ T24] audit: type=1400 audit(1736870051.350:265): avc: denied { ioctl } for pid=507 comm="syz.0.51" path="socket:[16506]" dev="sockfs" ino=16506 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.224112][ T15] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 32.234537][ T15] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 32.243384][ T15] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.355472][ T25] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.494023][ T335] usb 2-1: unable to get BOS descriptor or descriptor too short [ 32.534243][ T335] usb 2-1: not running at top speed; connect to a high speed hub [ 32.614236][ T335] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.623366][ T335] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.634388][ T335] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.643329][ T335] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.654029][ T25] usb 1-1: Using ep0 maxpacket: 32 [ 32.661855][ T335] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 32.675425][ T335] usb 2-1: config 1 has no interface number 1 [ 32.682208][ T335] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 32.698063][ T335] usb 2-1: config 1 interface 2 has no altsetting 0 [ 32.814046][ T25] usb 1-1: unable to get BOS descriptor or descriptor too short [ 32.846117][ T24] audit: type=1400 audit(1736870052.170:266): avc: denied { ioctl } for pid=532 comm="syz.3.60" path="socket:[16539]" dev="sockfs" ino=16539 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 32.871500][ T335] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 32.883337][ T335] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.883547][ T24] audit: type=1400 audit(1736870052.210:267): avc: denied { create } for pid=534 comm="syz.3.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 32.891568][ T335] usb 2-1: Product: syz [ 32.914793][ T25] usb 1-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.929157][ T335] usb 2-1: Manufacturer: syz [ 32.933642][ T25] usb 1-1: config 1 interface 0 has no altsetting 0 [ 32.940270][ T335] usb 2-1: SerialNumber: syz [ 33.003369][ T24] audit: type=1400 audit(1736870052.320:268): avc: denied { connect } for pid=538 comm="syz.3.63" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.104012][ T25] usb 1-1: New USB device found, idVendor=0c45, idProduct=5112, bcdDevice= 0.40 [ 33.114370][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.122875][ T25] usb 1-1: Product: syz [ 33.127511][ T25] usb 1-1: Manufacturer: syz [ 33.132348][ T25] usb 1-1: SerialNumber: syz [ 33.225896][ T24] audit: type=1400 audit(1736870052.550:269): avc: denied { create } for pid=543 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 33.275745][ T547] netlink: 8 bytes leftover after parsing attributes in process `syz.3.66'. [ 33.284647][ T547] netlink: 8 bytes leftover after parsing attributes in process `syz.3.66'. [ 33.307655][ T335] usb 2-1: USB disconnect, device number 2 [ 33.544302][ T332] udevd[332]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.674239][ T25] usbhid 1-1:1.0: can't add hid device: -71 [ 33.682472][ T25] usbhid: probe of 1-1:1.0 failed with error -71 [ 33.694495][ T25] usb 1-1: USB disconnect, device number 2 [ 33.767098][ T568] 9pnet: p9_errstr2errno: server reported unknown error [ 33.838896][ T570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.75'. [ 33.954213][ T578] usb usb7: usbfs: process 578 (syz.1.78) did not claim interface 0 before use [ 34.576977][ T606] netlink: 36 bytes leftover after parsing attributes in process `syz.2.87'. [ 34.660927][ T316] usb 5-1: USB disconnect, device number 2 [ 34.941943][ T612] netlink: 8 bytes leftover after parsing attributes in process `syz.4.91'. [ 35.903989][ T15] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.074235][ T54] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 36.163992][ T15] usb 3-1: Using ep0 maxpacket: 16 [ 36.304366][ T15] usb 3-1: config 0 has an invalid interface number: 214 but max is 0 [ 36.312735][ T15] usb 3-1: config 0 has no interface number 0 [ 36.319067][ T15] usb 3-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 36.434034][ T54] usb 5-1: config 0 has an invalid interface number: 107 but max is 0 [ 36.452485][ T54] usb 5-1: config 0 has no interface number 0 [ 36.463952][ T54] usb 5-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 36.514727][ T15] usb 3-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 36.524068][ T15] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.531890][ T15] usb 3-1: Product: syz [ 36.536405][ T15] usb 3-1: Manufacturer: syz [ 36.540853][ T15] usb 3-1: SerialNumber: syz [ 36.562179][ T25] rtc_cmos 00:00: Alarms can be up to one day in the future [ 36.609364][ T25] rtc_cmos 00:00: Alarms can be up to one day in the future [ 36.612574][ T15] usb 3-1: config 0 descriptor?? [ 36.617181][ T25] rtc_cmos 00:00: Alarms can be up to one day in the