last executing test programs: 21.076545899s ago: executing program 0 (id=2523): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x22) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1c0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 20.999668148s ago: executing program 0 (id=2524): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000180)={0x0, 0x24, 0xf, {0xf, 0x21, "e5f997ccf2be202bafa8b3acee"}}, &(0x7f0000000280)={0x0, 0x3, 0xaa, @string={0xaa, 0x3, "aa9c1c58e889ef8e9affa0864bda951b84a217a576d9f3c2f08e9da7be943df421954b528ceccf46e84ccf7590211ff782d833015f4eb2ec30b62a5127455cc039fd8944087aba51ca58bdf904cc2861f464297b4fd30bf90bd5a8161ef93704dc7b5acad43a372d956e6f1034b57db633124a54b764fd4be7067e50be4588a824f3077e4c7e166d6a6490797d7b2f47049d8c7627d94d3932bfeb2465063784bdf31a0ccadd96c0"}}}, &(0x7f00000007c0)={0x34, &(0x7f0000000400)={0x0, 0x17, 0x5, "e822e48e57"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000680)={0xc0, 0xa1, 0x4, 0x4}, &(0x7f00000006c0)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000000700)={0xc0, 0xa2, 0x2f, "ba2fbb0b8631d9134cb3f36eea7cac48f9c741c16fae8082a8c3dda7eeb10570b7c7b6d48c8c8ea03bb4144f90c620"}}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) r2 = socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x24000800) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 20.274712877s ago: executing program 0 (id=2529): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000000206050000000000000000000700000014000780080008400000009808000640200000000500010006000000050005000200000005000400000000000900020073797a310000000010000300686173683a69702c6d61"], 0x5c}}, 0x20000000) 20.052383283s ago: executing program 0 (id=2531): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r10, 0xc048aeca, &(0x7f0000000180)={0x3, 0x0, [{0x0, 0x0, 0x0, 0x6}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000101, 0x8}]}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb894f"], 0x72) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0x8000000000000001, 0x3, 0x5, 0xa, 0xc000000000000, 0xd, 0x5d, 0x6, 0x48, 0xfffffffd, 0x3, 0x100000000c, 0x20000000000bab7, 0x7, 0x80000002, 0xeede], 0x8000000, 0x202000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x1c, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x5, 0x11, 0x0, 0x1, [@generic='\x00']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 7.418827607s ago: executing program 2 (id=2586): socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="12000000240000"], 0x48) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) clock_nanosleep(0x7, 0x0, &(0x7f00000002c0)={0x0, 0x3938700}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB=' \x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000fedbdf250b0000000c000580070001"], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) 6.48322718s ago: executing program 4 (id=2589): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r1, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="f67f2def5513d2542892cddd15ecfa5d52a9833377de57dec4ff06f33c57c9b339a0b9242978db8e26d3901a0fef201fbf347cf8f38d1ae8669ff5050d0d1e1991d3ebf485e1542d", @ANYRESOCT=r0, @ANYRES16=r1, @ANYRESDEC=r0, @ANYBLOB="6ed9eaddabec92e3cdf1f70ace27862133341b", @ANYRESOCT=r1], &(0x7f0000000000)='GPL\x00', 0x8001, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0x0, 0x4, 0xc8, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000100)={0x0, 0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x0) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x2], 0x0, 0x0, 0x1, 0x1}}, 0x40) r9 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r9, 0x540a, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000001b00), 0x8a201, 0x0) 6.182854129s ago: executing program 1 (id=2591): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000acfdf32cd5062400000206030000000000b8791fa8000000001400078008001240000b000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65741aed7a72b89b478e128cafcd15cabd3f5ce53753a7cc0a273d5608923d888d777a2028d273be31450ff2ae1377b5e6f0f5a42c8f6238f0e67e71539e08b32d0b"], 0x60}, 0x1, 0x0, 0x0, 0x4004050}, 0x0) 6.102316523s ago: executing program 2 (id=2592): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000180)={0x0, 0x24, 0xf, {0xf, 0x21, "e5f997ccf2be202bafa8b3acee"}}, &(0x7f0000000280)={0x0, 0x3, 0xaa, @string={0xaa, 0x3, "aa9c1c58e889ef8e9affa0864bda951b84a217a576d9f3c2f08e9da7be943df421954b528ceccf46e84ccf7590211ff782d833015f4eb2ec30b62a5127455cc039fd8944087aba51ca58bdf904cc2861f464297b4fd30bf90bd5a8161ef93704dc7b5acad43a372d956e6f1034b57db633124a54b764fd4be7067e50be4588a824f3077e4c7e166d6a6490797d7b2f47049d8c7627d94d3932bfeb2465063784bdf31a0ccadd96c0"}}}, &(0x7f00000007c0)={0x34, &(0x7f0000000400)={0x0, 0x17, 0x5, "e822e48e57"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000680)={0xc0, 0xa1, 0x4, 0x4}, &(0x7f00000006c0)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000000700)={0xc0, 0xa2, 0x2f, "ba2fbb0b8631d9134cb3f36eea7cac48f9c741c16fae8082a8c3dda7eeb10570b7c7b6d48c8c8ea03bb4144f90c620"}}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) r2 = socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 5.518482581s ago: executing program 3 (id=2593): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000001c0)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0000c850220000b801000000b9a6080000b9800000c035000800000f30ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x68}], 0x1, 0x5c, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x2, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r9, 0xc048aeca, &(0x7f0000000180)={0x3, 0x0, [{0x0, 0x0, 0x0, 0x6}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000101, 0x8}]}) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb894f"], 0x72) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0x8000000000000001, 0x3, 0x5, 0xa, 0xc000000000000, 0xd, 0x5d, 0x6, 0x48, 0xfffffffd, 0x3, 0x100000000c, 0x20000000000bab7, 0x7, 0x80000002, 0xeede], 0x8000000, 0x202000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x1c, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x5, 0x11, 0x0, 0x1, [@generic='\x00']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 5.516770861s ago: executing program 1 (id=2602): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept4(r0, 0x0, 0x0, 0x800) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x4}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xf, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@map=r2, r3, 0x36, 0x20}, 0x20) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x59147b8dff6cbe02}, 0x4040850) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000040)) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [], {0xfffffffffffffed4, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x400c080) 5.419252628s ago: executing program 2 (id=2594): capset(&(0x7f0000000040)={0x20080522}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 4.658869792s ago: executing program 1 (id=2595): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x24008010) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@empty, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, r2}, {0x0, 0x28c, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x7, 0xfffffffffffffffe}, 0x1, 0x0, 0x1}, {{@in6=@local, 0x4d6, 0x33}, 0x0, @in6=@loopback, 0x2, 0x3, 0x3, 0xb7, 0x10000000, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x60) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000007880)=""/102400, 0x19000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{}, &(0x7f0000000080), &(0x7f0000000100)}, 0x20) fstat(r1, &(0x7f0000000580)) syz_emit_ethernet(0x82, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800452d007400660000020190780a010101ac1414bb0b03907800090000465c003b00657b98402f0004e00000017f000001070b856f83896401010264010102072717acd7b3f475f05f8b611e0101e0000002ffffffff0a0101000a010101ffffffff6401010194040100440c4880000000000000338c00001255076e1f8da77beaf94624a9bc8c174aa39a6f03215f76c30a801a70edee37680a07e5b9ac01fbae3c8df2f6f515fa3912951f0ca3a730e3470ab89d58172e7a7f5e7a9dc92840fd24c05b433ca4c502061d52ff171a613d1997316e4d34136d58f4b2b0873583ce6754d0aaac53b249203f51dba72e3033dedf543513f058de95a7e6131d90ffd5b3"], 0x0) getsockopt$MRT(0xffffffffffffffff, 0x0, 0x1ba0c6153006ddf4, 0x0, &(0x7f00000000c0)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 4.557697758s ago: executing program 2 (id=2596): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$qrtr(0x2a, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={0x14, 0x56, 0x1, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) connect$qrtr(r2, &(0x7f0000000100)={0x2a, 0x2, 0x4001}, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r6, 0x0, 0x0, 0x404c0c6, 0x0, 0x0) sendto$inet(r6, &(0x7f0000000100)='J', 0xffe3, 0x4004084, 0x0, 0x11000a00) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r7, 0x20) socket$netlink(0x10, 0x3, 0x0) shutdown(r7, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x1e3}) socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r8, 0xaf01, 0x0) r9 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) poll(&(0x7f0000000040)=[{r9}], 0x1, 0x0) 4.492680663s ago: executing program 3 (id=2597): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r0}, 0x8) r1 = socket$netlink(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x100008b}, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000001580)=0x1, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) syz_extract_tcp_res(0x0, 0x80000000, 0xd) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_io_uring_setup(0x38, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x0, 0x1, &(0x7f0000000000)=0x80020004, 0x4) listen(r4, 0x2) fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) writev(r7, &(0x7f0000000480)=[{&(0x7f0000000200)="34484abb23e7fcf3ea3ba16904242b7916ee33ca60f6556c760ec355f5f59326f69be122c30c24c7df020008000000000000008451196a02e09e7406c08ef3238a61f7", 0x43}, {&(0x7f00000004c0)="46af64c318671049e36c0276d3908b15b155e0cfa71e271e8f8c0057e0c6e8d5ebec022f0ba3f7b2edb9d4ee78fb59083f5680802157ef4adaa17e53450808304b869f52130ccd8406ff52be368ec61aaf25a53bd2c0cc3b3d9a4c817736cc8f43a3685ebac3003796c180843ef5cf8ab4122ac98611129ee8f21fa13b7672d7b5c38648ba83ddb4d0fc501eb26700722dd883c92ed4c2ba79510ecacb8bfbd10bc45cdb698e96dbbda96c1f76deea20e3f1e3c8ad4a1faf10362a00fa6a3b2fdd72e799aca5e08795d5b31dfab6b597e1d6388101d72f1bef0e350000000000e5ef485223df0de1601addbcb548b44f4cca7451c68c307608ae13ad548edab10d7c35484f8deb5e88eb640e36fdada72aa4456d3696df8d29817b26aa26310db301ef56427f108498755b643d507c134332d6487f92a9c06d6e1959aee3eb4d7743eda4302708354f5d794a0cd167aeda17627fcbac334ba136618db3c20e4a1a0ee55aae284e0c436b9a56bc1e11e43579f6878684613c7ffa0fc077d4dd14106ff84a184ac0c44353cc1bb8ed586f4f433d217e7d714af9a280ddcb1df5552ccaa9be21", 0x1a5}], 0x2) 4.157835425s ago: executing program 4 (id=2598): writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x240008c0}, 0xc8d4) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b0000001f00000002040000ff03000001"], 