last executing test programs: 5.053313494s ago: executing program 0 (id=79): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='!:\b', 0x3) 4.97672164s ago: executing program 4 (id=80): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x5, 0x4, 0xf06, 0x0, 0x84, 0x81, 0x5}, 0x9c) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000740)='wg0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000014c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2, 0xfffc, 0xe652, 0x2, 0x85, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0xff80, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) 4.931691376s ago: executing program 0 (id=81): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x4001, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, 'gre0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 4.412477033s ago: executing program 2 (id=82): syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(r5, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9}}}, &(0x7f00000000c0)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x801f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 4.107653752s ago: executing program 0 (id=84): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001340)=@newtfilter={0x34, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x0) 4.104240154s ago: executing program 4 (id=85): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) syz_emit_ethernet(0x36, &(0x7f0000000700)={@multicast, @local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x1, 0x2, 0x0, @rand_addr=0x1010164, @multicast1}, "2200354f0000000104000001e1010203c0a80101"}}}}, 0x0) 3.588456833s ago: executing program 4 (id=86): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x84b4b48d8e4e640f}, 0x40000) r1 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r1, r0, &(0x7f00000000c0)=0x58, 0xa) 3.575993875s ago: executing program 0 (id=87): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000001c0), r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)=ANY=[], 0x44}}, 0x0) 3.404327872s ago: executing program 2 (id=90): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000) read$FUSE(r1, &(0x7f0000003b80)={0x2020}, 0x2020) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_io_uring_setup(0xf03, 0x0, &(0x7f0000000100), 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000002980)=[{&(0x7f0000000740)=""/201, 0xc9}], 0x1) 3.301127278s ago: executing program 4 (id=91): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_INPUT(r0, &(0x7f0000001740)={0x8, {"2cc37ded11affd0c76bf1345c2275847b5c2334d8266b3276a67dbf94a3bf405a65127a53db41d9e2ead7e19ba806ec3e11c404a49729fba99775cea49428852a132d03d848b1c8c9466d3dccd47cf7600660bf6528d1e710468297ca28b40d3bad6e948068a8cfd3bdc9e49c51a7d37c49608f5c746fa6b8d1e4e8a5451d717f5c720e0e3c4e837abd1b9b298abd281e3b051924df5f8e9e30fb40deafc36acbbe7933546ce478ff7d448a0425244ce9daefd1c7b2038effc81a7fa8bd234105a9470f8f74c95895985abd9e9ff774e9adac413f6086ed6033e109195de94a646303356eb8ee029cda553e642e5b565fed8b927f1616e0b6eab3fe25e01de39738ddcca3a8115d6500af443859694f7defcc19cf1a6edbf6735afbd253bc8ebbcbb8c88d3acece3ce1b41203f75874a33c27a58a214e13e1b6d7825e1b34b53e75cf63b14ca46d598600c1e9dc2d43ec538f7de923e9ec1a9e06727eca3d97bbb3d5b4ef3657dc6b8355a21cab77dc4ebe16cb11c28a819a43e7df1d8b5ef4d7fc5b0314d52602ea58e0c4088f6869039679982f6f4c2e859a73a68715879a87e7faa7480ac5d92fa06d48d8cd73575f568a6f3fbe11ddc84f62e78efe59095673a08055b7f5973cc4714479f0d5cade2508992ef77b4468592167209d8728e1258a6ba19827c5df731b38986c71c09822ad85d556f290a8d0cb6e7e9d0139d4584561cc81ac43f48141f282d819115894df54816ff1882e476fe376a2ae605733dd136ff7d524a7c90d51077779100c5b467c7e4fb96293ce8c8dbd84c4760ec17e55eab933bb044ce62d67d085aa882d1ffa1156d2d2a840d9755ff284500014325098e8f4b1480bd25294e44eb8e3eee8bdeb5a68de82d942ea45cbfbc24151387a96639c6d6c6225738714678d16abf10faa3ec0dfaa501795683104827c209a51d0e1381574e2c8407b040cf7a0e8a76fd019f1d62fb24827619cdabf04cdeb1ac7e88df58b9223ff3936c1d542b6f30d04c55eae7911ad168997624527502316c57d8af60183f45ae1edc59553f63eaf3b0116c5f6cac3e9d86bd73d8f0155f1f2c9dfe20ded5adf8392d9eb04c42a1d23c0109c0c0f00fabfa6192eca9fa46ec94ac8872088f50e836e17880e03851c83f6e5455898d226aef0b1dd831f90b5256c42464ce8fce0bc08db14539a53ed6bf199ea95c83b1c1d85b41cd355f9c3a222b437d3578511dec932023fcc3df17af7b4eb34a307b4b64162fa749ca775e8ba18a5c046eb56e19e40aefe78f6b29be4778e1443e4839ebbd9a602d60fb25c5eac1a55bb2201618574e0d60bae8375cacd42b38b65470aa89bc8ab86ad869627f65d69755454d2d979196d2b88fcdd526a18397361418a882ba9c1adca07d23ad838f759e5b5a5e1f065db90e8527611ac0080852a7b6069884d8d4e9d76b9f0da466664039cb75bc32684096095b00497983160c4e9cdec9c305eb5448fc529574d607d538aeb8560f743d328d356449f20e051e025ac1a86f8bd886f26b4bbbcb4b873c17a9310b159f02095660c27fceb1708476b7dbd42bf6ca90c207f08359e7be7cabde426a71cb1b2ba7b2393bae27f434afbb47d2989361cefadf9401c6cb441f41f2c2f517f55bb1925b5922cbc744cd4a8dba6045f607ccee16bcfaf8bdb0a715c54146651d312c011192f31546b2f2081f3f5d57505086c376c7a7c155e85edfa2b59518fa7843498e10f068936bc6f9a20deabca7a95962f6079bfd67a6ef6e855f2054245b2bd7446930a82991eff4de6aa747c9675e2c943ae2710f348c5957f7d61293624be6d90bbd6f9f8be9b7539920ac7e46f14387e3dfa132a556ffe108fb1dee751b2595523c7c06f0d93ed225dda884776e9fe40e14aa0b4d4acc20361bfeaeeec37aa37db71a38f8c6da9d66a5e305b5622983fdc19fad861e7db0e47a8478396b63fe08fa4419d8cd27a640d4561bc661183c5fc2adb6b7441ce69cc05379cbb396394de8575058668a31fedfce48ee6604e8207d869a5612d80b1b6ba57e9c45a2ad305ba454406268ee2183149b7ccd67243cd5714bbe0310f4b25f815414309e73f2155b0c8563aa44b9e43c62c5f0a2d4309b4c6d022034128717d9a3371583213e7f7d41a6ef285a43f980818556509c2e2bd603dbb1060c36b9b4a783509588410f0da9c589fd04e1b361cbfe3bb54959719307f4d036e4ea2bb77f36d6bf18ae85633869b96ea863c29738cb15984843d5ccf2a44b339cf12c3b6292fd9500fecf1db25df401d3b8bbf3d398c62f19b0211d80793291505a980e249cbfbd29cc7744b6b9d4ba5b79a77f70cd8268b5947dd14cef117be0fd5049944e53977d8652d0b2d5ba9ede8f0c4b2bffbe1ee1f41934df8d6f10bb3d137fd15245c7c667ee2ff71ecdcab4df46626f0f5e4d93318a4362d0ec41ab58934f2fc72480a15feafd657f6ebe58c74bf3e2220f103374b9e19f2cc7566d3ad1da9813574bfcf6fc62913a4cadef73cc0de170252c401b363c2ee8bcb46aa0a817b2ae8767e290437188f6e3d0456a8d0a052e46c65c300364f607a52cb299f9adda0f47c9c539c104fecded7343cea7d260d899cdc6b4abec0928d73fcdc8b7e6f363a25a0279ebfe5ee1982a9e4339f5a3c0be91d0e270de523eb74cf9aacb4f551e7fa03ad720c0a86930852b7107175515e047a1096eaaea0db9b6c2569796f58bf217baf11083c2262de3a1bda6d4c002ed38a591305d1efca2dbd5f98dbb3aef79619c980f522ca5680d7660211935337cc8c587079bb6159c7eaf2e64bf9bdb725c558e76a31c30f7928280afae1591df60e0630ca1b5a99c555b191ac5be95b8495e1bcc093905b6f8544d081ac8ff17406b7a7c96b9a41358c85b194ba92612d35d9cc08b7d9051aad6eeb444948015aba4b8018e2f8c06d883a5ebe21f36ccb9b8728b0fea59b2e9e597d65c72cab11bfa61862f061e0100fa5ba84a0a765cba0b4631ed93f8513282c749396c49b33f882d4feeda0fe7a56058f8e078f35647d2dff01aa4db3bbb2dac0b974d90d3c8f9ab6a27b579a015705628864e2bd5f8f5266da713a37c611984eed0620b243b5a90be03270e59cad5cdf90867bd98ed3775aee2bb13fe769390ed6053001e9312bdb690cb5f37b8670f6e45b5f4f1a6943cccbe558bcff7f757aed48c1e4327f0d25fc2932dacd890d2ca43fc69295ce73234be766f487ae4676546c47cb49a3d7850ab96a815723568ccd96d0ec6dea75aa973b5866ec7370fbd885a0873a605e7e0225c6ad1fd02693de40bb801b60a8eb6660e9e4b5e9fcf98cd042e47ff2e72532a3bb1b01f23b7716f6fca16ad12f6c4186953ccf173c66889ba2fa29cd642835fd64fadbbd32bdefce7f3b196cfcb9fd8e4bde02d0fee62fe0fbfbab377d544e6224907ed55275ae5a6945a9902bbaf69f5a3ede4e41729895fe7f89bada11377cfebe34a2ad16be133056527b4458f1ce5c038f80e0ec29dc9254f68d0a8530020725ff7205fdf437fd2a0596b327e5efafce4622a6e26c35b963b92af03e6b6cb0e41914e8feea3607e35fe19015622e9c0104d9536a68a45e9a2cfee179053bb194a1d7472239f363edd50324dca7d51feb68cd25681020de9d78b66aff65f8851051ef59bce5964cc64c9357b8bfc5254fd537db1175376eb19e11a16306b10aaf3a777ba945663bd77a51bfb7b8d30f2a9056c2cd23a6e870a81288f8d7dbc7cab954c8c1212b0cd03ff3996cd01f027f983aa876f727dfd9e554ed15acf64ea9664d2fad08234db79732603e52e40d433ed842c83cdaf58b055fb89eab687f7a3e73f8d6233ffbba204e2de8ea66f201d6511730bd72be744ed550434692ccd65985006ef3b90206c2248c0c2f8dc5c2e8da32bf72dd3539b9a05d55a33d89b1154b852f574ef308f31b91caafa5a486f5b163d6050ae84ba908ed7047e30428ae51a8f3f0d48ddd7da449df94c66b98fdeae61d276a055d2ef0ee8de95dc88b71d9b419c37f6ff8f6cc8336d4cea5749fd75a4705b77a8f4559c953e1e29fe2c8d2547f414bd9f4700144fd5a7db5825d70edc0159d31857b51d6ba712364664df6d380640483566b2dcd10242042a43e2a50a156c1a247408e619b9296bc225fcede86c7b2b7eb3a8e40437686db04936346ac7d4b07bdaa7e57a2d21dff0f357a4f69bf398c506c24cbfa1540954e817aea8171d63a1587846663e65f61ddcf091f070f2cadc7d14b9f4dc19270dfa7487b305fefb4bd3e4f88ca6e442e34983b4fe119ec12eed9d56b43f4fd6c57ff66ce1dc545ce8cc3cd2cc9379e53d92992d811e945513ac6ed61df4ea3e683b98f4dd2c08339846a782989e1abec6b1af3e8da4514940ae3d228c47d991c1ebe18cc105f7cd32923f6fafe9395a2be9988c6347d0d9ada60d56f2b727de394cc2c3ccd239fd606e3617a5a290c026759949327c3898b1688903e8e9f811ecd23735ef3a13291fc0cd61d3318b940948397e74637a397feea98371150c7e6815a2ad043be266445fcebf147047126057c1f0c8c12b912821f5a360075d1389f65f8377300a7ba2472e51da3c5dd0b4e934a4c0bbc7ea66a1910f13672f8defa186780163edef6832cbe613c34003bd71cd6e573639d974bef9e7ddbbe6b875d0ceaf38ccc1f77284e827406bc7477aadbf83ce15db10feecaf1b6172039