future [ 36.629788][ T25] rtc_cmos 00:00: Alarms can be up to one day in the future [ 36.639409][ T25] rtc rtc0: __rtc_set_alarm: err=-22 [ 36.644717][ T54] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 36.656433][ T54] usb 5-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 36.665284][ T54] usb 5-1: Product: syz [ 36.669446][ T54] usb 5-1: Manufacturer: syz [ 36.674080][ T54] usb 5-1: SerialNumber: syz [ 36.749467][ T54] usb 5-1: config 0 descriptor?? [ 36.894943][ T24] kauditd_printk_skb: 69 callbacks suppressed [ 36.894969][ T24] audit: type=1400 audit(1736870056.210:339): avc: denied { write } for pid=649 comm="syz.3.107" name="ptype" dev="proc" ino=4026532537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 37.115210][ T394] usb 5-1: USB disconnect, device number 3 [ 37.408057][ T24] audit: type=1400 audit(1736870056.730:340): avc: denied { create } for pid=655 comm="syz.1.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.431792][ T24] audit: type=1400 audit(1736870056.750:341): avc: denied { read } for pid=655 comm="syz.1.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.482890][ T24] audit: type=1400 audit(1736870056.800:342): avc: denied { write } for pid=655 comm="syz.1.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.644518][ T24] audit: type=1400 audit(1736870056.970:343): avc: denied { map_create } for pid=666 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 37.694542][ T24] audit: type=1400 audit(1736870057.000:344): avc: denied { map_read map_write } for pid=666 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 38.144728][ T25] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 38.280804][ T24] audit: type=1400 audit(1736870057.600:345): avc: denied { create } for pid=682 comm="syz.1.119" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 38.394016][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 38.792396][ T15] usb 3-1: USB disconnect, device number 2 [ 38.815997][ T689] capability: warning: `syz.3.121' uses deprecated v2 capabilities in a way that may be insecure [ 38.829098][ T24] audit: type=1400 audit(1736870058.150:346): avc: denied { read } for pid=690 comm="syz.2.120" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 38.844077][ T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.872488][ T24] audit: type=1400 audit(1736870058.150:347): avc: denied { open } for pid=690 comm="syz.2.120" path="/dev/kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 38.898211][ T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.910252][ T25] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 38.921050][ T24] audit: type=1400 audit(1736870058.190:348): avc: denied { ioctl } for pid=690 comm="syz.2.120" path="/dev/kvm" dev="devtmpfs" ino=82 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 38.953363][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.966809][ T25] usb 5-1: config 0 descriptor?? [ 39.557745][ T25] hid-generic 0003:0403:6030.0001: unknown main item tag 0x0 [ 39.581381][ T25] hid-generic 0003:0403:6030.0001: unknown main item tag 0x0 [ 39.613051][ T25] hid-generic 0003:0403:6030.0001: hidraw0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 39.902061][ T691] kvm [690]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x800 [ 39.911976][ T691] kvm [690]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc2 data 0x0 [ 39.924899][ T691] kvm [690]: vcpu0, guest rIP: 0x18e ignored wrmsr: 0x11e data 0x0 [ 39.941869][ T691] kvm [690]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0x187 data 0x800 [ 40.194570][ T316] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 40.294046][ T15] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 40.543968][ T15] usb 4-1: Using ep0 maxpacket: 32 [ 40.694099][ T15] usb 4-1: config index 0 descriptor too short (expected 63268, got 36) [ 40.702474][ T15] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 40.710679][ T15] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 40.719610][ T15] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.730490][ T15] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.740124][ T15] usb 4-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 40.749658][ T292] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 40.757090][ T15] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.765936][ T15] usb 4-1: config 0 descriptor?? [ 40.784093][ T316] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 40.793143][ T316] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.801705][ T316] usb 1-1: Product: syz [ 40.807373][ T316] usb 1-1: Manufacturer: syz [ 40.811955][ T316] usb 1-1: SerialNumber: syz [ 40.882813][ T316] usb 5-1: USB disconnect, device number 4 [ 40.885974][ T25] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 41.014036][ T292] usb 3-1: Using ep0 maxpacket: 16 [ 41.134013][ T25] usb 2-1: Using ep0 maxpacket: 8 [ 41.164038][ T292] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 41.175307][ T292] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 41.185086][ T292] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 41.235010][ T15] hkems 0003:2006:0118.0002: item fetching failed at offset 2/5 [ 41.243096][ T15] hkems 0003:2006:0118.0002: parse failed [ 41.248888][ T15] hkems: probe of 0003:2006:0118.0002 failed with error -22 [ 41.254078][ T25] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 41.264413][ T25] usb 2-1: config 0 has no interface number 0 [ 41.270443][ T25] usb 2-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 41.274049][ T316] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 41.281022][ T25] usb 2-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 41.298979][ T25] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 41.312260][ T25] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 41.314084][ T292] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 41.321560][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.330888][ T292] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 41.340362][ T25] usb 2-1: config 0 descriptor?? [ 41.348613][ T292] usb 3-1: SerialNumber: syz [ 41.374118][ T729] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 41.438182][ T432] usb 4-1: USB disconnect, device number 2 [ 41.599126][ T15] usb 2-1: USB disconnect, device number 3 [ 41.605339][ T292] cdc_ether: probe of 3-1:1.0 failed with error -71 [ 41.617156][ T292] usb 3-1: USB disconnect, device number 3 [ 41.664075][ T316] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 41.673531][ T316] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 41.684417][ T316] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 41.884037][ T316] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 41.893359][ T316] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.902307][ T316] usb 5-1: Product: syz [ 41.906630][ T316] usb 5-1: Manufacturer: syz [ 41.911109][ T316] usb 5-1: SerialNumber: syz [ 41.960885][ T24] kauditd_printk_skb: 12 callbacks suppressed [ 41.960899][ T24] audit: type=1326 audit(1736870061.280:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=747 comm="syz.3.142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c45184d29 code=0x7ffc0000 [ 41.990898][ T24] audit: type=1326 audit(1736870061.280:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=747 comm="syz.3.142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c45184d29 code=0x7ffc0000 [ 42.015320][ T24] audit: type=1326 audit(1736870061.280:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=747 comm="syz.3.142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=84 compat=0 ip=0x7f2c45184d29 code=0x7ffc0000 [ 42.040986][ T24] audit: type=1326 audit(1736870061.280:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=747 comm="syz.3.142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c45184d29 code=0x7ffc0000 [ 42.066606][ T24] audit: type=1326 audit(1736870061.280:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=747 comm="syz.3.142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c45184d29 code=0x7ffc0000 [ 42.090342][ T24] audit: type=1400 audit(1736870061.390:366): avc: denied { ioctl } for pid=753 comm="syz.3.145" path="/dev/input/event2" dev="devtmpfs" ino=264 ioctlcmd=0x4504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 42.404058][ T25] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 42.412063][ T685] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 42.424110][ T316] usb 5-1: 0:2 : does not exist [ 42.631884][ T335] usb 5-1: USB disconnect, device number 5 [ 42.639041][ T20] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 42.654117][ T685] usb 4-1: Using ep0 maxpacket: 32 [ 42.764099][ T25] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 42.774276][ T685] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 42.784921][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.794602][ T25] usb 3-1: config 0 descriptor?? [ 42.928725][ T25] usb 1-1: USB disconnect, device number 3 [ 42.954215][ T685] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 42.963354][ T685] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 42.971653][ T685] usb 4-1: Product: syz [ 42.976486][ T685] usb 4-1: Manufacturer: syz [ 42.981288][ T685] usb 4-1: SerialNumber: syz [ 42.986741][ T685] usb 4-1: config 0 descriptor?? [ 43.004130][ T757] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 43.054050][ T20] usb 2-1: unable to get BOS descriptor or descriptor too short [ 43.094169][ T20] usb 2-1: not running at top speed; connect to a high speed hub [ 43.174318][ T20] usb 2-1: config 1 interface 0 altsetting 253 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 43.186392][ T20] usb 2-1: config 1 interface 0 altsetting 253 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 43.200215][ T20] usb 2-1: config 1 interface 0 has no altsetting 0 [ 