0x48) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b36, &(0x7f0000000000)={'wlan1\x00'}) socket$kcm(0x2, 0x200000000000001, 0x106) unshare(0x22020600) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x10, &(0x7f0000000480)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x5}, 0x94) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="8c45000043000701fefffffffcdbdf25017c0000"], 0x458c}, 0x1, 0x0, 0x0, 0xbbe21a6a6c0c72fd}, 0xc000) write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0e81003200080045000064fffe2000002f9078000000007f00000100890b6564010100e00004028307ffac1e00018903ed00830fb5ffffffffac141429ac1414320717e564010102ac141437ac1414aaac141416e0000001000000ffff4e23001090782204000180"], 0x76) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd2(0x6, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f0000000000)={0x0, r6}) ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x1}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB='5'], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 3.795751484s ago: executing program 3 (id=2599): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) gettid() close(r0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000240)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'lblcr\x00', 0x1, 0xa7e, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4f21, 0x3, 'lc\x00', 0x5, 0x8, 0x10}, {@multicast2, 0x4e20, 0x10048, 0xd0, 0x48, 0xfffffffe}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0x1bd, 0x12d5c, 0x12d5c}}, 0x44) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x0, 0xffffffffffffffff}}, './file0\x00'}) execveat$binfmt(r5, 0x0, &(0x7f0000000540)={[&(0x7f00000002c0)='lblcr\x00', &(0x7f0000000440)='\x00', &(0x7f00000004c0)='-\x00', &(0x7f0000000500)='/dev/nullb0\x00']}, &(0x7f0000001740)={[&(0x7f0000000600)='^{-@\x00', &(0x7f0000000640)='\x00']}, 0x800) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x123a02, 0x0) pwritev(r6, 0x0, 0x0, 0x7, 0x1) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) (async) gettid() (async) close(r0) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) (async) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socket$kcm(0xa, 0x2, 0x0) (async) socket(0x2, 0x80805, 0x0) (async) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000240)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'lblcr\x00', 0x1, 0xa7e, 0x70}, 0x2c) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4f21, 0x3, 'lc\x00', 0x5, 0x8, 0x10}, {@multicast2, 0x4e20, 0x10048, 0xd0, 0x48, 0xfffffffe}}, 0x44) (async) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0x1bd, 0x12d5c, 0x12d5c}}, 0x44) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x0, 0xffffffffffffffff}}, './file0\x00'}) (async) execveat$binfmt(r5, 0x0, &(0x7f0000000540)={[&(0x7f00000002c0)='lblcr\x00', &(0x7f0000000440)='\x00', &(0x7f00000004c0)='-\x00', &(0x7f0000000500)='/dev/nullb0\x00']}, &(0x7f0000001740)={[&(0x7f0000000600)='^{-@\x00', &(0x7f0000000640)='\x00']}, 0x800) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x123a02, 0x0) (async) pwritev(r6, 0x0, 0x0, 0x7, 0x1) (async) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) (async) 3.539998396s ago: executing program 3 (id=2600): syz_emit_ethernet(0x80d, &(0x7f0000003600)=ANY=[@ANYBLOB="e727dc071f80aaaaaaaaaabb86dd60dd07a707d72c00cb697a653e336f000000500000000000ff0200000000000000000000000000012e14002e"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000082c03cb697a653e336f000000500000000000ff02000000000000000000000000000102000003"], 0x0) 3.505029712s ago: executing program 1 (id=2601): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) sendmsg(r0, &(0x7f0000000380)={&(0x7f0000000080)=@l2tp6={0x1d, 0x0, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3000}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000100)="751edb18dbf46e8f09d97e5bbd402d11fea33f21e2", 0x15}, {&(0x7f0000000140)="da", 0x1}, {&(0x7f0000000240)="6d5f67af894fc09d5500897cd5556770418b1b34525a7becaa1a13b103508a04d5cd215b761cd584cddde2539d4d465745d349805bf16f7bd8010d7104086c0e743d76d4de754ad1714e562adea566f259c4f224d9098cbd4b94b351de0ed58f1361f6920b4598be11b9f546e6ba23ba5075072ef9d7362c255f779786606674fa7c324aa5dc055389df4d7725ef8f4e391c9bcbc80b7a9397f2f484ddc09076e854b1ee0569277a48abb91df8c3d57555dd4ed07a395e7c78444c971401bb04a219d661d01158a497c68330c7a8878ad272b2fd9915717c58efd568017a16947f31", 0xe2}], 0x3}, 0x4040010) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x133000) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) sendto$inet6(r2, &(0x7f0000000240)="c62ee5d6a89f2387cb4093532f7c0a22ce", 0xffffffffffffff69, 0x8040, 0x0, 0x0) r6 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2b, &(0x7f0000000000)={@link_local, @random="a538ae464632", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x11, 0x0, 0x0, @multicast1, '\x00'}}}}}, 0x0) sendmsg(r6, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f8035", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x14, 0x52, 0x6804311d36975393, 0x70bd2d, 0x25dfdbff, {0x1c}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x20044884) sendmsg$NL802154_CMD_SET_CCA_MODE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x28, r7, 0x233, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4040090) 3.45915756s ago: executing program 4 (id=2603): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (rerun: 64) r1 = socket$pppl2tp(0x18, 0x1, 0x1) (async) landlock_create_ruleset(&(0x7f0000000240)={0x2, 0x6, 0x2, 0x2004, 0x8}, 0x30, 0x2) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x2, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) (async) getpeername(r1, 0x0, &(0x7f0000000480)) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef010902120001000000000904"], 0x0) (async, rerun: 64) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000140)={[{@size={'size', 0x3d, [0x74]}}]}) (async, rerun: 64) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0xf4, 0x40, 0x107, 0x70bd2b, 0x25dfdbfa, {0x3, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0xdc, 0x9e, 0x0, 0x1, [@typed={0xc, 0x9b, 0x0, 0x0, @u64=0x9}, @generic="a7b474937eb67296bc116660ef10792a95fdce07b60b30e069f4cba7a0f4805e6249373677d4bd2a65d506b57d3c1a4723da3c570f27f3fae6659267ff9b676f9e711fa74f0a6ca2a4aba3d3af6f7f1b50c53e6780c04b1014aa39225b4860cf32f0a6afcb500c4648f9b9624c6cbb72c283417e32ce7f38826e0dcf6c0e10f29ed0788672185611eca9691237b41866b2491baece44e337743def43d40f9e74fe7830e96c3b865b890b1a42cbd02862a8baa9af042bd82b", @nested={0xc, 0x15a, 0x0, 0x1, [@typed={0x8, 0x5, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}]}, @typed={0x8, 0xd4, 0x0, 0x0, @uid}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x49590cefb43217cd}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x50bd2a, 0x25dedbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}]}, 0x24}}, 0x8000) (rerun: 64) 3.351628669s ago: executing program 3 (id=2604): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000180)={0x0, 0x24, 0xf, {0xf, 0x21, "e5f997ccf2be202bafa8b3acee"}}, &(0x7f0000000280)={0x0, 0x3, 0xaa, @string={0xaa, 0x3, "aa9c1c58e889ef8e9affa0864bda951b84a217a576d9f3c2f08e9da7be943df421954b528ceccf46e84ccf7590211ff782d833015f4eb2ec30b62a5127455cc039fd8944087aba51ca58bdf904cc2861f464297b4fd30bf90bd5a8161ef93704dc7b5acad43a372d956e6f1034b57db633124a54b764fd4be7067e50be4588a824f3077e4c7e166d6a6490797d7b2f47049d8c7627d94d3932bfeb2465063784bdf31a0ccadd96c0"}}}, &(0x7f00000007c0)={0x34, &(0x7f0000000400)={0x0, 0x17, 0x5, "e822e48e57"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000680)={0xc0, 0xa1, 0x4, 0x4}, &(0x7f00000006c0)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000000700)={0xc0, 0xa2, 0x2f, "ba2fbb0b8631d9134cb3f36eea7cac48f9c741c16fae8082a8c3dda7eeb10570b7c7b6d48c8c8ea03bb4144f90c620"}}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) r2 = socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 3.30796326s ago: executing program 4 (id=2605): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi0\x00', 0x400, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x13, 0x0, 0x2) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r5, 0x6f2d, 0xffffffffff60014a) ioctl$BLKTRACESETUP(r5, 0x6f29, 0x0) r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r6, &(0x7f0000001900)=[{&(0x7f00000006c0)=""/14, 0xe}], 0x1, 0x44, 0xe5) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5ce7}]}, 0x24}}, 0x40080) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001a00210f29bd7000fadbdf251c000000ff000005000000000800", @ANYRES16=r4], 0x24}, 0x1, 0x0, 0x0, 0xc4}, 0x20000010) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=r7, @ANYRESDEC=r3, @ANYRES32=r0, @ANYBLOB="3a73b03e934d0100", @ANYRES32=r0], 0x64}, 0x1, 0x0, 0x0, 0x8001}, 0x400400c) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x5, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x101}, [@btf_id={0x18, 0x6, 0x3, 0x0, 0x2}]}, &(0x7f0000000600)='syzkaller\x00', 0xa0c, 0x88, &(0x7f0000000680)=""/136, 0x40f00, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000740)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000780)={0x2, 0xf, 0x6, 0x70}, 0x10, 0x0, 0x0, 0x2, &(0x7f00000007c0), &(0x7f0000000800)=[{0x3, 0x1, 0xd, 0xc}, {0x0, 0x5, 0x10, 0x6}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000cc0)={r10, 0x0, 0x0}, 0x10) ioctl$DRM_IOCTL_GET_CLIENT(r9, 0xc0286405, &(0x7f00000004c0)={0x80000001, 0x5, {0x0}, {0xee01}, 0x0, 0x4}) move_pages(r11, 0x1, &(0x7f0000000500)=[&(0x7f0000ffa000/0x3000)=nil], &(0x7f0000000540)=[0x2], &(0x7f0000000580)=[0x0, 0x0, 0x0], 0x0) ioprio_get$pid(0x2, r11) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000d00)={0x90, r7, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SOCKETS={0x64, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r13}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20012}, 0x40c0800) syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r2) 2.077557071s ago: executing program 1 (id=2606): capset(&(0x7f0000000040)={0x20080522}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 1.887880678s ago: executing program 3 (id=2607): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x3) socket$inet6(0xa, 0x4, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x24044004) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r2, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00m'], 0x38}, 0x1, 0x300}, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r4, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000672000/0x1000)=nil) syz_clone3(&(0x7f0000000140)={0x120006200, 0x0, 0x0, 0x0, {0x28}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000000140), 0x4924b68, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}}], {0x14}}, 0x88}}, 0x0) close(r1) clock_settime(0x0, &(0x7f0000000040)={0x77359400}) close(0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) 1.805592295s ago: executing program 4 (id=2608): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='attr/current\x00') fcntl$setstatus(r1, 0x4, 0x40800) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0xb56cea99d7d0f667]}}, 0x0, 0x34}, 0x28) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) clock_nanosleep(0x7, 0x0, &(0x7f00000002c0)={0x0, 0x3938700}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x1}, 0x94) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000032700090026bd7000fddbdf25080000000b0001"], 0x20}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) 1.702169703s ago: executing program 0 (id=2545): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="662700000000000024001280090001007866726d0000000014000280040003"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000900)=[@in6={0xa, 0x4e23, 0x3f, @loopback, 0x5}], 0x1c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000940), &(0x7f0000001980)=0x8) 733.821676ms ago: executing program 4 (id=2609): getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@empty, @in6=@ipv4={""/10, ""/2, @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000300)=0xe8) mount$pvfs2(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x1001000, &(0x7f00000003c0)={[{'wlan1\x00'}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@context={'context', 0x3d, 'user_u'}}, {@subj_user}, {@smackfsdef={'smackfsdef', 0x3d, 'nl80211\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, 'nl80211\x00'}}, {@smackfshat={'smackfshat', 0x3d, '(,\'\xbc!:\xc7!