903a3a40d38594a7b9a0001730a8720b7a4018c9fe319bd28a0ba8f6844907a76ed5454db36bb78a5e5dbb3137dc01f74a316a3348136f5285c634b5c19a94481ca86ffd5edb4f555943d34e55b71e76a691f665102d91b17d53ab3d311f1094a4f0523fa1ca91c8d6ba17772e17dc681c8096e79d1263113b98b8900cf1f1be3dd06beddeecfdb222dd58a3ec18f3e0baaf53beaa218f982ae44741e94bb4ba03738669df2229443e9de3f614a723da47868649889b7783fe2542400541c418814978f3fb92dd6ec5e6f87abc83dd3f1b2ec8e6ee57c8f6ba31116d01d7b31f14df3a537362ce7b5b31ca37415ff9bd7accc75c44a2b6486fd34d1a7c894741b2f915c679aeb787d697733155ac7682175f434947e2a2327f8afbaf54f23ae2eb118883fa4e21408fb84b21c0f29d25dc0700853ecd47ca79283316852cd96e5f499828510d692ddf4993617f0928f821364b381f4810a0901031451d945af50a50213447e0b0cb35e7cbc4b712cb0d0fbff44b19f6ef25d3ba9c303b9bb0f876caa96307ec9f463a5f8fa38e9087947cd75932225bfa988c83b2b7df5e86e78576db907bddc1659f0e45c19c1257c7215d182981a2aba45ac72e1274a43832a76b09e53d39de19800afb6f731e0b04ad04d1503a2336655da07f2f9c0d5bc3b07549a93aac8e3d3cb72d02b40658e91480ee46ef961be0fd7a9bf037b731324cd0b50edf455a706ce2c86abe42565290564351d2262d6df1efa86477d895458c2fb6d35f86b1a8c59c495cdb990276b9f7e87e075debb88c6f56c90d7f6e2482e8f1f411fadcbee2c7aaa71d319141193b31d509aece690caa4b4988af42b9325b771ecda3efca40a03761fd8fafc535131a1f65d3c33ad6dede501dceba29d2450da7a6c1813d838efbc40c3d92fb39d10de186674f151c7f05514e12e8944cecd4a80d61b153dc6fc2187eedc52d797bebfbce1d8f4eb93a4b86e0bca70cb7839cc9e4136b725e723e5c3a511c54c34e429707a04b09a2489af85164dc48e508f2b04d27e5694", 0x1000}}, 0x1006) 3.235729082s ago: executing program 1 (id=92): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') sendmmsg(r0, 0x0, 0x0, 0x0) 3.20739974s ago: executing program 4 (id=93): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) ioctl$HIDIOCGRDESC(r1, 0x90044802, &(0x7f00000001c0)) 2.735997522s ago: executing program 1 (id=94): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='.\x00', 0x400) r6 = dup(0xffffffffffffffff) inotify_rm_watch(r6, r5) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010101}, 0x10) r8 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000400)={0xf0f000, 0x1}) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa72bb08004504001ce20000000002867800000000e001030011009078000000"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c2498f00080045000058f541cc48c2a3a2e6000000e0e000c800b4806558000000001039986e410086dd080088be000000001000000088f7ffff00000000080022eb000000"], 0x0) r9 = socket(0x10, 0x2, 0x0) write(r9, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r9, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x8, 0x3, &(0x7f0000000180)=ANY=[@ANYRES64=r1], &(0x7f0000000480)='syzkaller\x00'}, 0x94) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180a0000000000000000000000000000850000006600000095"], &(0x7f0000000000)='syzkaller\x00', 0xc, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 2.594621603s ago: executing program 0 (id=96): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x24}, 0x1, 0x5502000000000000}, 0x4001) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301, 0x400000000000001}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7e, 0x0, &(0x7f0000000140)="d2ffb49ede31518d65a476a96e4a4e0b75db47ec5454c327bb5b7233ac3507e16db41d0000008000000000a8ca9d22a565ff96d46e88faa10ff4240c00"/70}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) 2.548866833s ago: executing program 2 (id=97): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) syz_emit_ethernet(0x36, &(0x7f0000000700)={@multicast, @local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x1, 0x2, 0x0, @rand_addr=0x1010164, @multicast1}, "2200354f0000000104000001e1010203c0a80101"}}}}, 0x0) 2.359495827s ago: executing program 2 (id=98): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x400c4d00, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@ipv4_newaddr={0x20, 0x14, 0x601, 0x0, 0x0, {0x23, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x8, 0x2, @empty=0x4000000}]}, 0x20}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@getqdisc={0x2c, 0x26, 0x100, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x5, 0x2}, {0x6, 0x1}, {0x1, 0x8}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x20040000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r4, &(0x7f00000004c0)='\x00', 0x1) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r4, 0x800c5012, &(0x7f00000000c0)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x3, 0x6, 0xfffffffb}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x4, {{0xf7dff7e8, 0x0, 0x3, 0x0, 0x1}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) 2.122644585s ago: executing program 3 (id=99): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x1, 0x1, 0x3, 0x2}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='fdinfo/4\x00') unshare(0x22020400) pread64(r1, &(0x7f0000002140)=""/17, 0x11, 0x0) 1.702314191s ago: executing program 3 (id=100): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a6970"], 0x60}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="6800000004060500000000ac000000000000000a05000100070000000500010007000000"], 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 1.652619309s ago: executing program 3 (id=101): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)=0x7, 0x4) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000000c0)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.607766677s ago: executing program 1 (id=102): msgrcv(0x0, 0x0, 0x0, 0x3, 0x5000) 1.551459024s ago: executing program 0 (id=103): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB='<\x00\x00'], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) unshare(0x62040200) 1.496629121s ago: executing program 1 (id=104): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x15, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000019b704000000000000850000003300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000860000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000046cb95a850000008200000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r2, 0x2000012, 0xd, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 1.477590997s ago: executing program 3 (id=105): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmctl$SHM_INFO(0x0, 0xe, 0x0) r3 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) 1.409035566s ago: executing program 1 (id=106): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x22) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x40002017, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x11) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$dvb_demux(&(0x7f0000000080), 0xc, 0x101040) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f0000000040)={0x80, 0x0, 0x0, 0x5}) 1.408625319s ago: executing program 4 (id=107): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x3d}]}, &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0', 0xa) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r2 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000480)={0x80000000, 0xffffffffffffffff, 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x50) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000400012800c0001006d6163766c616e0030000280080003000300000008000100100000001c0005800a000400aaaaaaaaaa2d00000a0004003426f7b68ed1000008000500", @ANYRES32=r5], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) getsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000001040)=[{}], &(0x7f0000000100)=0x8) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000001c0), &(0x7f0000000780)={'syz', 0x1}, 0x0, 0x0, r6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x8000000}) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETA(r7, 0x5406, &(0x7f0000000200)={0xfff, 0xa925, 0x9, 0x8007, 0x8, "7a3800e5ffffff00"}) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000006c0)=0x16) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={@cgroup, 0xe, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad19576", 0x544, r6) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r8}, &(0x7f0000000840)=ANY=[], 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map=r3, r0, 0x7}, 0x10) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x7fff8) 776.993509ms ago: executing program 2 (id=108): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000002d0007012bbd7000fedbdf25067c00001c0001"], 0x34}, 0x1, 0x0, 0x0, 0x10000004}, 0x4008030) 732.965976ms ago: executing program 2 (id=109): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2481, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$inet(0xa, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_TARGET={0x8, 0x8, 0x2}]}}]}, 0x44}}, 0x4890) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xfffc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x7, 0x8005, 0x5, 0xfffffdff, 0x4006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0x9, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 436.845253ms ago: executing program 3 (id=110): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f0000002280)=""/4090, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0), 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r7 = add_key$user(&(0x7f0000002300), 0x0, &(0x7f0000000540), 0x0, r6) keyctl$dh_compute(0x17, &(0x7f0000000400)={r5, r7, r5}, &(0x7f0000000440)=""/206, 