43.227538][ T292] usb 4-1: USB disconnect, device number 3 [ 43.294064][ T25] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 43.364079][ T20] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 43.373173][ T20] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.381423][ T20] usb 2-1: Product: syz [ 43.385459][ T20] usb 2-1: Manufacturer: syz [ 43.389875][ T20] usb 2-1: SerialNumber: syz [ 43.414061][ T316] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 43.414226][ T772] raw-gadget.4 gadget: fail, usb_ep_enable returned -22 [ 43.654155][ T25] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 43.667240][ T25] usb 1-1: config 0 interface 0 has no altsetting 0 [ 43.675017][ T25] usb 1-1: New USB device found, idVendor=18d1, idProduct=503c, bcdDevice= 0.00 [ 43.684444][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.684945][ T316] usb 5-1: Using ep0 maxpacket: 8 [ 43.697873][ T25] usb 1-1: config 0 descriptor?? [ 43.714122][ T775] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 43.714473][ T20] usb 2-1: bad CDC descriptors [ 43.732127][ T20] usb 2-1: USB disconnect, device number 4 [ 43.755089][ T24] audit: type=1400 audit(1736870063.080:367): avc: denied { read write } for pid=780 comm="syz.3.156" name="uhid" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 43.760339][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.780018][ T24] audit: type=1400 audit(1736870063.080:368): avc: denied { open } for pid=780 comm="syz.3.156" path="/dev/uhid" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 43.787276][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.818286][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.826326][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.834508][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.844036][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.852277][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.854026][ T316] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 43.859942][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.868893][ T316] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 43.877274][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.890052][ T316] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 43.897581][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.907541][ T316] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 43.915506][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.928196][ T316] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 43.935536][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.950367][ T316] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 43.959261][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.967066][ T316] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.974711][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 43.992088][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.001095][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.012356][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.021864][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.029514][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.037429][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.044975][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.053044][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.060637][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.068146][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.075639][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.083381][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.091109][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.098318][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.110346][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.117734][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.125095][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.132803][ T335] hid-generic 0006:0003:0003.0003: unknown main item tag 0x0 [ 44.142269][ T685] usb 3-1: USB disconnect, device number 4 [ 44.149439][ T335] hid-generic 0006:0003:0003.0003: hidraw0: VIRTUAL HID v0.00 Device [syz1] on syz0 [ 44.206600][ T25] hid-generic 0003:18D1:503C.0004: hidraw0: USB HID v7.32 Device [HID 18d1:503c] on usb-dummy_hcd.0-1/input0 [ 44.417870][ T316] usb 1-1: USB disconnect, device number 4 [ 44.483992][ T292] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 44.519566][ T25] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 44.754251][ T24] audit: type=1400 audit(1736870063.990:369): avc: denied { mount } for pid=798 comm="syz.2.163" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 44.777334][ T25] usb 4-1: Using ep0 maxpacket: 16 [ 44.904261][ T25] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.917647][ T25] usb 4-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 44.928949][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.982188][ T25] usb 