\x1b'}}, {@uid_gt={'uid>', r0}}, {@flag='silent'}, {@smackfshat={'smackfshat', 0x3d, 'nl80211\x00'}}, {@appraise_type}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)={[{@mpol={'mpol', 0x3d, {'interleave', '', @val={0x3a, [0x32, 0x2d, 0x32, 0x3a, 0x30, 0x2f]}}}, 0x4e}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r1, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r2, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x108, 0x3a}}}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x4000010) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x13) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'syz_tun\x00'}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x8000) syz_emit_ethernet(0x2e, &(0x7f0000000600)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c40)={r9, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000a00), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, 0x0, 0x8, 0x0, 0x0}}, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'hsr0\x00'}) sendmsg$NL80211_CMD_FRAME(r11, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r12, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r13, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_SET_PMK(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0x84, r12, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x85e4, 0x6b}}}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "daf46725452b60d9b5bd2cc6079a8826"}, @NL80211_ATTR_PMK={0x14, 0xfe, "2a640f0e364977414f760916bb0d22b6"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "3d7cffd09e65b14eba94837f30090c95"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "a9de10455a849db18e4313b4635d8487"}]}, 0x84}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000640)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x4, r15, 0x3, 0x0) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x28, r10, 0x200, 0x70bd25, 0x1, {{0x2}, {@val={0x8, 0x3, r14}, @val={0xc, 0x99, {0xfffffffc, 0x52}}}}, [@chandef_params]}, 0x28}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) 731.98643ms ago: executing program 1 (id=2610): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="ffffffff00"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000bd25e0da97f5a34eaf8170e303caf362000b6e6f6fb9978c4b1f20cbdbf6f7def3eb9a75831c055fdab386e3b8ea3d41dd5bfe4546a71c47"], 0x50) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x600800, 0x0) accept$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x80, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f00000001c0)={0x48}) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4000004) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000fb9000/0x10000)=nil, 0x10000}}) syz_usb_connect$uac3(0x5, 0x9c, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x582, 0xb2, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0xf, 0x10, 0xfa, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x26, 0x1b}, [@processing_unit={0x9, 0x24, 0x9, 0x1, 0x1, [0x0]}, @output_terminal={0x13, 0x24, 0x3, 0x2, 0x300, 0x2, 0x1, 0x5, 0x2, 0x3, 0x7, 0x10}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x6, 0x80, 0x1, {0xa, 0x25, 0x25, 0x2, 0x7, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x1, 0x4, 0x9, {0xa, 0x25, 0x25, 0x2, 0x3, 0x4}}}}}}}}]}}, 0x0) sendmsg$netlink(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001440)=ANY=[@ANYBLOB="1400000030000103000000000000000001"], 0x114}], 0x1}, 0x0) recvmmsg(r3, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) 663.44017ms ago: executing program 0 (id=2611): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="020a000302000000e4a17c45", 0xc}], 0x1}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000000)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r2, @ANYBLOB="05", @ANYRES16=r2, @ANYRES64=r2], 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'gretap0\x00', &(0x7f0000000200)={'syztnl2\x00', 0x0, 0x1, 0x8, 0x6, 0x2, {{0x5, 0x4, 0x0, 0xa, 0x14, 0x67, 0x0, 0x87, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x32}, @broadcast}}}}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000480)={&(0x7f00000005c0)=ANY=[@ANYBLOB="cc000000", @ANYRES16=0x0, @ANYBLOB="000303000000fddbdf250b0000000c00018008000100", @ANYRES32=r4, @ANYRESDEC, @ANYRES32=r5, @ANYBLOB="4836d237fda84a1399ae0d7f95891ed070b6280c23f6cecabed55144bdc84073a19c37e76e0d992e8234a5915c1a32918431cd80fffd367b43aa1bc13e83f84108f108fd596866409a3d3c9ac9fa109b69d8dd24c880b7ff291eff0a93368aae2468ac74fde6aac80b04b1b5fc4bf23cbcc18f4ebf67a229545f88c94a4542b548f3426517b731b5ae91813899ec152887502984bca4c47045ad66f85b3447f33a87673f3fcbbe", @ANYRES32=r3, @ANYBLOB="080003000300000008000300030000006800018008000300030000001400020076657468305f746f5f6261746164760008000300020000001400020064756d6d7930000000000000000000000800030002000000140002007465616d5f736c6176655f300000000008000300020000000800030003000000"], 0xcc}, 0x1, 0x0, 0x0, 0x4000001}, 0x40000) clock_nanosleep(0xfffffffffffffffe, 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000340)=0x9) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r13, {0x6}, {}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x9, 0x0, 0x3, 0xfffffffd}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r10, {0x10}, {0x6}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x1e1c2d2e161b5631, 0x8741, 0x8, 0x1ff, 0x1}, {0x81, 0x1, 0x7, 0x6, 0x2e7, 0x3ff}, 0x8, 0x3, 0x338}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x880) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r14 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r14, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r14, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r15, 0x1, 0x0, 0x6, @multicast}, 0x14) 152.225713ms ago: executing program 2 (id=2612): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES8, @ANYBLOB, @ANYRES32=0x0, @ANYRES32], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x80002, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='smaps\x00') r1 = syz_io_uring_setup(0x38, &(0x7f0000000580)={0x0, 0xbbda, 0x13100, 0x0, 0x20000000}, &(0x7f0000000240), &(0x7f0000000080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x21, &(0x7f0000000440), 0x1) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @multicast2}}, 0x24) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @multicast2}}, 0x24) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)={0x60, 0x2, 0x6, 0x5, 0xa, 0x0, {}, [@IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x73}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x4}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}]}, 0x60}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="44000080040601020093e0a036649d5885d155b94350a1cb000c0000000000030000040900020073797a3200000000050001000700000005000100070000000900020073797a3000006f001b22c31f000500010007000000"], 0x44}, 0x1, 0x0, 0x0, 0x4008041}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket(0x40000000015, 0x5, 0x0) bind$inet(r4, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7f6b3000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x5, 0x8000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, 0x0) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 0s ago: executing program 2 (id=2613): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r5, 0x10e, 0x6, &(0x7f00000000c0)=""/219, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000009380)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3, 0xa}, {0xc02c6a9266be83b, 0x7}, {0xd, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000540)={0x1000000, 0x0, @pic={0x3, 0x7, 0x81, 0x81, 0x9, 0xf9, 0x40, 0x42, 0x6, 0x81, 0xc, 0x0, 0xf3, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x9, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): r cycle [ 286.051171][T10106] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1223'. [ 286.098444][T10106] geneve3: entered promiscuous mode [ 286.104819][T10106] geneve3: entered allmulticast mode [ 286.184870][ T9520] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 286.308453][ T9520] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 286.439918][ T9520] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 286.536212][ T9520] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 286.592497][ T7682] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 287.103930][ T7682] usb 5-1: device descriptor read/8, error -71 [ 287.512340][ T7682] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 287.540904][ T29] audit: type=1400 audit(1783190327.750:764): avc: denied { checkpoint_restore } for pid=10107 comm="syz.0.1226" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 287.596481][T10109] tipc: Enabling of bearer rejected, failed to enable media [ 287.607088][ T7682] usb 5-1: device descriptor read/8, error -71 [ 287.803872][ T7682] usb usb5-port1: unable to enumerate USB device [ 288.475205][ T29] audit: type=1400 audit(1783190328.690:765): avc: denied { setopt } for pid=10119 comm="syz.2.1228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 288.605307][ T29] audit: type=1400 audit(1783190328.810:766): avc: denied { write } for pid=10112 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 288.674961][T10141] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1231'. [ 288.756211][T10144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1232'. [ 288.792830][ T29] audit: type=1400 audit(1783190329.000:767): avc: denied { write } for pid=10145 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 289.585136][ T29] audit: type=1400 audit(1783190329.800:768): avc: denied { write } for pid=10150 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 289.836804][ T29] audit: type=1400 audit(1783190330.050:769): avc: denied { write } for pid=10167 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 290.362772][T10187] netlink: 23 bytes leftover after parsing attributes in process `syz.0.1240'. [ 293.141376][T10208] xt_hashlimit: size too large, truncated to 1048576 [ 293.623689][T10215] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1245'. [ 293.753703][T10215] 8021q: adding VLAN 0 to HW filter on device team1 [ 294.192780][T10230] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 294.285416][T10236] kAFS: unable to lookup cell 'ÿ' [ 295.692629][ T7683] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 295.769011][T10273] netlink: 'syz.3.1263': attribute type 4 has an invalid length. [ 295.873526][ T7683] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 295.882402][ T7683] usb 3-1: config 0 has no interface number 0 [ 295.890298][ T7683] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 295.899434][ T7683] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.907516][ T7683] usb 3-1: Product: syz [ 295.911786][ T7683] usb 3-1: Manufacturer: syz [ 295.916443][ T7683] usb 3-1: SerialNumber: syz [ 295.922674][ T7683] usb 3-1: config 0 descriptor?? [ 296.170919][T10278] kernel read not supported for file /!selinuxwk1ÐmÃ9Éž*T“ýâ‘ïª#j—¼ÞYÌÅmVËvm(pÉ-QZ#Ò{„¿ (pid: 10278 comm: syz.0.1264) [ 296.239632][ T29] audit: type=1400 audit(1783190336.380:770): avc: denied { module_load } for pid=10277 comm="syz.0.1264" path=2F2173656C696E7578776B311FD06DC37F39C99E2A0D5493FDE291EFAA16236A978FBCDE590FCCC56D56CB15766D2870C92D515A23D27B84BF06 dev="mqueue" ino=22704 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=system permissive=1 [ 296.278449][ T29] audit: type=1400 audit(1783190336.400:771): avc: denied { connect } for pid=10277 comm="syz.0.1264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 296.299526][ T29] audit: type=1400 audit(1783190336.400:772): avc: denied { bind } for pid=10277 comm="syz.0.1264" lport=21680 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 296.326705][ T29] audit: type=1400 audit(1783190336.400:773): avc: denied { name_bind } for pid=10277 comm="syz.0.1264" src=20006 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 296.361834][ T29] audit: type=1400 audit(1783190336.400:774): avc: denied { node_bind } for pid=10277 comm="syz.0.1264" saddr=172.20.20.187 src=20006 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 296.440517][T10289] syzkaller0: entered promiscuous mode [ 296.446219][T10289] syzkaller0: entered allmulticast mode [ 296.997148][ T7701] IPVS: starting estimator thread 0... [ 297.092416][T10300] IPVS: using max 46 ests per chain, 110400 per kthread [ 298.376865][ T7683] uvcvideo 3-1:0.64: Found Unit with invalid ID 0 [ 298.383488][ T7683] uvcvideo 3-1:0.64: Found UVC 0.08 device syz (046d:0823) [ 298.415169][ T7683] uvcvideo 3-1:0.64: No valid video chain found. [ 298.491313][ T7683] usb 3-1: USB disconnect, device number 42 [ 299.237906][T10347] netlink: 260 bytes leftover after parsing attributes in process `syz.3.1278'. [ 299.556616][ T29] audit: type=1400 audit(1783190339.770:775): avc: denied { mounton } for pid=10356 comm="syz.4.1284" path="/178/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 299.780117][ T29] audit: type=1326 audit(1783190339.990:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10368 comm="syz.1.1287" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f264379de59 code=0x7ffc0000 [ 299.833054][ T29] audit: type=1326 audit(1783190339.990:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10368 comm="syz.1.1287" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f264379de59 code=0x7ffc0000 [ 299.891304][ T29] audit: type=1326 audit(1783190340.020:778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10368 comm="syz.1.1287" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7f264379de59 code=0x7ffc0000 [ 299.944468][ T29] audit: type=1326 audit(1783190340.020:779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10368 comm="syz.1.1287" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f264373f1d9 code=0x7ffc0000 [ 301.088469][T10399] overlayfs: upper fs does not support file handles, falling back to index=off. [ 302.159112][T10432] Cannot find add_set index 1 as target [ 303.834879][T10438] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1309'. [ 303.852439][T10437] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1309'. [ 303.959160][T10438] netlink: zone id is out of range [ 303.970109][T10437] netlink: zone id is out of range [ 303.985702][T10438] netlink: del zone limit has 4 unknown bytes [ 303.995466][T10437] netlink: del zone limit has 4 unknown bytes [ 304.529362][T10460] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 304.547324][T10460] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1318'. [ 304.682795][T10460] geneve2: entered promiscuous mode [ 304.688126][T10460] geneve2: entered allmulticast mode [ 306.392572][ T46] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 306.553187][ T46] usb 3-1: Using ep0 maxpacket: 16 [ 306.570923][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 306.605840][ T46] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 306.623516][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.638978][ T46] usb 3-1: Product: syz [ 306.643824][ T46] usb 3-1: Manufacturer: syz [ 306.653164][ T46] usb 3-1: SerialNumber: syz [ 306.676705][ T46] usb 3-1: config 0 descriptor?? [ 306.703034][ T46] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 306.713992][ T46] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 307.987292][ T46] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 308.251511][ T29] kauditd_printk_skb: 30 callbacks suppressed [ 308.251528][ T29] audit: type=1400 audit(1783190348.460:810): avc: denied { lock } for pid=10506 comm="syz.3.1330" path="socket:[23172]" dev="sockfs" ino=23172 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 308.255052][T10508] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1330'. [ 308.327880][T10508] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8 sclass=netlink_xfrm_socket pid=10508 comm=syz.3.1330 [ 308.436241][ T46] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 308.441295][T10507] bridge0: port 3(vlan3) entered blocking state [ 308.444579][ T46] em28xx 3-1:0.0: board has no eeprom [ 308.466237][T10507] bridge0: port 3(vlan3) entered disabled state [ 308.517227][T10507] vlan3: entered allmulticast mode [ 308.534754][T10507] geneve0: entered allmulticast mode [ 308.551460][T10507] vlan3: entered promiscuous mode [ 308.568460][T10507] geneve0: entered promiscuous mode [ 309.024861][T10520] fuse: fd is not a fuse device [ 309.209218][T10530] openvswitch: netlink: Missing key (keys=40, expected=100) [ 309.572473][T10479] em28xx 3-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 309.602304][ T46] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 309.641535][ T46] em28xx 3-1:0.0: dvb set to bulk mode. [ 309.663815][ T7682] em28xx 3-1:0.0: Binding DVB extension [ 309.716438][ T46] usb 3-1: USB disconnect, device number 43 [ 309.763648][ T46] em28xx 3-1:0.0: Disconnecting em28xx [ 309.918505][ T7682] em28xx 3-1:0.0: Registering input extension [ 309.939700][ T46] em28xx 3-1:0.0: Closing input extension [ 310.054879][T10537] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1336'. [ 310.089150][T10537] netlink: 'syz.0.1336': attribute type 30 has an invalid length. [ 310.100806][ T46] em28xx 3-1:0.0: Freeing device [ 310.150390][T10538] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1336'. [ 310.194488][ T9514] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.214234][T10538] netlink: 'syz.0.1336': attribute type 30 has an invalid length. [ 310.226957][ T9514] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.240238][T10541] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1337'. [ 310.281800][ T9514] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.345869][ T9514] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.520336][T10549] xt_hashlimit: size too large, truncated to 1048576 [ 310.529343][ T29] audit: type=1400 audit(1783190350.740:811): avc: denied { bind } for pid=10546 comm="syz.0.1340" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 310.583917][T10552] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1341'. [ 310.604674][T10552] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1341'. [ 310.731364][ T29] audit: type=1326 audit(1783190350.940:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10555 comm="syz.1.1342" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f264379de59 code=0x0 [ 310.777165][T10559] netlink: 'syz.4.1339': attribute type 10 has an invalid length. [ 310.810388][T10559] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1339'. [ 310.938258][T10559] team0: Port device geneve1 added [ 311.017799][T10567] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1343'. [ 311.388318][T10578] syz_tun: entered allmulticast mode [ 311.702441][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 311.713275][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.720318][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 312.294194][ T29] audit: type=1400 audit(1783190352.500:813): avc: denied { accept } for pid=10596 comm="syz.1.1354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 312.647322][T10610] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1358'. [ 312.689060][ T29] audit: type=1400 audit(1783190352.890:814): avc: denied { relabelfrom } for pid=10609 comm="syz.1.1358" name="" dev="pipefs" ino=23570 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 312.740632][T10612] @0Ù: renamed from virt_wifi0 [ 312.748101][T10612] pipefs: Unknown parameter '/dev/infiniband/rdma_cm' [ 313.060148][T10619] xt_time: unknown flags 0xc [ 313.126005][T10619] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.133324][T10619] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.210580][T10624] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 313.218533][T10624] UDF-fs: Scanning with blocksize 512 failed [ 313.227186][T10624] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 313.237466][T10624] UDF-fs: Scanning with blocksize 1024 failed [ 313.245316][T10624] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 313.254910][T10624] UDF-fs: Scanning with blocksize 2048 failed [ 313.263430][T10624] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 313.271029][T10624] UDF-fs: Scanning with blocksize 4096 failed [ 313.303269][T10619] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 313.361292][T10619] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 313.384682][T10627] mmap: syz.1.1365 (10627): VmData 37593088 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 313.468695][T10619] veth0_vlan: left promiscuous mode [ 313.704693][ T9513] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.735466][ T9513] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.776915][ T9513] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.802083][ T9513] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 314.134078][T10655] overlayfs: upper fs does not support file handles, falling back to index=off. [ 314.373860][T10670] netlink: 'syz.1.1374': attribute type 9 has an invalid length. [ 314.448805][ T29] audit: type=1400 audit(1783190354.660:815): avc: denied { write } for pid=10635 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 314.723757][ T29] audit: type=1400 audit(1783190354.940:816): avc: denied { write } for pid=10678 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 314.949087][T10685] netlink: 'syz.4.1377': attribute type 1 has an invalid length. [ 314.983397][T10687] netlink: 'syz.2.1378': attribute type 1 has an invalid length. [ 315.168350][T10687] 8021q: adding VLAN 0 to HW filter on device bond2 [ 315.255586][ T29] audit: type=1400 audit(1783190355.470:817): avc: denied { open } for pid=10701 comm="syz.4.1381" path="/dev/ptyqc" dev="devtmpfs" ino=131 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 315.313305][T10694] bond2: (slave gretap1): making interface the new active one [ 315.340004][T10694] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 315.340109][ T29] audit: type=1400 audit(1783190355.500:818): avc: denied { ioctl } for pid=10701 comm="syz.4.1381" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 316.282030][ T29] audit: type=1400 audit(1783190356.490:819): avc: denied { write } for pid=10690 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.427347][ T29] audit: type=1400 audit(1783190356.640:820): avc: denied { write } for pid=10749 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 317.049846][ T29] audit: type=1400 audit(1783190356.770:821): avc: denied { read } for pid=10748 comm="syz.1.