0xce, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0x2000016c, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}]}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 2.256521ms ago: executing program 1 (id=111): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x6d, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x11}}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 0s ago: executing program 3 (id=112): openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f00000001c0), 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x80000100, @loopback, 0xfffffffe}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r1, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.60' (ED25519) to the list of known hosts. [ 72.555556][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 72.555578][ T29] audit: type=1400 audit(1786307391.059:129): avc: denied { mounton } for pid=5583 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 72.586065][ T29] audit: type=1400 audit(1786307391.089:130): avc: denied { mount } for pid=5583 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.589417][ T5583] cgroup: Unknown subsys name 'net' [ 72.616117][ T29] audit: type=1400 audit(1786307391.119:131): avc: denied { unmount } for pid=5583 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.736887][ T5583] cgroup: Unknown subsys name 'cpuset' [ 72.745041][ T5583] cgroup: Unknown subsys name 'rlimit' [ 72.875297][ T29] audit: type=1400 audit(1786307391.379:132): avc: denied { setattr } for pid=5583 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 72.920474][ T29] audit: type=1400 audit(1786307391.379:133): avc: denied { create } for pid=5583 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.941554][ T29] audit: type=1400 audit(1786307391.379:134): avc: denied { write } for pid=5583 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.962277][ T29] audit: type=1400 audit(1786307391.379:135): avc: denied { read } for pid=5583 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.983710][ T29] audit: type=1400 audit(1786307391.389:136): avc: denied { mounton } for pid=5583 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 72.990620][ T5585] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 73.009027][ T29] audit: type=1400 audit(1786307391.389:137): avc: denied { mount } for pid=5583 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 73.040624][ T29] audit: type=1400 audit(1786307391.519:138): avc: denied { relabelto } for pid=5585 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 74.011764][ T5583] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.724817][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 77.724838][ T29] audit: type=1400 audit(1786307396.219:143): avc: denied { create } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 77.757548][ T29] audit: type=1400 audit(1786307396.219:144): avc: denied { read write } for pid=5594 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 77.781863][ T29] audit: type=1400 audit(1786307396.229:145): avc: denied { open } for pid=5594 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 77.811799][ T29] audit: type=1400 audit(1786307396.229:146): avc: denied { ioctl } for pid=5596 comm="syz-executor" path="socket:[4675]" dev="sockfs" ino=4675 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 77.845927][ T5609] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.854968][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.862870][ T5612] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.869343][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.871008][ T5612] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.877803][ T5609] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.895417][ T5612] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.899440][ T5613] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.910842][ T5614] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.911589][ T5612] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.918018][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.931352][ T5613] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.933446][ T5609] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.940337][ T5612] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.946468][ T5614] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.954589][ T5612] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.960939][ T5614] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.968299][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.981263][ T5609] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.989446][ T29] audit: type=1400 audit(1786307396.479:147): avc: denied { read } for pid=5594 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 77.990983][ T5609] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.011365][ T29] audit: type=1400 audit(1786307396.479:148): avc: denied { open } for pid=5594 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 78.041459][ T5609] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.042991][ T29] audit: type=1400 audit(1786307396.539:149): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 78.048681][ T5609] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.079497][ T5614] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.086860][ T5614] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.094388][ T29] audit: type=1400 audit(1786307396.569:150): avc: denied { module_request } for pid=5594 comm="syz-executor" kmod="netdev-nr2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 78.116287][ T5607] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.135687][ T29] audit: type=1400 audit(1786307396.599:151): avc: denied { sys_module } for pid=5594 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 79.379919][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.387164][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.395289][ T5597] bridge_slave_0: entered allmulticast mode [ 79.402018][ T5597] bridge_slave_0: entered promiscuous mode [ 79.409672][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.417536][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.424729][ T5594] bridge_slave_0: entered allmulticast mode [ 79.431707][ T5594] bridge_slave_0: entered promiscuous mode [ 79.448653][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.455797][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.462917][ T5595] bridge_slave_0: entered allmulticast mode [ 79.472082][ T5595] bridge_slave_0: entered promiscuous mode [ 79.486640][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.494017][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.501092][ T5597] bridge_slave_1: entered allmulticast mode [ 79.508030][ T5597] bridge_slave_1: entered promiscuous mode [ 79.522125][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.530000][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.537650][ T5594] bridge_slave_1: entered allmulticast mode [ 79.544647][ T5594] bridge_slave_1: entered promiscuous mode [ 79.558095][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.565330][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.572425][ T5595] bridge_slave_1: entered allmulticast mode [ 79.579353][ T5595] bridge_slave_1: entered promiscuous mode [ 79.624518][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.641367][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.659765][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.670570][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.680011][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.687356][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.694754][ T5596] bridge_slave_0: entered allmulticast mode [ 79.701385][ T5596] bridge_slave_0: entered promiscuous mode [ 79.710285][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.735120][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.759577][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.766773][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.774032][ T5596] bridge_slave_1: entered allmulticast mode [ 79.780783][ T5596] bridge_slave_1: entered promiscuous mode [ 79.811625][ T5595] team0: Port device team_slave_0 added [ 79.835216][ T5594] team0: Port device team_slave_0 added [ 79.842218][ T5595] team0: Port device team_slave_1 added [ 79.862039][ T5597] team0: Port device team_slave_0 added [ 79.876255][ T5594] team0: Port device team_slave_1 added [ 79.896486][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.907174][ T5597] team0: Port device team_slave_1 added [ 79.926799][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.933829][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.959785][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.973412][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.980384][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.006499][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.014193][ T50] Bluetooth: hci3: command tx timeout [ 80.019637][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.045945][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.053082][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.060412][ T5599] bridge_slave_0: entered allmulticast mode [ 80.067186][ T5599] bridge_slave_0: entered promiscuous mode [ 80.074685][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.081625][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.107509][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.143790][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.150740][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.178498][ T50] Bluetooth: hci0: command tx timeout [ 80.178681][ T50] Bluetooth: hci2: command tx timeout [ 80.184102][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.200374][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.207584][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.214870][ T5599] bridge_slave_1: entered allmulticast mode [ 80.221631][ T5599] bridge_slave_1: entered promiscuous mode [ 80.228332][ T50] Bluetooth: hci1: command tx timeout [ 80.233315][ T50] Bluetooth: hci4: command tx timeout [ 80.246914][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.253896][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.279832][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.297170][ T5596] team0: Port device team_slave_0 added [ 80.303333][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.310278][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.336284][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.369156][ T5596] team0: Port device team_slave_1 added [ 80.381528][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.393025][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.406338][ T5595] hsr_slave_0: entered promiscuous mode [ 80.412471][ T5595] hsr_slave_1: entered promiscuous mode [ 80.451614][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.458699][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.484865][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.496918][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.503909][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.529912][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.549803][ T5599] team0: Port device team_slave_0 added [ 80.576408][ T5594] hsr_slave_0: entered promiscuous mode [ 80.582470][ T5594] hsr_slave_1: entered promiscuous mode [ 80.588608][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 80.595230][ T5594] Cannot create hsr debugfs directory [ 80.602843][ T5599] team0: Port device team_slave_1 added [ 80.628778][ T5597] hsr_slave_0: entered promiscuous mode [ 80.634893][ T5597] hsr_slave_1: entered promiscuous mode [ 80.640725][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 80.646454][ T5597] Cannot create hsr debugfs directory [ 80.689984][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.696992][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.723080][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.745769][ T5596] hsr_slave_0: entered promiscuous mode [ 80.751802][ T5596] hsr_slave_1: entered promiscuous mode [ 80.757843][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 80.764105][ T5596] Cannot create hsr debugfs directory [ 80.774313][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.781261][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.807587][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.940370][ T5599] hsr_slave_0: entered promiscuous mode [ 80.946623][ T5599] hsr_slave_1: entered promiscuous mode [ 80.952497][ T5599] debugfs: 'hsr0' already exists in 'hsr' [ 80.958355][ T5599] Cannot create hsr debugfs directory [ 81.192522][ T5595] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.204324][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.221748][ T5595] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.231835][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.239334][ T5595] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.248684][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.266937][ T5595] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.275769][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.333880][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 81.342820][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.350552][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 81.359609][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.367656][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 81.376247][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.384330][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 81.393737][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.468506][ T5597] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.478699][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.487263][ T5597] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.496708][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.505064][ T5597] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.514121][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.521857][ T5597] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.531830][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.622095][ T5599] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.631531][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.640004][ T5599] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.649181][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.658235][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.672083][ T5599] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.681547][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.689684][ T5599] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.700057][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.752731][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.790655][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.798030][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.808070][ T5596] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.818821][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.826736][ T5596] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.838227][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.846821][ T5596] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.856693][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.866015][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.879082][ T5596] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.889169][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.905500][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.912571][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.967144][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.995325][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.002416][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.019019][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.037073][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.044143][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.063951][ T50] Bluetooth: hci3: command tx timeout [ 82.111365][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.136943][ T29] audit: type=1400 audit(1786307400.629:152): avc: denied { sys_module } for pid=5595 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 82.161612][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.168718][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.198134][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.205321][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.224895][ T5614] Bluetooth: hci0: command tx timeout [ 82.230646][ T50] Bluetooth: hci2: command tx timeout [ 82.251105][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.281614][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.304121][ T50] Bluetooth: hci4: command tx timeout [ 82.309936][ T5614] Bluetooth: hci1: command tx timeout [ 82.357376][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.378644][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.424377][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.431540][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.459176][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.466971][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.494424][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.501610][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.535379][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.542564][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.766189][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.010521][ T5595] veth0_vlan: entered promiscuous mode [ 83.092850][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.120364][ T5595] veth1_vlan: entered promiscuous mode [ 83.208545][ T5595] veth0_macvtap: entered promiscuous mode [ 83.252571][ T5595] veth1_macvtap: entered promiscuous mode [ 83.330435][ T5594] veth0_vlan: entered promiscuous mode [ 83.362318][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.392796][ T5594] veth1_vlan: entered promiscuous mode [ 83.407233][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.419966][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.464341][ T80] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.522994][ T5594] veth0_macvtap: entered promiscuous mode [ 83.535636][ T35] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.549913][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.588541][ T5594] veth1_macvtap: entered promiscuous mode [ 83.618031][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.645251][ T35] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.678158][ T5597] veth0_vlan: entered promiscuous mode [ 83.690930][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.719357][ T5597] veth1_vlan: entered promiscuous mode [ 83.729113][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.739050][ T667] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.755685][ T667] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.822414][ T667] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.831990][ T667] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.848053][ T5596] veth0_vlan: entered promiscuous mode [ 83.867053][ T5596] veth1_vlan: entered promiscuous mode [ 83.872738][ T29] audit: type=1400 audit(1786307402.369:153): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/root/syzkaller.Wrfkyd/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 83.902774][ T29] audit: type=1400 audit(1786307402.369:154): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.928915][ T29] audit: type=1400 audit(1786307402.399:155): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/root/syzkaller.Wrfkyd/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 83.958165][ T80] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.970160][ T29] audit: type=1400 audit(1786307402.399:156): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 83.992298][ T29] audit: type=1400 audit(1786307402.429:157): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/root/syzkaller.Wrfkyd/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 84.020851][ T5597] veth0_macvtap: entered promiscuous mode [ 84.038850][ T5595] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 84.050864][ T5596] veth0_macvtap: entered promiscuous mode [ 84.055453][ T29] audit: type=1400 audit(1786307402.429:158): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/root/syzkaller.Wrfkyd/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7574 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 84.074932][ T5596] veth1_macvtap: entered promiscuous mode [ 84.094978][ T29] audit: type=1400 audit(1786307402.429:159): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 84.114724][ T35] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.119715][ T29] audit: type=1400 audit(1786307402.469:160): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 84.147519][ T50] Bluetooth: hci3: command tx timeout [ 84.162613][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.166852][ T29] audit: type=1400 audit(1786307402.469:161): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="gadgetfs" ino=7576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 84.196401][ T29] audit: type=1400 audit(1786307402.469:162): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 84.219281][ T80] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.219611][ T80] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.240623][ T5597] veth1_macvtap: entered promiscuous mode [ 84.252826][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.261395][ T5599] veth0_vlan: entered promiscuous mode [ 84.308065][ T5599] veth1_vlan: entered promiscuous mode [ 84.323244][ T35] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.332668][ T50] Bluetooth: hci2: command tx timeout [ 84.338827][ T50] Bluetooth: hci0: command tx timeout [ 84.349305][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.371464][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.384832][ T50] Bluetooth: hci4: command tx timeout [ 84.390323][ T50] Bluetooth: hci1: command tx timeout [ 84.478310][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.498103][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.499176][ T667] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.508142][ T1059] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.518092][ T667] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.542772][ T1059] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.557189][ T1059] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.680284][ T1059] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.908324][ T5599] veth0_macvtap: entered promiscuous mode [ 84.931366][ T5599] veth1_macvtap: entered promiscuous mode [ 85.037983][ T5794] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3'. [ 85.055588][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.089056][ T1059] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.097330][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.105712][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.112705][ T1059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.238850][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.317041][ T5798] netlink: 'syz.2.7': attribute type 1 has an invalid length. [ 85.329087][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.344099][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.481835][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.494433][ T1059] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.513651][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.014185][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.060337][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.226183][ T5614] Bluetooth: hci3: command tx timeout [ 86.274314][ T1164] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.278354][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.389271][ T5614] Bluetooth: hci0: command tx timeout [ 86.394929][ T5614] Bluetooth: hci2: command tx timeout [ 86.464105][ T5614] Bluetooth: hci4: command tx timeout [ 86.469858][ T50] Bluetooth: hci1: command tx timeout [ 86.686076][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.706145][ T5810] capability: warning: `syz.1.10' uses 32-bit capabilities (legacy support in use) [ 86.770511][ T667] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.782885][ T667] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.855655][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.890226][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.951601][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.974796][ T5813] binder_alloc: 5811: binder_alloc_buf, no vma [ 87.549266][ T80] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.680638][ T3853] cfg80211: failed to load regulatory.db [ 87.731235][ T5836] netlink: 'syz.4.16': attribute type 1 has an invalid length. [ 88.036343][ T5842] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17'. [ 88.514518][ T5860] netlink: 8 bytes leftover after parsing attributes in process `syz.0.23'. [ 89.198700][ T29] kauditd_printk_skb: 45 callbacks suppressed [ 89.198726][ T29] audit: type=1400 audit(1786307407.699:208): avc: denied { create } for pid=5858 comm="syz.3.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 89.231673][ T29] audit: type=1400 audit(1786307407.699:209): avc: denied { setopt } for pid=5858 comm="syz.3.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 89.254470][ T29] audit: type=1400 audit(1786307407.699:210): avc: denied { write } for pid=5858 comm="syz.3.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 89.970573][ T5880] netlink: 'syz.2.28': attribute type 1 has an invalid length. [ 90.093680][ T5883] warning: `syz.1.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 90.609479][ T5894] syzkaller0: entered promiscuous mode [ 90.619515][ T5894] syzkaller0: entered allmulticast mode [ 90.688265][ T29] audit: type=1400 audit(1786307409.189:211): avc: denied { ioctl } for pid=5893 comm="syz.2.33" path="socket:[8685]" dev="sockfs" ino=8685 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 91.429069][ T29] audit: type=1400 audit(1786307409.929:212): avc: denied { mmap_zero } for pid=5906 comm="syz.4.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 91.496765][ T29] audit: type=1400 audit(1786307409.979:213): avc: denied { create } for pid=5906 comm="syz.4.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 91.603401][ T29] audit: type=1400 audit(1786307409.979:214): avc: denied { bind } for pid=5906 comm="syz.4.