4-1: config 0 descriptor?? [ 45.706863][ T25] wacom 0003:056A:0084.0005: hidraw0: USB HID v0.00 Device [HID 056a:0084] on usb-dummy_hcd.3-1/input0 [ 45.762644][ T24] audit: type=1400 audit(1736870065.080:370): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 45.926010][ T25] usb 4-1: USB disconnect, device number 4 [ 45.960935][ T292] usb 2-1: Using ep0 maxpacket: 8 [ 46.532431][ T831] xt_CT: No such helper "snmp" [ 46.773333][ T20] usb 5-1: USB disconnect, device number 6 [ 46.787099][ T830] binder: 828:830 ioctl c018620c 20000000 returned -1 [ 46.799417][ T830] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 46.817744][ T838] usb usb4: usbfs: process 838 (syz.4.173) did not claim interface 0 before use [ 47.094167][ T24] kauditd_printk_skb: 7 callbacks suppressed [ 47.094210][ T24] audit: type=1400 audit(1736870066.230:378): avc: denied { create } for pid=839 comm="syz.4.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.140487][ T845] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.147945][ T845] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.170708][ T24] audit: type=1400 audit(1736870066.240:379): avc: denied { bind } for pid=839 comm="syz.4.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.239764][ T24] audit: type=1400 audit(1736870066.250:380): avc: denied { write } for pid=839 comm="syz.4.175" path="socket:[17125]" dev="sockfs" ino=17125 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.266550][ T24] audit: type=1400 audit(1736870066.450:381): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.290388][ T24] audit: type=1400 audit(1736870066.450:382): avc: denied { remove_name } for pid=77 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.329283][ T24] audit: type=1400 audit(1736870066.450:383): avc: denied { rename } for pid=77 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 47.374223][ T292] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 47.391232][ T292] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 47.409650][ T24] audit: type=1400 audit(1736870066.450:384): avc: denied { add_name } for pid=77 comm="syslogd" name="messages.0" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.415783][ T292] usb 2-1: Product: syz [ 47.446061][ T24] audit: type=1400 audit(1736870066.450:385): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 47.449911][ T292] usb 2-1: config 0 descriptor?? [ 47.484677][ T24] audit: type=1400 audit(1736870066.620:386): avc: denied { write } for pid=849 comm="syz.0.179" name="event2" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 47.514052][ T292] usb 2-1: can't set config #0, error -71 [ 47.529184][ T292] usb 2-1: USB disconnect, device number 5 [ 47.841203][ T868] kvm [867]: vcpu0, guest rIP: 0x1be disabled perfctr wrmsr: 0xc2 data 0x18000004008 [ 47.844251][ T882] Zero length message leads to an empty skb [ 47.885070][ T886] netlink: 52 bytes leftover after parsing attributes in process `syz.1.192'. [ 47.972395][ T24] audit: type=1400 audit(1736870067.290:387): avc: denied { create } for pid=890 comm="syz.1.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 48.024758][ T895] netlink: 28 bytes leftover after parsing attributes in process `syz.1.196'. [ 48.172307][ T902] overlayfs: maximum fs stacking depth exceeded [ 48.253948][ T54] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 48.875537][ T918] A link change request failed with some changes committed already. Interface ip6erspan0 may have been left with an inconsistent configuration, please check. [ 49.031168][ T54] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.043934][ T20] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 49.075986][ T54] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.095634][ T54] usb 5-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 49.105442][ T54] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.118024][ T54] usb 5-1: config 0 descriptor?? [ 49.150318][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.160478][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.168133][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.176916][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.184585][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.192262][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.199814][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.207929][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.215603][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.223138][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.230646][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.238225][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.245641][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.253129][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.260794][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.268329][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.275809][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.283177][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.290709][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.298383][ T927] netlink: 12 bytes leftover after parsing attributes in process `syz.2.207'. [ 49.307317][ T20] usb 1-1: Using ep0 maxpacket: 16 [ 49.312542][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.321229][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.329188][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.336799][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.344524][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.351938][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.360223][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.367876][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.375768][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.383161][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.390917][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.398615][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.406196][ T920] hid-generic 0006:0003:0003.0006: unknown main item tag 0x0 [ 49.414406][ T920] hid-generic 0006:0003:0003.0006: hidraw0: VIRTUAL HID v0.00 Device [syz1] on syz0 [ 49.424099][ T20] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.442346][ T20] usb 1-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 49.451979][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.464182][ T20] usb 1-1: config 0 descriptor?? [ 49.595028][ T54] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 49.602537][ T54] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 49.609848][ T54] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 49.618238][ T54] zeroplus 0003:0C12:0005.0007: hidraw1: USB HID v0.00 Device [HID 0c12:0005] on usb-dummy_hcd.4-1/input0 [ 49.629772][ T54] zeroplus 0003:0C12:0005.0007: no inputs found [ 49.738230][ T920] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 49.994081][ T20] hid-generic 0003:1E71:170E.0008: unknown main item tag 0x0 [ 50.029888][ T20] hid-generic 0003:1E71:170E.0008: unknown main item tag 0x0 [ 50.057865][ T20] hid-generic 0003:1E71:170E.0008: item fetching failed at offset 2/5 [ 50.079713][ T20] hid-generic: probe of 0003:1E71:170E.0008 failed with error -22 [ 50.111348][ T920] usb 2-1: config 0 has no interfaces? [ 50.117048][ T394] usb 5-1: USB disconnect, device number 7 [ 50.122786][ T920] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 50.163007][ T920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.177951][ T920] usb 2-1: config 0 descriptor?? [ 50.280659][ T54] usb 1-1: USB disconnect, device number 5 [ 50.654736][ T394] usb 2-1: USB disconnect, device number 6 [ 50.912972][ T959] syz.4.216 uses obsolete (PF_INET,SOCK_PACKET) [ 51.549687][ T977] kvm: emulating exchange as write [ 52.478479][ T1013] ================================================================== [ 52.486527][ T1013] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 [ 52.494585][ T1013] Read of size 8 at addr ffff8881158f10c0 by task syz.4.239/1013 [ 52.502123][ T1013] [ 52.504290][ T1013] CPU: 1 PID: 1013 Comm: syz.4.239 Not tainted 5.10.232-syzkaller-00746-g49e8ba0a684f #0 [ 52.514200][ T1013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 52.524221][ T1013] Call Trace: [ 52.527450][ T1013] dump_stack_lvl+0x1e2/0x24b [ 52.532211][ T1013] ? bfq_pos_tree_add_move+0x43b/0x43b [ 52.537788][ T1013] ? panic+0x812/0x812 [ 52.541764][ T1013] print_address_description+0x81/0x3b0 [ 52.547174][ T1013] kasan_report+0x179/0x1c0 [ 52.551478][ T1013] ? tc_setup_flow_action+0xbb8/0x3630 [ 52.557131][ T1013] ? tc_setup_flow_action+0xbb8/0x3630 [ 52.562491][ T1013] __asan_report_load8_noabort+0x14/0x20 [ 52.568357][ T1013] tc_setup_flow_action+0xbb8/0x3630 [ 52.573670][ T1013] ? __kmalloc+0x1aa/0x330 [ 52.578068][ T1013] ? flow_rule_alloc+0x30/0x2b0 [ 52.582842][ T1013] mall_replace_hw_filter+0x394/0xc10 [ 52.588030][ T1013] ? mall_set_parms+0x440/0x440 [ 52.592731][ T1013] ? tcf_exts_destroy+0xb0/0xb0 [ 52.598021][ T1013] ? pcpu_memcg_post_alloc_hook+0x1c8/0x360 [ 52.603867][ T1013] ? pcpu_alloc+0xfa0/0x1420 [ 52.604429][ T430] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 52.608302][ T1013] ? mall_set_parms+0x4b/0x440 [ 52.620303][ T1013] ? mall_set_parms+0x1a2/0x440 [ 52.625065][ T1013] mall_change+0x573/0x7a0 [ 52.629305][ T1013] ? __kasan_check_write+0x14/0x20 [ 52.634271][ T1013] ? mall_get+0xb0/0xb0 [ 52.638380][ T1013] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 52.644310][ T1013] tc_new_tfilter+0x168e/0x1dc0 [ 52.648954][ T1013] ? mall_get+0xb0/0xb0 [ 52.653098][ T1013] ? tcf_gate_entry_destructor+0x20/0x20 [ 52.654026][ T316] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 52.658555][ T1013] ? security_capable+0x87/0xb0 [ 52.658572][ T1013] ? ns_capable+0x89/0xe0 [ 52.658596][ T1013] ? netlink_net_capable+0x125/0x160 [ 52.679948][ T1013] ? tcf_gate_entry_destructor+0x20/0x20 [ 52.685514][ T1013] rtnetlink_rcv_msg+0x77a/0xc50 [ 52.690277][ T1013] ? is_bpf_text_address+0x172/0x190 [ 52.695612][ T1013] ? rtnetlink_bind+0x80/0x80 [ 52.700134][ T1013] ? arch_stack_walk+0xf3/0x140 [ 52.704881][ T1013] ? stack_trace_save+0x113/0x1c0 [ 52.709740][ T1013] ? __kasan_check_write+0x14/0x20 [ 52.714684][ T1013] ? stack_trace_snprint+0xf0/0xf0 [ 52.719633][ T1013] ? avc_has_perm+0x14d/0x400 [ 52.724153][ T1013] ? memcpy+0x56/0x70 [ 52.727966][ T1013] ? avc_has_perm+0x275/0x400 [ 52.732674][ T1013] ? __kasan_slab_alloc+0xb1/0xe0 [ 52.737536][ T1013] ? slab_post_alloc_hook+0x61/0x2f0 [ 52.742649][ T1013] ? kmem_cache_alloc+0x168/0x2e0 [ 52.747512][ T1013] ? avc_has_perm_noaudit+0x240/0x240 [ 52.752717][ T1013] ? iov_iter_advance+0x258/0xb20 [ 52.757692][ T1013] netlink_rcv_skb+0x1cf/0x410 [ 52.762298][ T1013] ? rtnetlink_bind+0x80/0x80 [ 52.766796][ T1013] ? netlink_ack+0xb30/0xb30 [ 52.771234][ T1013] ? __netlink_lookup+0x37b/0x3a0 [ 52.776263][ T1013] rtnetlink_rcv+0x1c/0x20 [ 52.780626][ T1013] netlink_unicast+0x8df/0xac0 [ 52.785222][ T1013] ? netlink_detachskb+0x90/0x90 [ 52.790101][ T1013] ? security_netlink_send+0x7b/0xa0 [ 52.794108][ T292] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 52.795331][ T1013] netlink_sendmsg+0xa46/0xd00 [ 52.795355][ T1013] ? netlink_getsockopt+0x5c0/0x5c0 [ 52.812293][ T1013] ? security_socket_sendmsg+0x82/0xb0 [ 52.817932][ T1013] ? netlink_getsockopt+0x5c0/0x5c0 [ 52.822979][ T1013] ____sys_sendmsg+0x59e/0x8f0 [ 52.827870][ T1013] ? __sys_sendmsg_sock+0x40/0x40 [ 52.832796][ T1013] ? import_iovec+0xe5/0x120 [ 52.837320][ T1013] ___sys_sendmsg+0x252/0x2e0 [ 52.841890][ T1013] ? __sys_sendmsg+0x280/0x280 [ 52.846713][ T1013] ? __fdget+0x1bc/0x240 [ 52.850792][ T1013] __se_sys_sendmsg+0x1b1/0x280 [ 52.855464][ T1013] ? __x64_sys_sendmsg+0x90/0x90 [ 52.860238][ T1013] ? fpu__clear_all+0x20/0x20 [ 52.864753][ T1013] ? __kasan_check_read+0x11/0x20 [ 52.869604][ T1013] __x64_sys_sendmsg+0x7b/0x90 [ 52.874229][ T1013] do_syscall_64+0x34/0x70 [ 52.878497][ T1013] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.884345][ T1013] RIP: 0033:0x7f1661d92d29 [ 52.888965][ T1013] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 52.894203][ T430] usb 2-1: Using ep0 maxpacket: 16 [ 52.909093][ T1013] RSP: 002b:00007f1660404038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 52.909112][ T1013] RAX: ffffffffffffffda RBX: 00007f1661f82fa0 RCX: 00007f1661d92d29 [ 52.909120][ T1013] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000004 [ 52.909128][ T1013] RBP: 00007f1661e0eb08 R08: 0000000000000000 R09: 0000000000000000 [ 52.909136][ T1013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.909144][ T1013] R13: 0000000000000000 R14: 00007f1661f82fa0 R15: 00007fff2b423428 [ 52.909155][ T1013] [ 52.909162][ T1013] Allocated by task 1013: [ 52.909193][ T1013] ____kasan_kmalloc+0xdb/0x110 [ 52.975149][ T1013] __kasan_kmalloc+0x9/0x10 [ 52.979498][ T1013] __kmalloc+0x1aa/0x330 [ 52.983620][ T1013] tcf_idr_create+0x5f/0x770 [ 52.987967][ T1013] tcf_idr_create_from_flags+0x5f/0x70 [ 52.993586][ T1013] tcf_gact_init+0x373/0x6e0 [ 52.998629][ T1013] tcf_action_init_1+0x584/0x830 [ 53.003530][ T1013] tcf_action_init+0x2b5/0x800 [ 53.008214][ T1013] tcf_exts_validate+0x232/0x540 [ 53.013111][ T1013] mall_set_parms+0x4b/0x440 [ 53.017504][ T1013] mall_change+0x49e/0x7a0 [ 53.021973][ T1013] tc_new_tfilter+0x168e/0x1dc0 [ 53.026661][ T1013] rtnetlink_rcv_msg+0x77a/0xc50 [ 53.031554][ T1013] netlink_rcv_skb+0x1cf/0x410 [ 53.036140][ T1013] rtnetlink_rcv+0x1c/0x20 [ 53.040396][ T1013] netlink_unicast+0x8df/0xac0 [ 53.045359][ T1013] netlink_sendmsg+0xa46/0xd00 [ 53.050219][ T1013] ____sys_sendmsg+0x59e/0x8f0 [ 53.054525][ T430] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 53.054969][ T1013] ___sys_sendmsg+0x252/0x2e0 [ 53.063385][ T430] usb 2-1: config 0 has no interface number 0 [ 53.067710][ T1013] __se_sys_sendmsg+0x1b1/0x280 [ 53.067723][ T1013] __x64_sys_sendmsg+0x7b/0x90 [ 53.067736][ T1013] do_syscall_64+0x34/0x70 [ 53.067748][ T1013] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.067752][ T1013] [ 53.067775][ T1013] The buggy address belongs to the object at ffff8881158f1000 [ 53.067775][ T1013] which belongs to the cache kmalloc-192 of size 192 [ 53.075923][ T430] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 53.078627][ T1013] The buggy address is located 0 bytes to the right of [ 53.078627][ T1013] 192-byte region [ffff8881158f1000, ffff8881158f10c0) [ 53.078644][ T1013] The buggy address belongs to the page: [ 53.083362][ T430] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 53.087546][ T1013] page:ffffea0004563c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1158f1 [ 53.087561][ T1013] flags: 0x4000000000000200(slab) [ 53.087579][ T1013] raw: 4000000000000200 0000000000000000 