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 317.137350][ T29] audit: type=1400 audit(1783190357.300:822): avc: denied { mounton } for pid=10748 comm="syz.1.1387" path="/374/file0" dev="configfs" ino=1086 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 317.311594][ T29] audit: type=1400 audit(1783190357.520:823): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 317.880092][T10780] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1393'. [ 317.986321][ T29] audit: type=1400 audit(1783190358.200:824): avc: denied { write } for pid=10759 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.549690][T10805] openvswitch: netlink: Missing key (keys=40, expected=100) [ 319.130497][T10831] kvm: kvm [10830]: vcpu128, guest rIP: 0xfff0 Unhandled RDMSR(0x40000076) [ 320.125968][T10859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1414'. [ 320.403111][T10862] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47397 sclass=netlink_route_socket pid=10862 comm=syz.2.1415 [ 320.812830][T10873] ip6tnl1: entered allmulticast mode [ 320.825909][ T70] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 320.842006][ T70] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 320.852504][ T7683] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 320.983412][T10879] 9p: Bad value for 'rfdno' [ 321.151204][T10888] FAULT_INJECTION: forcing a failure. [ 321.151204][T10888] name failslab, interval 1, probability 0, space 0, times 0 [ 321.164260][ T7683] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 321.172366][T10888] CPU: 0 UID: 0 PID: 10888 Comm: syz.2.1424 Not tainted syzkaller #0 PREEMPT(full) [ 321.172390][T10888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 321.172399][T10888] Call Trace: [ 321.172404][T10888] [ 321.172410][T10888] dump_stack_lvl+0x100/0x190 [ 321.172433][T10888] should_fail_ex.cold+0x5/0xa [ 321.172451][T10888] should_failslab+0xc2/0x120 [ 321.172468][T10888] __kmalloc_noprof+0xfc/0x820 [ 321.172482][T10888] ? tcf_idr_create+0x62/0x880 [ 321.172506][T10888] tcf_idr_create+0x62/0x880 [ 321.172524][T10888] ? tcf_idr_check_alloc+0xe1/0x7a0 [ 321.172548][T10888] tcf_idr_create_from_flags+0x4f/0x70 [ 321.172571][T10888] tcf_ct_init+0xf7d/0x44e0 [ 321.172589][T10888] ? netlink_sendmsg+0x8b0/0xda0 [ 321.172606][T10888] ? ____sys_sendmsg+0xa4d/0xbe0 [ 321.172622][T10888] ? ___sys_sendmsg+0x190/0x1e0 [ 321.172637][T10888] ? __sys_sendmsg+0x160/0x210 [ 321.172649][T10888] ? do_syscall_64+0x115/0x870 [ 321.172666][T10888] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.172687][T10888] ? __pfx_tcf_ct_init+0x10/0x10 [ 321.172722][T10888] ? __kasan_kmalloc+0xaa/0xb0 [ 321.172736][T10888] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 321.172755][T10888] ? tcf_action_init_1+0x2d8/0x6c0 [ 321.172775][T10888] ? __asan_memcpy+0x3c/0x60 [ 321.172798][T10888] ? tcf_action_init_1+0x466/0x6c0 [ 321.172817][T10888] tcf_action_init_1+0x466/0x6c0 [ 321.172840][T10888] ? __pfx_tcf_action_init_1+0x10/0x10 [ 321.172859][T10888] ? tc_action_load_ops+0x1f5/0x3e0 [ 321.172891][T10888] ? __nla_parse+0x40/0x60 [ 321.172913][T10888] tcf_action_init+0x43f/0xa60 [ 321.172940][T10888] ? __pfx_tcf_action_init+0x10/0x10 [ 321.172976][T10888] ? __lock_acquire+0x49f/0x1a40 [ 321.173019][T10888] ? __lock_acquire+0x49f/0x1a40 [ 321.173036][T10888] tcf_action_add+0xed/0x5c0 [ 321.173052][T10888] ? __pfx_tcf_action_add+0x10/0x10 [ 321.173094][T10888] ? __nla_parse+0x40/0x60 [ 321.173115][T10888] tc_ctl_action+0x2e3/0x470 [ 321.173129][T10888] ? __pfx_tc_ctl_action+0x10/0x10 [ 321.173150][T10888] ? __pfx_tc_ctl_action+0x10/0x10 [ 321.173164][T10888] rtnetlink_rcv_msg+0x3c9/0xe90 [ 321.173182][T10888] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 321.173201][T10888] ? __lock_acquire+0x49f/0x1a40 [ 321.173219][T10888] netlink_rcv_skb+0x159/0x420 [ 321.173238][T10888] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 321.173253][T10888] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 321.173279][T10888] ? netlink_deliver_tap+0x1ae/0xcc0 [ 321.173301][T10888] netlink_unicast+0x585/0x850 [ 321.173322][T10888] ? __pfx_netlink_unicast+0x10/0x10 [ 321.173346][T10888] netlink_sendmsg+0x8b0/0xda0 [ 321.173369][T10888] ? __pfx_netlink_sendmsg+0x10/0x10 [ 321.173388][T10888] ? __might_fault+0xc0/0x140 [ 321.173418][T10888] ____sys_sendmsg+0xa4d/0xbe0 [ 321.173436][T10888] ? __pfx_netlink_sendmsg+0x10/0x10 [ 321.173458][T10888] ? __pfx_____sys_sendmsg+0x10/0x10 [ 321.173487][T10888] ___sys_sendmsg+0x190/0x1e0 [ 321.173508][T10888] ? __pfx____sys_sendmsg+0x10/0x10 [ 321.173525][T10888] ? __lock_acquire+0x49f/0x1a40 [ 321.173541][T10888] ? get_pid_task+0x106/0x250 [ 321.173588][T10888] __sys_sendmsg+0x160/0x210 [ 321.173603][T10888] ? __pfx___sys_sendmsg+0x10/0x10 [ 321.173630][T10888] do_syscall_64+0x115/0x870 [ 321.173650][T10888] ? clear_bhb_loop+0x40/0x90 [ 321.173670][T10888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.173688][T10888] RIP: 0033:0x7f887b59de59 [ 321.173702][T10888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.173717][T10888] RSP: 002b:00007f887c502028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.173732][T10888] RAX: ffffffffffffffda RBX: 00007f887b825fa0 RCX: 00007f887b59de59 [ 321.173742][T10888] RDX: 0000000000000040 RSI: 0000200000000140 RDI: 0000000000000003 [ 321.173751][T10888] RBP: 00007f887c502090 R08: 0000000000000000 R09: 0000000000000000 [ 321.173760][T10888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.173769][T10888] R13: 00007f887b826038 R14: 00007f887b825fa0 R15: 00007ffd36b13688 [ 321.173790][T10888] [ 321.631601][ T7683] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 321.859212][T10902] gretap0: Device is already in use. [ 322.643395][T10917] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=23 sclass=netlink_tcpdiag_socket pid=10917 comm=syz.1.1430 [ 322.864417][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 322.864434][ T29] audit: type=1400 audit(1783190363.080:827): avc: denied { create } for pid=10919 comm="syz.2.1433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 322.896081][ T7683] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 322.950215][ T29] audit: type=1400 audit(1783190363.110:828): avc: denied { write } for pid=10919 comm="syz.2.1433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 322.978654][T10922] IPv6: NLM_F_CREATE should be specified when creating new route [ 323.044505][T10930] fuse: fd is not a fuse device [ 323.083889][ T7683] usb 5-1: config 0 has an invalid interface number: 213 but max is 0 [ 323.093739][ T7683] usb 5-1: config 0 has no interface number 0 [ 323.101186][ T7683] usb 5-1: too many endpoints for config 0 interface 213 altsetting 136: 242, using maximum allowed: 30 [ 323.120359][ T7683] usb 5-1: config 0 interface 213 altsetting 136 has 0 endpoint descriptors, different from the interface descriptor's value: 242 [ 323.138359][ T7683] usb 5-1: config 0 interface 213 has no altsetting 0 [ 323.157847][ T7683] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 323.169348][ T7683] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.179333][ T7683] usb 5-1: Product: syz [ 323.209753][ T7683] usb 5-1: Manufacturer: syz [ 323.218387][ T7683] usb 5-1: SerialNumber: syz [ 323.239010][T10934] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 323.257622][ T7683] usb 5-1: config 0 descriptor?? [ 323.401379][ T5625] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 323.731516][T10951] FAULT_INJECTION: forcing a failure. [ 323.731516][T10951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 323.764121][T10951] CPU: 0 UID: 0 PID: 10951 Comm: syz.2.1442 Not tainted syzkaller #0 PREEMPT(full) [ 323.764146][T10951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 323.764156][T10951] Call Trace: [ 323.764162][T10951] [ 323.764169][T10951] dump_stack_lvl+0x100/0x190 [ 323.764191][T10951] should_fail_ex.cold+0x5/0xa [ 323.764208][T10951] _copy_to_user+0x32/0xd0 [ 323.764226][T10951] simple_read_from_buffer+0xcb/0x170 [ 323.764250][T10951] proc_fail_nth_read+0x1af/0x230 [ 323.764270][T10951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 323.764289][T10951] ? rw_verify_area+0xce/0x6d0 [ 323.764306][T10951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 323.764324][T10951] vfs_read+0x1e4/0xb40 [ 323.764344][T10951] ? __pfx_vfs_read+0x10/0x10 [ 323.764362][T10951] ? __fget_files+0x215/0x3d0 [ 323.764387][T10951] ? __fget_files+0x21f/0x3d0 [ 323.764413][T10951] ksys_read+0x12a/0x250 [ 323.764431][T10951] ? __pfx_ksys_read+0x10/0x10 [ 323.764454][T10951] do_syscall_64+0x115/0x870 [ 323.764473][T10951] ? clear_bhb_loop+0x40/0x90 [ 323.764490][T10951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.764503][T10951] RIP: 0033:0x7f887b55e68e [ 323.764515][T10951] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 323.764528][T10951] RSP: 002b:00007f887c501fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 323.764542][T10951] RAX: ffffffffffffffda RBX: 00007f887c5026c0 RCX: 00007f887b55e68e [ 323.764551][T10951] RDX: 000000000000000f RSI: 00007f887c5020a0 RDI: 0000000000000004 [ 323.764559][T10951] RBP: 00007f887c502090 R08: 0000000000000000 R09: 0000000000000000 [ 323.764567][T10951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 323.764575][T10951] R13: 00007f887b826038 R14: 00007f887b825fa0 R15: 00007ffd36b13688 [ 323.764594][T10951] [ 324.822389][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 324.890428][T10994] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1450'. [ 325.931937][T11029] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=128 