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 91.626266][ T29] audit: type=1400 audit(1786307409.979:215): avc: denied { name_bind } for pid=5906 comm="syz.4.38" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 91.654426][ T29] audit: type=1400 audit(1786307409.979:216): avc: denied { node_bind } for pid=5906 comm="syz.4.38" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 91.680642][ T29] audit: type=1400 audit(1786307410.029:217): avc: denied { listen } for pid=5906 comm="syz.4.38" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 92.770063][ T5929] binder: 5928:5929 ioctl c0306201 0 returned -14 [ 92.782372][ T5929] binder: 5928:5929 ioctl c0306201 200000000540 returned -22 [ 92.917670][ T5932] binder: 5928:5932 ioctl c0306201 200000000640 returned -22 [ 93.592956][ T5943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.47'. [ 94.791443][ T29] kauditd_printk_skb: 8 callbacks suppressed [ 94.791465][ T29] audit: type=1400 audit(1786307413.289:226): avc: denied { read } for pid=5948 comm="syz.3.49" name="demux0" dev="devtmpfs" ino=928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 95.077520][ T29] audit: type=1400 audit(1786307413.289:227): avc: denied { open } for pid=5948 comm="syz.3.49" path="/dev/dvb/adapter0/demux0" dev="devtmpfs" ino=928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 95.250476][ T29] audit: type=1400 audit(1786307413.289:228): avc: denied { ioctl } for pid=5948 comm="syz.3.49" path="/dev/dvb/adapter0/demux0" dev="devtmpfs" ino=928 ioctlcmd=0x6f2b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 96.825104][ T5985] netlink: 16 bytes leftover after parsing attributes in process `syz.0.60'. [ 97.634020][ T29] audit: type=1400 audit(1786307416.129:229): avc: denied { mount } for pid=5994 comm="syz.4.63" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 97.742528][ T5717] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 97.750424][ T5717] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 97.763504][ T5717] lpc_ich 0000:00:00.0: I/O space for GPIO uninitialized [ 97.771133][ T5717] lpc_ich 0000:00:00.0: No MFD cells added [ 97.862965][ T5717] lpc_ich 0000:00:01.0: I/O space for ACPI uninitialized [ 97.877768][ T5717] lpc_ich 0000:00:01.0: I/O space for ACPI uninitialized [ 97.885768][ T5717] lpc_ich 0000:00:01.0: I/O space for GPIO uninitialized [ 97.894370][ T5717] lpc_ich 0000:00:01.0: No MFD cells added [ 97.900539][ T5717] lpc_ich 0000:00:01.3: RCBA is disabled by hardware/BIOS, device disabled [ 97.910684][ T5717] lpc_ich 0000:00:01.3: I/O space for GPIO uninitialized [ 97.919292][ T5717] lpc_ich 0000:00:01.3: No MFD cells added [ 97.925830][ T5717] lpc_ich 0000:00:05.0: I/O space for ACPI uninitialized [ 97.955960][ T5717] lpc_ich 0000:00:05.0: I/O space for ACPI uninitialized [ 97.977361][ T5717] lpc_ich 0000:00:05.0: I/O space for GPIO uninitialized [ 97.994318][ T5717] lpc_ich 0000:00:05.0: No MFD cells added [ 98.076387][ T29] audit: type=1400 audit(1786307416.579:230): avc: denied { unmount } for pid=5599 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 98.380787][ T29] audit: type=1400 audit(1786307416.849:231): avc: denied { create } for pid=6000 comm="syz.0.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 99.070659][ T29] audit: type=1400 audit(1786307416.849:232): avc: denied { connect } for pid=6000 comm="syz.0.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 99.893316][ T29] audit: type=1400 audit(1786307418.389:233): avc: denied { write } for pid=6024 comm="syz.2.72" name="frontend0" dev="devtmpfs" ino=927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 99.923397][ T29] audit: type=1400 audit(1786307418.399:234): avc: denied { create } for pid=6026 comm="syz.1.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 99.968539][ T29] audit: type=1400 audit(1786307418.469:235): avc: denied { mount } for pid=6032 comm="syz.4.74" name="/" dev="configfs" ino=65 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 99.995604][ T29] audit: type=1400 audit(1786307418.469:236): avc: denied { search } for pid=6032 comm="syz.4.74" name="/" dev="configfs" ino=65 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 100.103278][ T29] audit: type=1400 audit(1786307418.469:237): avc: denied { search } for pid=6032 comm="syz.4.74" name="nullb" dev="configfs" ino=2919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 100.126547][ T29] audit: type=1400 audit(1786307418.499:238): avc: denied { unmount } for pid=5599 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 100.184852][ T24] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 100.774294][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 100.790890][ T24] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 100.816245][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.836369][ T29] audit: type=1400 audit(1786307419.339:239): avc: denied { ioctl } for pid=6043 comm="syz.2.78" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 100.841940][ T24] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 100.926141][ T29] audit: type=1400 audit(1786307419.419:240): avc: denied { mount } for pid=6047 comm="syz.0.79" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 100.970273][ T29] audit: type=1400 audit(1786307419.429:241): avc: denied { search } for pid=6047 comm="syz.0.79" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 100.998265][ T29] audit: type=1400 audit(1786307419.429:242): avc: denied { write } for pid=6047 comm="syz.0.79" name="dynamic_events" dev="tracefs" ino=32 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 101.022042][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.037226][ T24] usb 2-1: Product: syz [ 101.057596][ T24] usb 2-1: Manufacturer: syz [ 101.065945][ T24] usb 2-1: SerialNumber: syz [ 101.086907][ T24] r8152-cfgselector 2-1: Unknown version 0x0000 [ 101.102088][ T24] r8152-cfgselector 2-1: config 0 descriptor?? [ 101.517793][ T24] r8152-cfgselector 2-1: USB disconnect, device number 2 [ 101.865550][ T6065] netlink: 'syz.3.83': attribute type 1 has an invalid length. [ 103.477013][ T6100] binder: 6098:6100 ioctl c0306201 200000000540 returned -22 [ 103.628824][ T6104] binder: 6098:6104 ioctl c0306201 200000000640 returned -22 [ 103.673852][ T6105] syz_tun: entered allmulticast mode [ 104.131517][ T6113] netlink: 'syz.2.98': attribute type 2 has an invalid length. [ 104.218253][ T6096] syz_tun: left allmulticast mode [ 104.223587][ T6116] netlink: 68 bytes leftover after parsing attributes in process `syz.3.100'. [ 104.330445][ T6108] netlink: 'syz.2.98': attribute type 4 has an invalid length. [ 104.724803][ T6131] vhci_hcd vhci_hcd.0: remove, state 4 [ 104.731790][ T6131] usb usb34: USB disconnect, device number 1 [ 105.025000][ T6125] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6125 comm=syz.0.103 [ 105.098318][ T6137] Zero length message leads to an empty skb [ 105.122783][ T6137] capability: warning: `syz.4.107' uses deprecated v2 capabilities in a way that may be insecure [ 105.158542][ T6139] netlink: 'syz.2.108': attribute type 1 has an invalid length. [ 105.158597][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.2.108'. [ 105.201693][ T6125] syz.0.103 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 105.201793][ T6125] CPU: 1 UID: 0 PID: 6125 Comm: syz.0.103 Not tainted syzkaller #0 PREEMPT(full) [ 105.201818][ T6125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 105.201838][ T6125] Call Trace: [ 105.201858][ T6125] [ 105.201867][ T6125] dump_stack_lvl+0x100/0x190 [ 105.201918][ T6125] dump_header+0xfb/0x606 [ 105.201945][ T6125] oom_kill_process.cold+0xd/0x330 [ 105.201970][ T6125] out_of_memory+0x340/0x14f0 [ 105.202005][ T6125] ? __pfx_out_of_memory+0x10/0x10 [ 105.202041][ T6125] mem_cgroup_out_of_memory+0xc6/0x130 [ 105.202063][ T6125] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 105.202082][ T6125] ? find_held_lock+0x2b/0x80 [ 105.202106][ T6125] ? do_raw_spin_unlock+0x145/0x1e0 [ 105.202138][ T6125] ? _raw_spin_unlock+0x28/0x50 [ 105.202164][ T6125] try_charge_memcg+0x6e5/0xdf0 [ 105.202198][ T6125] ? __pfx_try_charge_memcg+0x10/0x10 [ 105.202231][ T6125] ? find_held_lock+0x2b/0x80 [ 105.202249][ T6125] ? rcu_read_unlock+0x17/0x60 [ 105.202275][ T6125] ? rcu_read_unlock+0x17/0x60 [ 105.202309][ T6125] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 105.202344][ T6125] ? kasan_save_track+0x14/0x30 [ 105.202371][ T6125] kmem_cache_alloc_noprof+0x587/0x6a0 [ 105.202394][ T6125] ? sk_prot_alloc+0x60/0x2a0 [ 105.202427][ T6125] sk_prot_alloc+0x60/0x2a0 [ 105.202452][ T6125] sk_alloc+0x36/0xe80 [ 105.202473][ T6125] inet6_create+0x385/0x12b0 [ 105.202495][ T6125] ? inet6_create+0x7f/0x12b0 [ 105.202518][ T6125] __sock_create+0x339/0x860 [ 105.202540][ T6125] inet_ctl_sock_create+0x94/0x230 [ 105.202562][ T6125] ? __pfx_inet_ctl_sock_create+0x10/0x10 [ 105.202586][ T6125] ? ndisc_net_init+0x1b1/0x230 [ 105.202609][ T6125] ? __pfx_ndisc_net_init+0x10/0x10 [ 105.202651][ T6125] igmp6_net_init+0x1b2/0x430 [ 105.202678][ T6125] ? __pfx_igmp6_net_init+0x10/0x10 [ 105.202705][ T6125] ops_init+0x1e2/0x5f0 [ 105.202734][ T6125] setup_net+0x118/0x3a0 [ 105.202760][ T6125] ? __pfx_setup_net+0x10/0x10 [ 105.202785][ T6125] ? mutex_init_lockdep+0xf1/0x120 [ 105.202819][ T6125] copy_net_ns+0x46f/0x7c0 [ 105.202849][ T6125] create_new_namespaces+0x3ea/0xac0 [ 105.202889][ T6125] unshare_nsproxy_namespaces+0xf2/0x220 [ 105.202920][ T6125] ksys_unshare+0x438/0xab0 [ 105.202956][ T6125] ? __pfx_ksys_unshare+0x10/0x10 [ 105.202992][ T6125] __x64_sys_unshare+0x31/0x40 [ 105.203018][ T6125] do_syscall_64+0x115/0x870 [ 105.203044][ T6125] ? clear_bhb_loop+0x70/0xc0 [ 105.203068][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.203086][ T6125] RIP: 0033:0x7f905c19e0d9 [ 105.203103][ T6125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.203119][ T6125] RSP: 002b:00007f905a3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 105.203159][ T6125] RAX: ffffffffffffffda RBX: 00007f905c425fa0 RCX: 00007f905c19e0d9 [ 105.203173][ T6125] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200 [ 105.203189][ T6125] RBP: 00007f905c235024 R08: 0000000000000000 R09: 0000000000000000 [ 105.203201][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.203211][ T6125] R13: 00007f905c426038 R14: 00007f905c425fa0 R15: 00007ffd647e51d8 [ 105.203232][ T6125] [ 105.225756][ T6125] memory: usage 96kB, limit 96kB, failcnt 33 [ 105.225802][ T6125] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 105.225817][ T6125] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 105.225831][ T6125] Memory cgroup stats for /syz0/test: [ 105.226314][ T6125] cache 0 [ 105.226329][ T6125] rss 0 [ 105.226338][ T6125] rss_huge 0 [ 105.226346][ T6125] shmem 0 [ 105.226353][ T6125] mapped_file 0 [ 105.226362][ T6125] dirty 0 [ 105.226370][ T6125] writeback 0 [ 105.226378][ T6125] workingset_refault_anon 0 [ 105.226386][ T6125] workingset_refault_file 0 [ 105.226395][ T6125] swap 0 [ 105.226403][ T6125] swapcached 0 [ 105.226411][ T6125] pgpgin 0 [ 105.226418][ T6125] pgpgout 0 [ 105.226426][ T6125] pgfault 0 [ 105.226434][ T6125] pgmajfault 0 [ 105.226442][ T6125] inactive_anon 0 [ 105.226449][ T6125] active_anon 0 [ 105.226456][ T6125] inactive_file 0 [ 105.226464][ T6125] active_file 0 [ 105.226470][ T6125] unevictable 0 [ 105.226477][ T6125] hierarchical_memory_limit 98304 [ 105.226485][ T6125] hierarchical_memsw_limit 9223372036854771712 [ 105.226494][ T6125] total_cache 0 [ 105.226500][ T6125] total_rss 0 [ 105.226508][ T6125] total_rss_huge 0 [ 105.226515][ T6125] total_shmem 0 [ 105.226522][ T6125] total_mapped_file 0 [ 105.226528][ T6125] total_dirty 0 [ 105.226534][ T6125] total_writeback 0 [ 105.226541][ T6125] total_workingset_refault_anon 0 [ 105.226549][ T6125] total_workingset_refault_file 0 [ 105.226557][ T6125] total_swap 0 [ 105.226563][ T6125] total_swapcached 0 [ 105.226571][ T6125] total_pgpgin 0 [ 105.226578][ T6125] total_pgpgout 0 [ 105.226585][ T6125] total_pgfault 0 [ 105.226592][ T6125] total_pgmajfault 0 [ 105.226599][ T6125] total_inactive_anon 0 [ 105.226615][ T6125] total_active_anon 0 [ 105.228569][ T6125] total_inactive_file 0 [ 105.228582][ T6125] total_active_file 0 [ 105.228591][ T6125] total_unevictable 0 [ 105.228599][ T6125] anon_cost 0 [ 105.228607][ T6125] file_cost 0 [ 105.228616][ T6125] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.103,pid=6123,uid=0 [ 105.229773][ T6125] Memory cgroup out of memory: Killed process 6123 (syz.0.103) total-vm:104432kB, anon-rss:1432kB, file-rss:23332kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 105.259034][ T6125] Failed to initialize the IGMP6 autojoin socket (err -105) [ 105.306185][ T1091] vhci_hcd vhci_hcd.0: stop threads [ 105.347998][ T6142] syzkaller0: entered promiscuous mode [ 105.359582][ T1091] vhci_hcd vhci_hcd.0: release socket [ 105.370057][ T6142] syzkaller0: entered allmulticast mode [ 105.472833][ T1091] vhci_hcd vhci_hcd.0: disconnect device [ 105.838498][ T6145] tipc: Started in network mode [ 105.857746][ T6131] vhci_hcd vhci_hcd.0: USB bus 34 deregistered [ 105.867117][ T6145] tipc: Node identity ea8658d371fe, cluster identity 4711 [ 105.876177][ T6145] tipc: Enabled bearer , priority 0 [ 105.892465][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 105.892484][ T29] audit: type=1400 audit(1786307424.289:248): avc: denied { name_connect } for pid=6143 comm="syz.3.110" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 105.982964][ T29] audit: type=1400 audit(1786307424.309:249): avc: denied { getopt } for pid=6143 comm="syz.3.110" laddr=::1 lport=39480 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 105.995942][ T1091] vhci_hcd vhci_hcd.0: stop threads [ 106.011307][ T1091] vhci_hcd vhci_hcd.0: release socket [ 106.018080][ T1091] vhci_hcd vhci_hcd.0: disconnect device [ 106.028048][ T6131] vhci_hcd vhci_hcd.0: remove, state 4 [ 106.032699][ T6142] tipc: Resetting bearer [ 106.043213][ T6131] usb usb33: USB disconnect, device number 1 [ 106.074995][ T1091] ================================================================== [ 106.083092][ T1091] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3a/0x60 [ 106.083238][ T29] audit: type=1400 audit(1786307424.539:250): avc: denied { shutdown } for pid=6148 comm="syz.3.112" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 106.091250][ T1091] Read of size 1 at addr ffff88802bb446c8 by task kworker/u8:8/1091 [ 106.091266][ T1091] [ 106.091278][ T1091] CPU: 0 UID: 0 PID: 1091 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 106.091296][ T1091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 106.091321][ T1091] Workqueue: usbip_event event_handler [ 106.091345][ T1091] Call Trace: [ 106.091352][ T1091] [ 106.091359][ T1091] dump_stack_lvl+0x100/0x190 [ 106.091383][ T1091] print_report+0x13d/0x4b0 [ 106.091407][ T1091] ? __virt_addr_valid+0x239/0x430 [ 106.091430][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 106.091452][ T1091] kasan_report+0xdf/0x1c0 [ 106.091476][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 106.091495][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 106.091512][ T1091] __kasan_check_byte+0x36/0x50 [ 106.091533][ T1091] lock_acquire+0x132/0x370 [ 106.091552][ T1091] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 106.091576][ T1091] ? _raw_spin_lock_irqsave+0x52/0x60 [ 106.091595][ T1091] _raw_spin_lock_irqsave+0x3a/0x60 [ 106.091612][ T1091] ? event_handler+0x21e/0x570 [ 106.091627][ T1091] event_handler+0x21e/0x570 [ 106.091645][ T1091] process_one_work+0xa23/0x1940 [ 106.091668][ T1091] ? __pfx_process_one_work+0x10/0x10 [ 106.091687][ T1091] ? __pfx_event_handler+0x10/0x10 [ 106.091703][ T1091] worker_thread+0x5ef/0xe50 [ 106.091722][ T1091] ? __pfx_worker_thread+0x10/0x10 [ 106.091738][ T1091] ? kthread+0x13a/0x450 [ 106.091753][ T1091] ? __pfx_worker_thread+0x10/0x10 [ 106.091769][ T1091] kthread+0x370/0x450 [ 106.091783][ T1091] ? __pfx_kthread+0x10/0x10 [ 106.091798][ T1091] ret_from_fork+0x72b/0xd50 [ 106.091822][ T1091] ? __pfx_ret_from_fork+0x10/0x10 [ 106.091843][ T1091] ? __switch_to+0x800/0x10f0 [ 106.091860][ T1091] ? __pfx_kthread+0x10/0x10 [ 106.091875][ T1091] ret_from_fork_asm+0x1a/0x30 [ 106.091901][ T1091] [ 106.091907][ T1091] [ 106.187125][ T6141] tipc: Resetting bearer [ 106.188619][ T1091] Allocated by task 1: [ 106.188652][ T1091] kasan_save_stack+0x30/0x50 [ 106.309719][ T1091] kasan_save_track+0x14/0x30 [ 106.311678][ T6131] vhci_hcd vhci_hcd.0: USB bus 33 deregistered [ 106.314398][ T1091] __kasan_kmalloc+0xaa/0xb0 [ 106.314426][ T1091] __kmalloc_noprof+0x322/0x820 [ 106.314450][ T1091] __usb_create_hcd+0x5e/0xac0 [ 106.314475][ T1091] vhci_hcd_probe+0x1a5/0x4e0 [ 106.314492][ T1091] platform_probe+0x106/0x1d0 [ 106.314510][ T1091] really_probe+0x241/0xa60 [ 106.314528][ T1091] __driver_probe_device+0x20e/0x450 [ 106.314546][ T1091] driver_probe_device+0x4a/0x140 [ 106.314563][ T1091] __device_attach_driver+0x1df/0x320 [ 106.314583][ T1091] bus_for_each_drv+0x159/0x1e0 [ 106.314617][ T1091] __device_attach+0x1e4/0x4d0 [ 106.314637][ T1091] device_initial_probe+0xaf/0xd0 [ 106.314656][ T1091] bus_probe_device+0x64/0x160 [ 106.314672][ T1091] device_add+0x121d/0x1970 [ 106.314699][ T1091] platform_device_add+0x35a/0x800 [ 106.314714][ T1091] platform_device_register_full+0x5cf/0x830 [ 106.314734][ T1091] vhci_hcd_init+0x1a1/0x2f0 [ 106.314760][ T1091] do_one_initcall+0x11d/0x700 [ 106.314785][ T1091] kernel_init_freeable+0x6ea/0x7b0 [ 106.314814][ T1091] kernel_init+0x1f/0x1e0 [ 106.314830][ T1091] ret_from_fork+0x72b/0xd50 [ 106.314857][ T1091] ret_from_fork_asm+0x1a/0x30 [ 106.314880][ T1091] [ 106.314885][ T1091] Freed by task 6131: [ 106.314895][ T1091] kasan_save_stack+0x30/0x50 [ 106.314913][ T1091] kasan_save_track+0x14/0x30 [ 106.314930][ T1091] kasan_save_free_info+0x3b/0x70 [ 106.314943][ T1091] __kasan_slab_free+0x5f/0x80 [ 106.314962][ T1091] kfree+0x22b/0x6c0 [ 106.314975][ T1091] usb_put_hcd+0x149/0x1f0 [ 106.314995][ T1091] vhci_hcd_remove+0xb5/0x1b0 [ 106.315011][ T1091] platform_remove+0x5f/0x80 [ 106.315036][ T1091] device_remove+0xcb/0x180 [ 106.315052][ T1091] device_release_driver_internal+0x44e/0x620 [ 106.315074][ T1091] unbind_store+0xf8/0x110 [ 106.315088][ T1091] drv_attr_store+0x74/0xb0 [ 106.315111][ T1091] sysfs_kf_write+0xf2/0x150 [ 106.315125][ T1091] kernfs_fop_write_iter+0x3e0/0x5f0 [ 106.315147][ T1091] vfs_write+0x6ac/0x1050 [ 106.315161][ T1091] ksys_write+0x12a/0x250 [ 106.315174][ T1091] do_syscall_64+0x115/0x870 [ 106.512459][ T1091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.518349][ T1091] [ 106.520678][ T1091] Last potentially related work creation: [ 106.526370][ T1091] kasan_save_stack+0x30/0x50 [ 106.531030][ T1091] kasan_record_aux_stack+0xa7/0xc0 [ 106.536216][ T1091] insert_work+0x36/0x230 [ 106.540541][ T1091] __queue_work+0x9bc/0x12b0 [ 106.545110][ T1091] queue_work_on+0x1a9/0x1e0 [ 106.549678][ T1091] usb_hcd_giveback_urb+0x330/0x4a0 [ 106.554861][ T1091] unlink1+0x418/0x510 [ 106.558910][ T1091] usb_hcd_unlink_urb+0x131/0x210 [ 106.563917][ T1091] usb_kill_urb+0x121/0x320 [ 106.568403][ T1091] hub_quiesce+0x1e9/0x320 [ 106.572798][ T1091] hub_suspend+0x4ab/0x9e0 [ 106.577198][ T1091] usb_suspend_both+0x288/0x950 [ 106.582028][ T1091] usb_runtime_suspend+0x49/0x120 [ 106.587034][ T1091] __rpm_callback+0xc8/0x620 [ 106.591610][ T1091] rpm_callback+0x16a/0x1b0 [ 106.596090][ T1091] rpm_suspend+0x2f4/0x11a0 [ 106.600573][ T1091] __pm_runtime_suspend+0xba/0x1a0 [ 106.605680][ T1091] usb_new_device.part.0+0x1653/0x1686 [ 106.611122][ T1091] register_root_hub+0x4e6/0x639 [ 106.616042][ T1091] usb_add_hcd.cold+0xccd/0x1158 [ 106.620964][ T1091] vhci_hcd_probe+0x1c2/0x4e0 [ 106.625627][ T1091] platform_probe+0x106/0x1d0 [ 106.630287][ T1091] really_probe+0x241/0xa60 [ 106.634782][ T1091] __driver_probe_device+0x20e/0x450 [ 106.640063][ T1091] driver_probe_device+0x4a/0x140 [ 106.645066][ T1091] __device_attach_driver+0x1df/0x320 [ 106.650417][ T1091] bus_for_each_drv+0x159/0x1e0 [ 106.655247][ T1091] __device_attach+0x1e4/0x4d0 [ 106.660009][ T1091] device_initial_probe+0xaf/0xd0 [ 106.665045][ T1091] bus_probe_device+0x64/0x160 [ 106.669818][ T1091] device_add+0x121d/0x1970 [ 106.674319][ T1091] platform_device_add+0x35a/0x800 [ 106.679414][ T1091] platform_device_register_full+0x5cf/0x830 [ 106.685383][ T1091] vhci_hcd_init+0x1a1/0x2f0 [ 106.689956][ T1091] do_one_initcall+0x11d/0x700 [ 106.694705][ T1091] kernel_init_freeable+0x6ea/0x7b0 [ 106.699890][ T1091] kernel_init+0x1f/0x1e0 [ 106.704216][ T1091] ret_from_fork+0x72b/0xd50 [ 106.708795][ T1091] ret_from_fork_asm+0x1a/0x30 [ 106.713541][ T1091] [ 106.715843][ T1091] Second to last potentially related work creation: [ 106.722411][ T1091] kasan_save_stack+0x30/0x50 [ 106.727070][ T1091] kasan_record_aux_stack+0xa7/0xc0 [ 106.732256][ T1091] insert_work+0x36/0x230 [ 106.736563][ T1091] __queue_work+0x9bc/0x12b0 [ 106.741134][ T1091] queue_work_on+0x1a9/0x1e0 [ 106.745701][ T1091] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 106.750884][ T1091] usb_hcd_submit_urb+0xab7/0x2150 [ 106.755978][ T1091] usb_submit_urb+0x827/0x19b0 [ 106.760717][ T1091] usb_start_wait_urb+0x10e/0x580 [ 106.765718][ T1091] usb_control_msg+0x328/0x4b0 [ 106.770459][ T1091] hub_suspend+0x826/0x9e0 [ 106.774853][ T1091] usb_suspend_both+0x288/0x950 [ 106.779684][ T1091] usb_runtime_suspend+0x49/0x120 [ 106.784712][ T1091] __rpm_callback+0xc8/0x620 [ 106.789282][ T1091] rpm_callback+0x16a/0x1b0 [ 106.793764][ T1091] rpm_suspend+0x2f4/0x11a0 [ 106.798252][ T1091] __pm_runtime_suspend+0xba/0x1a0 [ 106.803341][ T1091] usb_new_device.part.0+0x1653/0x1686 [ 106.808784][ T1091] register_root_hub+0x4e6/0x639 [ 106.813702][ T1091] usb_add_hcd.cold+0xccd/0x1158 [ 106.818619][ T1091] vhci_hcd_probe+0x1c2/0x4e0 [ 106.823276][ T1091] platform_probe+0x106/0x1d0 [ 106.827930][ T1091] really_probe+0x241/0xa60 [ 106.832431][ T1091] __driver_probe_device+0x20e/0x450 [ 106.837702][ T1091] driver_probe_device+0x4a/0x140 [ 106.842708][ T1091] __device_attach_driver+0x1df/0x320 [ 106.848058][ T1091] bus_for_each_drv+0x159/0x1e0 [ 106.852882][ T1091] __device_attach+0x1e4/0x4d0 [ 106.857626][ T1091] device_initial_probe+0xaf/0xd0 [ 106.862643][ T1091] bus_probe_device+0x64/0x160 [ 106.867385][ T1091] device_add+0x121d/0x1970 [ 106.871888][ T1091] platform_device_add+0x35a/0x800 [ 106.876974][ T1091] platform_device_register_full+0x5cf/0x830 [ 106.882934][ T1091] vhci_hcd_init+0x1a1/0x2f0 [ 106.887505][ T1091] do_one_initcall+0x11d/0x700 [ 106.892253][ T1091] kernel_init_freeable+0x6ea/0x7b0 [ 106.897441][ T1091] kernel_init+0x1f/0x1e0 [ 106.901754][ T1091] ret_from_fork+0x72b/0xd50 [ 106.906329][ T1091] ret_from_fork_asm+0x1a/0x30 [ 106.911082][ T1091] [ 106.913382][ T1091] The buggy address belongs to the object at ffff88802bb44000 [ 106.913382][ T1091] which belongs to the cache kmalloc-8k of size 8192 [ 106.927410][ T1091] The buggy address is located 1736 bytes inside of [ 106.927410][ T1091] freed 8192-byte region [ffff88802bb44000, ffff88802bb46000) [ 106.941356][ T1091] [ 106.943660][ T1091] The buggy address belongs to the physical page: [ 106.950059][ T1091] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb40 [ 106.958801][ T1091] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 106.967275][ T1091] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 106.974807][ T1091] page_type: f5(slab) [ 106.978768][ T1091] raw: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000 [ 106.987334][ T1091] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 106.995898][ T1091] head: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000 [ 107.004554][ T1091] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 107.013201][ T1091] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 107.021846][ T1091] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 107.030487][ T1091] page dumped because: kasan: bad access detected [ 107.036884][ T1091] page_owner tracks the page as allocated [ 107.042577][ T1091] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12692957993, free_ts 12589583725 [ 107.063140][ T1091] post_alloc_hook+0xfd/0x120 [ 107.067803][ T1091] get_page_from_freelist+0xf48/0x3530 [ 107.073238][ T1091] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 107.079107][ T1091] new_slab+0xa2/0x640 [ 107.083151][ T1091] refill_objects+0xe3/0x410 [ 107.087717][ T1091] __pcs_replace_empty_main+0x376/0x680 [ 107.093236][ T1091] __kmalloc_noprof+0x66d/0x820 [ 107.098064][ T1091] __usb_create_hcd+0x5e/0xac0 [ 107.102811][ T1091] vhci_hcd_probe+0x1a5/0x4e0 [ 107.107475][ T1091] platform_probe+0x106/0x1d0 [ 107.112144][ T1091] really_probe+0x241/0xa60 [ 107.116631][ T1091] __driver_probe_device+0x20e/0x450 [ 107.121895][ T1091] driver_probe_device+0x4a/0x140 [ 107.126899][ T1091] __device_attach_driver+0x1df/0x320 [ 107.132251][ T1091] bus_for_each_drv+0x159/0x1e0 [ 107.137080][ T1091] __device_attach+0x1e4/0x4d0 [ 107.141824][ T1091] page last free pid 24 tgid 24 stack trace: [ 107.147777][ T1091] free_pages_prepare+0x586/0xd80 [ 107.152789][ T1091] __free_contig_range_common+0x14f/0x250 [ 107.158504][ T1091] free_pages_bulk+0x12a/0x200 [ 107.163246][ T1091] vm_area_free_pages+0xad/0x2b0 [ 107.168165][ T1091] vfree+0x107/0x750 [ 107.172038][ T1091] delayed_vfree_work+0x56/0x80 [ 107.176868][ T1091] process_one_work+0xa23/0x1940 [ 107.181785][ T1091] worker_thread+0x5ef/0xe50 [ 107.186361][ T1091] kthread+0x370/0x450 [ 107.190419][ T1091] ret_from_fork+0x72b/0xd50 [ 107.194999][ T1091] ret_from_fork_asm+0x1a/0x30 [ 107.199767][ T1091] [ 107.202078][ T1091] Memory state around the buggy address: [ 107.207703][ T1091] ffff88802bb44580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.215759][ T1091] ffff88802bb44600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.223808][ T1091] >ffff88802bb44680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.231848][ T1091] ^ [ 107.238236][ T1091] ffff88802bb44700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.246275][ T1091] ffff88802bb44780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.254310][ T1091] ================================================================== [ 107.262372][ T1091] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 107.269569][ T1091] CPU: 0 UID: 0 PID: 1091 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 107.279008][ T1091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 107.289045][ T1091] Workqueue: usbip_event event_handler [ 107.294495][ T1091] Call Trace: [ 107.297756][ T1091] [ 107.300683][ T1091] dump_stack_lvl+0x100/0x190 [ 107.305349][ T1091] vpanic+0x552/0x970 [ 107.309311][ T1091] ? __pfx_vpanic+0x10/0x10 [ 107.313793][ T1091] ? __pfx_vprintk_emit+0x10/0x10 [ 107.318798][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 107.324150][ T1091] panic+0xd1/0xe0 [ 107.327848][ T1091] ? __pfx_panic+0x10/0x10 [ 107.332242][ T1091] ? end_report.part.0+0x23/0x90 [ 107.337164][ T1091] ? rcu_is_watching+0x12/0xc0 [ 107.341917][ T1091] ? end_report.part.0+0x23/0x90 [ 107.346839][ T1091] ? check_panic_on_warn+0x1f/0x90 [ 107.351934][ T1091] check_panic_on_warn.cold+0x19/0x34 [ 107.357287][ T1091] end_report.part.0+0x3a/0x90 [ 107.362034][ T1091] kasan_report.cold+0xe/0x18 [ 107.366697][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 107.372052][ T1091] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 107.377412][ T1091] __kasan_check_byte+0x36/0x50 [ 107.382250][ T1091] lock_acquire+0x132/0x370 [ 107.386735][ T1091] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 107.392523][ T1091] ? _raw_spin_lock_irqsave+0x52/0x60 [ 107.397874][ T1091] _raw_spin_lock_irqsave+0x3a/0x60 [ 107.403051][ T1091] ? event_handler+0x21e/0x570 [ 107.407796][ T1091] event_handler+0x21e/0x570 [ 107.412388][ T1091] process_one_work+0xa23/0x1940 [ 107.417310][ T1091] ? __pfx_process_one_work+0x10/0x10 [ 107.422667][ T1091] ? __pfx_event_handler+0x10/0x10 [ 107.427768][ T1091] worker_thread+0x5ef/0xe50 [ 107.432346][ T1091] ? __pfx_worker_thread+0x10/0x10 [ 107.437436][ T1091] ? kthread+0x13a/0x450 [ 107.441657][ T1091] ? __pfx_worker_thread+0x10/0x10 [ 107.446751][ T1091] kthread+0x370/0x450 [ 107.450801][ T1091] ? __pfx_kthread+0x10/0x10 [ 107.455370][ T1091] ret_from_fork+0x72b/0xd50 [ 107.459952][ T1091] ? __pfx_ret_from_fork+0x10/0x10 [ 107.465046][ T1091] ? __switch_to+0x800/0x10f0 [ 107.469701][ T1091] ? __pfx_kthread+0x10/0x10 [ 107.474268][ T1091] ret_from_fork_asm+0x1a/0x30 [ 107.479024][ T1091] [ 107.482253][ T1091] Kernel Offset: disabled [ 107.486552][ T1091] Rebooting in 86400 seconds..