0000000100000001 ffff888100043380 [ 53.087596][ T1013] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 53.094093][ T430] usb 2-1: config 0 interface 41 has no altsetting 0 [ 53.095510][ T1013] page dumped because: kasan: bad access detected [ 53.095536][ T1013] page_owner tracks the page as allocated [ 53.109638][ T292] usb 3-1: Using ep0 maxpacket: 32 [ 53.119225][ T1013] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 100, ts 5656558763, free_ts 0 [ 53.119247][ T1013] prep_new_page+0x166/0x180 [ 53.119257][ T1013] get_page_from_freelist+0x2d8c/0x2f30 [ 53.119267][ T1013] __alloc_pages_nodemask+0x435/0xaf0 [ 53.119289][ T1013] new_slab+0x80/0x400 [ 53.214530][ T316] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 53.224140][ T1013] ___slab_alloc+0x302/0x4b0 [ 53.224151][ T1013] __slab_alloc+0x63/0xa0 [ 53.224163][ T1013] kmem_cache_alloc_trace+0x1bd/0x2e0 [ 53.224174][ T1013] kernfs_fop_open+0x324/0xab0 [ 53.224184][ T1013] do_dentry_open+0x7c1/0x10d0 [ 53.224193][ T1013] vfs_open+0x73/0x80 [ 53.224204][ T1013] path_openat+0x2660/0x3000 [ 53.224226][ T1013] do_filp_open+0x21c/0x460 [ 53.228906][ T316] usb 1-1: config 0 has no interfaces? [ 53.234102][ T1013] do_sys_openat2+0x13f/0x710 [ 53.234113][ T1013] __x64_sys_openat+0x243/0x290 [ 53.234126][ T1013] do_syscall_64+0x34/0x70 [ 53.234138][ T1013] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.234143][ T1013] page_owner free stack trace missing [ 53.234148][ T1013] [ 53.234152][ T1013] Memory state around the buggy address: [ 53.234178][ T1013] ffff8881158f0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.240909][ T316] usb 1-1: New USB device found, idVendor=045e, idProduct=00f4, bcdDevice=d5.51 [ 53.243370][ T1013] ffff8881158f1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.243389][ T1013] >ffff8881158f1080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 53.254047][ T316] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.258100][ T1013] ^ [ 53.258113][ T1013] ffff8881158f1100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.258131][ T1013] ffff8881158f1180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 53.263496][ T316] usb 1-1: config 0 descriptor?? [ 53.267763][ T1013] ================================================================== [ 53.267768][ T1013] Disabling lock debugging due to kernel taint [ 53.562112][ T292] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 53.571992][ T292] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 53.580484][ T292] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 53.589560][ T292] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 53.600101][ T292] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 53.610168][ T430] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 53.619068][ T292] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 53.632610][ T430] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.640592][ T430] usb 2-1: Product: syz [ 53.644667][ T292] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 53.653775][ T292] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.661750][ T430] usb 2-1: Manufacturer: syz [ 53.666591][ T430] usb 2-1: SerialNumber: syz [ 53.671732][ T430] usb 2-1: config 0 descriptor?? [ 53.675130][ T24] kauditd_printk_skb: 15 callbacks suppressed [ 53.675147][ T24] audit: type=1400 audit(1736870072.990:403): avc: denied { execute } for pid=1006 comm="syz.0.237" path="/55/cgroup.stat" dev="tmpfs" ino=305 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 53.677398][ T292] usb 3-1: config 0 descriptor?? [ 53.705729][ T1002] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 53.717446][ T1002] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 53.724826][ T54] usb 1-1: USB disconnect, device number 6 [ 53.957059][ T1002] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 53.964241][ T1002] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 53.965205][ T292] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 54.175017][ T24] audit: type=1400 audit(1736870073.500:404): avc: denied { read write } for pid=1010 comm="syz.2.238" name="lp0" dev="devtmpfs" ino=611 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 54.195056][ T292] usb 3-1: USB disconnect, device number 5 [ 54.199397][ T24] audit: type=1400 audit(1736870073.500:405): avc: denied { open } for pid=1010 comm="syz.2.238" path="/dev/usb/lp0" dev="devtmpfs" ino=611 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 54.207515][ T292] usblp0: removed [ 54.232390][ T430] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 54.238029][ T24] audit: type=1400 audit(1736870073.500:406): avc: denied { ioctl } for pid=1010 comm="syz.2.238" path="/dev/usb/lp0" dev="devtmpfs" ino=611 ioctlcmd=0xf50f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 54.250172][ T430] CoreChips: probe of 2-1:0.41 failed with error -71 [ 54.280655][ T430] usb 2-1: USB disconnect, device number 7