sclass=netlink_route_socket pid=11029 comm=syz.0.1460 [ 326.716698][ T46] usb 5-1: USB disconnect, device number 38 [ 326.765142][T11044] FAULT_INJECTION: forcing a failure. [ 326.765142][T11044] name failslab, interval 1, probability 0, space 0, times 0 [ 326.778090][T11044] CPU: 0 UID: 0 PID: 11044 Comm: syz.4.1465 Not tainted syzkaller #0 PREEMPT(full) [ 326.778105][T11044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 326.778112][T11044] Call Trace: [ 326.778116][T11044] [ 326.778120][T11044] dump_stack_lvl+0x100/0x190 [ 326.778138][T11044] should_fail_ex.cold+0x5/0xa [ 326.778152][T11044] should_failslab+0xc2/0x120 [ 326.778164][T11044] __kmalloc_cache_noprof+0x91/0x6c0 [ 326.778179][T11044] ? __xa_alloc_cyclic+0x1f2/0x330 [ 326.778189][T11044] ? __xdp_reg_mem_model+0x134/0x6a0 [ 326.778205][T11044] __xdp_reg_mem_model+0x134/0x6a0 [ 326.778217][T11044] ? __pfx___xdp_reg_mem_model+0x10/0x10 [ 326.778231][T11044] ? page_pool_list+0x223/0x2a0 [ 326.778243][T11044] xdp_reg_mem_model+0x22/0x70 [ 326.778256][T11044] bpf_test_run_xdp_live+0x1cb/0x760 [ 326.778270][T11044] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 326.778287][T11044] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 326.778311][T11044] ? _copy_from_user+0x59/0xd0 [ 326.778324][T11044] ? bpf_test_init.isra.0+0x51/0x100 [ 326.778339][T11044] bpf_prog_test_run_xdp+0xd7d/0x1670 [ 326.778358][T11044] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 326.778376][T11044] ? fput+0x79/0x100 [ 326.778387][T11044] ? __bpf_prog_get+0x97/0x2a0 [ 326.778400][T11044] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 326.778413][T11044] __sys_bpf+0x2a12/0x4e80 [ 326.778433][T11044] ? __pfx___sys_bpf+0x10/0x10 [ 326.778449][T11044] ? find_held_lock+0x2b/0x80 [ 326.778464][T11044] ? get_pid_task+0xfc/0x250 [ 326.778479][T11044] ? get_pid_task+0xfc/0x250 [ 326.778498][T11044] ? find_held_lock+0x2b/0x80 [ 326.778516][T11044] ? rcu_read_lock_any_held+0x6a/0xa0 [ 326.778532][T11044] ? find_held_lock+0x2b/0x80 [ 326.778546][T11044] ? ksys_write+0x190/0x250 [ 326.778560][T11044] ? ksys_write+0x190/0x250 [ 326.778584][T11044] ? fput+0x79/0x100 [ 326.778596][T11044] ? __x64_sys_bpf+0xce/0x140 [ 326.778612][T11044] __x64_sys_bpf+0xce/0x140 [ 326.778633][T11044] ? do_syscall_64+0x90/0x870 [ 326.778656][T11044] do_syscall_64+0x115/0x870 [ 326.778678][T11044] ? clear_bhb_loop+0x40/0x90 [ 326.778696][T11044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.778713][T11044] RIP: 0033:0x7ff90bd9de59 [ 326.778727][T11044] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 326.778743][T11044] RSP: 002b:00007ff909ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 326.778757][T11044] RAX: ffffffffffffffda RBX: 00007ff90c025fa0 RCX: 00007ff90bd9de59 [ 326.778763][T11044] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 326.778769][T11044] RBP: 00007ff909ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 326.778775][T11044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 326.778781][T11044] R13: 00007ff90c026038 R14: 00007ff90c025fa0 R15: 00007ffceac16d38 [ 326.778795][T11044] [ 327.746386][T11051] netlink: 184 bytes leftover after parsing attributes in process `syz.4.1467'. [ 327.901088][ T29] audit: type=1400 audit(1783190368.110:829): avc: denied { watch } for pid=11055 comm="syz.2.1469" path="/179/file1" dev="tmpfs" ino=953 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 328.564299][T11070] trusted_key: encrypted_key: insufficient parameters specified [ 328.576009][T11070] netlink: 'syz.2.1473': attribute type 40 has an invalid length. [ 329.003996][T11072] openvswitch: netlink: Flow actions attr not present in new flow. [ 329.054803][T11049] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1466'. [ 329.068163][T11076] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1475'. [ 329.210944][T11084] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1479'. [ 329.395901][ T29] audit: type=1400 audit(1783190369.610:830): avc: denied { execute } for pid=11089 comm="syz.4.1481" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 329.905589][ T29] audit: type=1400 audit(1783190370.120:831): avc: denied { append } for pid=11089 comm="syz.4.1481" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 330.316903][T11099] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.379161][T11099] bridge_slave_1 (unregistering): left allmulticast mode [ 330.397376][T11099] bridge_slave_1 (unregistering): left promiscuous mode [ 330.433951][T11099] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.508655][ T29] audit: type=1800 audit(1783190370.720:832): pid=11109 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.1488" name="nullb0" dev="tmpfs" ino=654 res=0 errno=0 [ 331.076843][T11111] lo speed is unknown, defaulting to 1000 [ 331.369926][ T29] audit: type=1326 audit(1783190371.580:833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11110 comm="syz.2.1489" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x0 [ 331.922163][ T29] audit: type=1400 audit(1783190372.090:834): avc: denied { map } for pid=11145 comm="syz.4.1498" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 332.832420][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 333.175142][T11166] fuse: fd is not a fuse device [ 334.132413][ T7701] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 334.282387][ T29] audit: type=1400 audit(1783190374.490:835): avc: denied { ioctl } for pid=11175 comm="syz.4.1506" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 334.328635][ T7701] usb 3-1: device descriptor read/64, error -71 [ 334.524165][T11183] tipc: Enabled bearer , priority 0 [ 334.563655][T11183] syzkaller0: entered promiscuous mode [ 334.585396][T11183] syzkaller0: entered allmulticast mode [ 334.605573][ T7701] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 334.626063][T11187] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 334.682642][T11183] tipc: Resetting bearer [ 334.709713][T11182] tipc: Resetting bearer [ 334.742094][T11182] tipc: Disabling bearer [ 334.752354][ T7701] usb 3-1: device descriptor read/64, error -71 [ 334.863431][ T7701] usb usb3-port1: attempt power cycle [ 335.223315][ T7701] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 335.266936][T11213] lo speed is unknown, defaulting to 1000 [ 335.275064][ T7701] usb 3-1: device descriptor read/8, error -71 [ 335.512300][ T7701] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 335.544218][ T7701] usb 3-1: device descriptor read/8, error -71 [ 335.546554][T11213] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1518'. [ 335.567730][T11213] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 335.682712][ T7701] usb usb3-port1: unable to enumerate USB device [ 336.719032][T11229] overlayfs: upper fs does not support file handles, falling back to index=off. [ 336.839017][T11236] openvswitch: netlink: Missing key (keys=40, expected=100) [ 336.940299][T11240] veth0: entered promiscuous mode [ 337.899703][T11240] veth0: left promiscuous mode [ 337.942524][ T7701] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 338.725758][T11272] netlink: 'syz.2.1536': attribute type 1 has an invalid length. [ 338.733623][T11272] netlink: 'syz.2.1536': attribute type 2 has an invalid length. [ 339.145942][T11280] overlayfs: upper fs does not support file handles, falling back to index=off. [ 339.578060][ T29] audit: type=1400 audit(1783190379.780:836): avc: denied { write } for pid=11279 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 339.736005][ T29] audit: type=1400 audit(1783190379.940:837): avc: denied { write } for pid=11297 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 340.099765][T11309] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1792 sclass=netlink_route_socket pid=11309 comm=syz.1.1541 [ 340.842288][ T7701] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 340.859516][T11326] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 340.957879][ T29] audit: type=1400 audit(1783190381.170:838): avc: denied { write } for pid=11308 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 341.014157][ T7701] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 341.122326][ T7701] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 341.142369][ T7701] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.158536][ T7701] usb 5-1: config 0 descriptor?? [ 341.171139][T11336] overlayfs: upper fs does not support file handles, falling back to index=off. [ 341.176595][ T7701] pwc: Askey VC010 type 2 USB webcam detected. [ 341.220234][ T29] audit: type=1400 audit(1783190381.430:839): avc: denied { write } for pid=11337 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 341.488018][T11349] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1552'. [ 341.522442][T11349] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 341.584979][ T7701] pwc: recv_control_msg error -32 req 02 val 2b00 [ 341.610116][ T7701] pwc: recv_control_msg error -32 req 02 val 2700 [ 341.894493][ T7701] pwc: recv_control_msg error -71 req 04 val 1000 [ 341.917003][ T7701] pwc: recv_control_msg error -71 req 04 val 1300 [ 341.938312][ T7701] pwc: recv_control_msg error -71 req 04 val 1400 [ 341.953035][T11358] lo speed is unknown, defaulting to 1000 [ 341.959840][ T7701] pwc: recv_control_msg error -71 req 02 val 2000 [ 341.972348][ T7701] pwc: recv_control_msg error -71 req 02 val 2100 [ 341.986456][ T7701] pwc: recv_control_msg error -71 req 04 val 1500 [ 342.012653][ T7701] pwc: recv_control_msg error -71 req 02 val 2500 [ 342.021913][ T7701] pwc: recv_control_msg error -71 req 02 val 2400 [ 342.040456][ T7701] pwc: recv_control_msg error -71 req 02 val 2600 [ 342.056048][ T7701] pwc: recv_control_msg error -71 req 02 val 2900 [ 342.072372][ T7701] pwc: recv_control_msg error -71 req 02 val 2800 [ 342.088392][ T7701] pwc: recv_control_msg error -71 req 04 val 1100 [ 342.102699][ T7701] pwc: recv_control_msg error -71 req 04 val 1200 [ 342.124835][T11364] tmpfs: Cannot disable swap on remount [ 342.146346][ T7701] pwc: Registered as video103. [ 342.164528][ T7701] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input14 [ 342.198362][ T29] audit: type=1400 audit(1783190382.410:840): avc: denied { read } for pid=4961 comm="acpid" name="event4" dev="devtmpfs" ino=2977 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 342.208629][ T7701] usb 5-1: USB disconnect, device number 40 [ 342.322582][ T29] audit: type=1400 audit(1783190382.410:841): avc: denied { open } for pid=4961 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2977 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 342.349983][ T29] audit: type=1400 audit(1783190382.410:842): avc: denied { ioctl } for pid=4961 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2977 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 342.849413][ T29] audit: type=1400 audit(1783190383.060:843): avc: denied { write } for pid=11392 comm="syz.4.1564" name="ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 342.996942][ T29] audit: type=1400 audit(1783190383.200:844): avc: denied { read write } for pid=11392 comm="syz.4.1564" name="mouse0" dev="devtmpfs" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 343.068264][ T29] audit: type=1400 audit(1783190383.200:845): avc: denied { open } for pid=11392 comm="syz.4.1564" path="/dev/input/mouse0" dev="devtmpfs" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 343.880802][T11419] 9p: Could not find request transport: fd0x0000000000000003 [ 344.417459][T11435] syz_tun: entered allmulticast mode [ 344.779630][T11455] xfrm1: entered allmulticast mode [ 344.832022][T11458] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1582'. [ 344.857805][T11458] 8021q: VLANs not supported on ip6gre0 [ 345.712963][T11471] netlink: 'syz.0.1586': attribute type 11 has an invalid length. [ 346.716379][T11509] macsec1: entered promiscuous mode [ 346.734665][T11509] macsec1: entered allmulticast mode [ 346.974251][T11479] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 348.805747][T11557] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11557 comm=syz.4.1608 [ 348.819890][T11557] netlink: 'syz.4.1608': attribute type 1 has an invalid length. [ 348.832346][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 348.843702][T11557] 8021q: adding VLAN 0 to HW filter on device bond1 [ 348.864137][T11557] vlan2: entered allmulticast mode [ 348.869355][T11557] veth0_to_bond: entered allmulticast mode [ 348.880558][T11557] bond1: (slave vlan2): making interface the new active one [ 348.889975][T11557] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 349.168911][T11574] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1614'. [ 349.224346][T11574] 8021q: VLANs not supported on ip6gre0 [ 350.068478][T11587] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1619'. [ 350.208169][ T9] libceph: connect (1)[c::]:6789 error -101 [ 350.225072][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 350.369239][T11588] ceph: No mds server is up or the cluster is laggy [ 350.520381][T11605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1624'. [ 350.637316][T11588] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5127 sclass=netlink_route_socket pid=11588 comm=syz.0.1619 [ 350.691592][T11611] 8021q: adding VLAN 0 to HW filter on device bond4 [ 350.732374][ T46] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 350.788837][T11611] bond4: (slave ip6erspan0): making interface the new active one [ 350.798119][T11611] bond4: (slave ip6erspan0): Enslaving as an active interface with an up link [ 350.836978][ T29] audit: type=1326 audit(1783190391.050:846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 350.864357][ T29] audit: type=1326 audit(1783190391.050:847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 350.899174][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 350.913814][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 350.926744][ T29] audit: type=1326 audit(1783190391.080:848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=78 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 350.971673][ T46] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 350.980867][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.992268][ T29] audit: type=1326 audit(1783190391.080:849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.019044][ T46] usb 5-1: Product: syz [ 351.025135][ T46] usb 5-1: Manufacturer: syz [ 351.029781][ T46] usb 5-1: SerialNumber: syz [ 351.037611][ T29] audit: type=1326 audit(1783190391.080:850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.065453][ T29] audit: type=1326 audit(1783190391.100:851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.092991][ T29] audit: type=1326 audit(1783190391.100:852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.119569][ T29] audit: type=1326 audit(1783190391.110:853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.166121][ T29] audit: type=1326 audit(1783190391.110:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.214175][ T29] audit: type=1326 audit(1783190391.110:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11615 comm="syz.2.1627" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887b59de59 code=0x7ffc0000 [ 351.221284][T11622] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1629'. [ 351.288443][T11601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 351.332646][T11601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 351.370275][ T46] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 351.409314][ T46] usb 5-1: USB disconnect, device number 41 [ 351.688443][T11647] netlink: 136 bytes leftover after parsing attributes in process `syz.1.1634'. [ 351.737821][T11650] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 351.764768][T11650] CIFS mount error: No usable UNC path provided in device string! [ 351.764768][T11650] [ 351.774913][T11650] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 351.878948][T11654] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1636'. [ 351.991511][ T46] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 352.192386][ T46] usb 5-1: Using ep0 maxpacket: 8 [ 352.463674][ T46] usb 5-1: config index 0 descriptor too short (expected 301, got 72) [ 352.507769][ T46] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 352.619984][ T46] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 352.672694][ T46] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 352.741999][ T46] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 352.759820][ T46] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 352.772620][ T46] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 352.807148][ T46] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.025658][T11671] lo speed is unknown, defaulting to 1000 [ 353.048136][T11601] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1622'. [ 353.062996][T11671] lo speed is unknown, defaulting to 1000 [ 353.078188][ T46] usb 5-1: usb_control_msg returned -71 [ 353.089264][ T46] usbtmc 5-1:16.0: can't read capabilities [ 353.145744][ T46] usb 5-1: USB disconnect, device number 42 [ 353.167318][T11671] lo speed is unknown, defaulting to 1000 [ 354.665843][T11671] infiniband syz1: set down [ 354.671016][ T5702] lo speed is unknown, defaulting to 1000 [ 354.690646][T11671] infiniband syz1: added lo [ 354.769780][T11671] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 354.842266][T11671] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 354.935442][T11671] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 354.948219][T11717] tipc: Enabling of bearer rejected, failed to enable media [ 355.089540][T11671] RDS/IB: syz1: added [ 355.107964][T11671] smc: adding ib device syz1 with port count 1 [ 355.122548][T11671] smc: ib device syz1 port 1 has no pnetid [ 355.135269][ T46] lo speed is unknown, defaulting to 1000 [ 355.173089][T11671] lo speed is unknown, defaulting to 1000 [ 355.295408][T11733] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1655'. [ 355.469999][T11671] lo speed is unknown, defaulting to 1000 [ 355.472290][ T5702] usb 5-1: new full-speed USB device number 43 using dummy_hcd [ 355.618531][ T9] libceph: connect (1)[c::]:6789 error -101 [ 355.628540][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 355.739657][T11746] ceph: No mds server is up or the cluster is laggy [ 355.763496][ T5702] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 355.784372][ T5702] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 356.217249][ T9] libceph: connect (1)[c::]:6789 error -101 [ 356.223376][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 356.230271][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.239310][ T5702] usb 5-1: Product: syz [ 356.244439][ T5702] usb 5-1: Manufacturer: syz [ 356.250405][ T5702] usb 5-1: SerialNumber: syz [ 356.391034][T11671] lo speed is unknown, defaulting to 1000 [ 356.432454][T11762] netlink: 'syz.0.1658': attribute type 14 has an invalid length. [ 356.582575][ T5702] usb 5-1: USB disconnect, device number 43 [ 356.807824][T11671] lo speed is unknown, defaulting to 1000 [ 357.089252][T11671] lo speed is unknown, defaulting to 1000 [ 357.834237][T11775] xt_nfacct: accounting object `syz1' does not exist [ 357.851568][T11777] xt_nfacct: accounting object `syz1' does not exist [ 357.885674][T11775] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11775 comm=syz.0.1661 [ 357.977454][T11780] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=11780 comm=syz.3.1662 [ 358.162786][T11782] pim6reg: entered allmulticast mode [ 359.648126][T11794] lo speed is unknown, defaulting to 1000 [ 359.662725][T11794] lo speed is unknown, defaulting to 1000 [ 360.543566][ T29] kauditd_printk_skb: 76 callbacks suppressed [ 360.543581][ T29] audit: type=1400 audit(1783190400.760:932): avc: denied { accept } for pid=11801 comm="syz.0.1669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 360.964290][T11821] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1030 sclass=netlink_route_socket pid=11821 comm=syz.0.1671 [ 361.535666][T11829] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=72 sclass=netlink_xfrm_socket pid=11829 comm=syz.0.1671 [ 361.655724][T11833] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=12 sclass=netlink_route_socket pid=11833 comm=syz.3.1676 [ 361.682333][ T29] audit: type=1400 audit(1783190401.880:933): avc: denied { write } for pid=11830 comm="syz.4.1675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 361.768703][T11835] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1675'. [ 361.781856][T11833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1676'. [ 361.889337][T11837] netdevsim netdevsim4: Firmware load for '../file0/file0' refused, path contains '..' component [ 363.127646][T11857] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 363.258726][T11860] tipc: Enabling of bearer rejected, failed to enable media [ 363.592018][ T29] audit: type=1400 audit(1783190403.800:934): avc: denied { create } for pid=11868 comm="syz.4.1685" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 364.180437][T11869] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.187682][T11869] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.050360][T11869] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 365.087086][T11869] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 365.670965][T11893] lo speed is unknown, defaulting to 1000 [ 365.678992][T11893] lo speed is unknown, defaulting to 1000 [ 365.738092][ T80] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.856787][ T80] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.906916][ T80] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.919550][ T80] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.050167][T11909] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 367.678588][ T29] audit: type=1400 audit(1783190407.880:935): avc: denied { write } for pid=11896 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.853346][T11933] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1697'. [ 367.882711][T11933] netlink: 'syz.2.1697': attribute type 7 has an invalid length. [ 367.891979][T11933] netlink: 'syz.2.1697': attribute type 8 has an invalid length. [ 367.973520][T11933] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1697'. [ 368.051170][ T29] audit: type=1400 audit(1783190408.260:936): avc: denied { write } for pid=11940 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 368.238881][T11945] FAULT_INJECTION: forcing a failure. [ 368.238881][T11945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 368.252013][T11945] CPU: 0 UID: 0 PID: 11945 Comm: syz.4.1700 Not tainted syzkaller #0 PREEMPT(full) [ 368.252036][T11945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 368.252046][T11945] Call Trace: [ 368.252052][T11945] [ 368.252058][T11945] dump_stack_lvl+0x100/0x190 [ 368.252084][T11945] should_fail_ex.cold+0x5/0xa [ 368.252106][T11945] _copy_from_user+0x2e/0xd0 [ 368.252127][T11945] copy_msghdr_from_user+0x9f/0x4c0 [ 368.252150][T11945] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 368.252183][T11945] ___sys_sendmsg+0x106/0x1e0 [ 368.252209][T11945] ? __pfx____sys_sendmsg+0x10/0x10 [ 368.252228][T11945] ? __lock_acquire+0x49f/0x1a40 [ 368.252247][T11945] ? get_pid_task+0x106/0x250 [ 368.252295][T11945] __sys_sendmsg+0x160/0x210 [ 368.252313][T11945] ? __pfx___sys_sendmsg+0x10/0x10 [ 368.252340][T11945] do_syscall_64+0x115/0x870 [ 368.252363][T11945] ? clear_bhb_loop+0x40/0x90 [ 368.252384][T11945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.252401][T11945] RIP: 0033:0x7ff90bd9de59 [ 368.252415][T11945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.252430][T11945] RSP: 002b:00007ff909fb4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 368.252447][T11945] RAX: ffffffffffffffda RBX: 00007ff90c026180 RCX: 00007ff90bd9de59 [ 368.252458][T11945] RDX: 00000000280048c6 RSI: 0000200000000000 RDI: 000000000000000c [ 368.252468][T11945] RBP: 00007ff909fb4090 R08: 0000000000000000 R09: 0000000000000000 [ 368.252478][T11945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 368.252487][T11945] R13: 00007ff90c026218 R14: 00007ff90c026180 R15: 00007ffceac16d38 [ 368.252511][T11945] [ 370.691878][T11978] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1706'. [ 370.724406][ T29] audit: type=1400 audit(1783190410.930:937): avc: denied { write } for pid=11947 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 371.454489][T11989] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1709'. [ 371.574460][ T29] audit: type=1400 audit(1783190411.790:938): avc: denied { write } for pid=11990 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 372.838245][ T29] audit: type=1400 audit(1783190413.050:939): avc: denied { write } for pid=12001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 372.862222][ T0] NOHZ tick-stop error: local softirq work is pending, handler #86!!! [ 373.148915][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.178873][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.449793][ T29] audit: type=1400 audit(1783190413.660:940): avc: denied { write } for pid=12026 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 374.901021][T12050] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1721'. [ 374.989942][T12055] veth1_virt_wifi: entered promiscuous mode [ 375.041859][T12055] veth1_virt_wifi: left promiscuous mode [ 375.114656][T12066] FAULT_INJECTION: forcing a failure. [ 375.114656][T12066] name failslab, interval 1, probability 0, space 0, times 0 [ 375.171207][T12066] CPU: 1 UID: 0 PID: 12066 Comm: syz.4.1724 Not tainted syzkaller #0 PREEMPT(full) [ 375.171233][T12066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 375.171243][T12066] Call Trace: [ 375.171249][T12066] [ 375.171256][T12066] dump_stack_lvl+0x100/0x190 [ 375.171288][T12066] should_fail_ex.cold+0x5/0xa [ 375.171311][T12066] should_failslab+0xc2/0x120 [ 375.171331][T12066] kmem_cache_alloc_noprof+0x91/0x6a0 [ 375.171350][T12066] ? ptlock_alloc+0x1f/0x70 [ 375.171378][T12066] ptlock_alloc+0x1f/0x70 [ 375.171400][T12066] pte_alloc_one+0x82/0x3d0 [ 375.171418][T12066] __pte_alloc+0x6d/0x3e0 [ 375.171437][T12066] ? __pfx___pte_alloc+0x10/0x10 [ 375.171456][T12066] ? do_raw_spin_lock+0x128/0x260 [ 375.171478][T12066] ? find_held_lock+0x2b/0x80 [ 375.171504][T12066] do_anonymous_page+0x13ae/0x2080 [ 375.171533][T12066] ? __pmd_alloc+0x3fb/0x950 [ 375.171556][T12066] __handle_mm_fault+0x1d2c/0x2a00 [ 375.171586][T12066] ? mt_find+0x45e/0x8e0 [ 375.171605][T12066] ? __pfx___handle_mm_fault+0x10/0x10 [ 375.171627][T12066] ? __pfx_mt_find+0x10/0x10 [ 375.171656][T12066] ? find_vma+0xbf/0x140 [ 375.171673][T12066] ? __pfx_find_vma+0x10/0x10 [ 375.171693][T12066] handle_mm_fault+0x37b/0xa30 [ 375.171722][T12066] do_user_addr_fault+0x74c/0x12f0 [ 375.171754][T12066] exc_page_fault+0x6f/0xd0 [ 375.171778][T12066] asm_exc_page_fault+0x26/0x30 [ 375.171795][T12066] RIP: 0010:rep_movs_alternative+0xf/0xa0 [ 375.171815][T12066] Code: c4 10 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 7d 9d 04 00 66 66 [ 375.171831][T12066] RSP: 0018:ffffc90010447d10 EFLAGS: 00050202 [ 375.171845][T12066] RAX: 0000000000000001 RBX: 0000200000001980 RCX: 0000000000000004 [ 375.171855][T12066] RDX: 0000000000000001 RSI: 0000200000001980 RDI: ffffc90010447d88 [ 375.171866][T12066] RBP: 0000000000000004 R08: 0000000000000001 R09: fffff52002088fb1 [ 375.171876][T12066] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 375.171886][T12066] R13: ffffc90010447d88 R14: 0000000000000004 R15: ffff88805665f000 [ 375.171910][T12066] _copy_from_user+0x98/0xd0 [ 375.171933][T12066] xsk_setsockopt+0x886/0xab0 [ 375.171954][T12066] ? __pfx_xsk_setsockopt+0x10/0x10 [ 375.171973][T12066] ? find_held_lock+0x2b/0x80 [ 375.171995][T12066] ? __fget_files+0x215/0x3d0 [ 375.172022][T12066] ? selinux_socket_setsockopt+0x6a/0x80 [ 375.172040][T12066] ? __pfx_xsk_setsockopt+0x10/0x10 [ 375.172053][T12066] do_sock_setsockopt+0xf3/0x1d0 [ 375.172067][T12066] __sys_setsockopt+0x195/0x220 [ 375.172087][T12066] __x64_sys_setsockopt+0xbd/0x160 [ 375.172103][T12066] ? do_syscall_64+0x90/0x870 [ 375.172118][T12066] ? lockdep_hardirqs_on+0x78/0x100 [ 375.172132][T12066] do_syscall_64+0x115/0x870 [ 375.172146][T12066] ? clear_bhb_loop+0x40/0x90 [ 375.172159][T12066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.172169][T12066] RIP: 0033:0x7ff90bd9de59 [ 375.172178][T12066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.172189][T12066] RSP: 002b:00007ff909ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 375.172204][T12066] RAX: ffffffffffffffda RBX: 00007ff90c025fa0 RCX: 00007ff90bd9de59 [ 375.172214][T12066] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000003 [ 375.172222][T12066] RBP: 00007ff909ff6090 R08: 0000000000000004 R09: 0000000000000000 [ 375.172232][T12066] R10: 0000200000001980 R11: 0000000000000246 R12: 0000000000000001 [ 375.172241][T12066] R13: 00007ff90c026038 R14: 00007ff90c025fa0 R15: 00007ffceac16d38 [ 375.172263][T12066] [ 375.562715][T12058] veth1_virt_wifi: entered promiscuous mode [ 375.578048][T12058] veth1_virt_wifi: left promiscuous mode [ 375.713842][T12073] sch_tbf: burst 19872 is lower than device lo mtu (65558) ! [ 376.101398][ T29] audit: type=1400 audit(1783190416.310:941): avc: denied { read } for pid=12083 comm="syz.3.1731" path="socket:[28726]" dev="sockfs" ino=28726 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 376.750107][ T7682] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 376.914860][ T7682] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 376.943924][ T7682] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 376.961634][ T7682] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 376.981310][ T7682] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.996226][ T7682] usb 5-1: Product: syz [ 377.008328][ T7682] usb 5-1: Manufacturer: syz [ 377.016422][ T7682] usb 5-1: SerialNumber: syz [ 377.256022][T12078] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1727'. [ 377.685578][T12127] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1741'. [ 377.873264][ T7682] usb 5-1: USB disconnect, device number 44 [ 377.959934][T12133] udevd[12133]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 378.702304][ T5703] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 378.864671][ T5703] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 378.892322][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.912403][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 378.932637][ T5703] usb 5-1: config 0 descriptor?? [ 378.971257][ T5703] pwc: Samsung MPC-C10 USB webcam detected. [ 379.041451][T12168] netlink: 'syz.2.1756': attribute type 1 has an invalid length. [ 379.114289][T12173] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1758'. [ 380.024942][ T5625] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 380.323539][ T5625] Bluetooth: hci1: Injecting HCI hardware error event [ 380.335684][ T49] Bluetooth: hci1: hardware error 0x00 [ 380.405755][ T5703] pwc: send_video_command error -71 [ 380.419223][ T5703] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 380.447845][ T5703] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 380.460893][ T5703] usb 5-1: USB disconnect, device number 45 [ 380.768976][T12189] overlayfs: missing 'lowerdir' [ 381.346214][T12206] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1768'. [ 382.443787][ T49] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 382.466005][T12229] overlayfs: missing 'lowerdir' [ 383.626628][T12255] xt_hashlimit: max too large, truncated to 1048576 [ 383.636635][ T29] audit: type=1326 audit(1783190423.850:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12254 comm="syz.0.1786" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f16bdd9de59 code=0x0 [ 383.699551][T12257] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1786'. [ 384.955229][T12282] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1795'. [ 385.420049][T12285] fuse: Bad value for 'fd' [ 385.717368][ T29] audit: type=1400 audit(1783190425.930:943): avc: denied { create } for pid=12290 comm="syz.1.1799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 385.741004][ T29] audit: type=1400 audit(1783190425.950:944): avc: denied { bind } for pid=12290 comm="syz.1.1799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 386.207021][T12307] FAULT_INJECTION: forcing a failure. [ 386.207021][T12307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 386.220415][T12307] CPU: 0 UID: 0 PID: 12307 Comm: syz.4.1804 Not tainted syzkaller #0 PREEMPT(full) [ 386.220437][T12307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 386.220447][T12307] Call Trace: [ 386.220453][T12307] [ 386.220460][T12307] dump_stack_lvl+0x100/0x190 [ 386.220485][T12307] should_fail_ex.cold+0x5/0xa [ 386.220507][T12307] _copy_to_user+0x32/0xd0 [ 386.220531][T12307] simple_read_from_buffer+0xcb/0x170 [ 386.220558][T12307] proc_fail_nth_read+0x1af/0x230 [ 386.220582][T12307] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 386.220606][T12307] ? rw_verify_area+0xce/0x6d0 [ 386.220626][T12307] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 386.220648][T12307] vfs_read+0x1e4/0xb40 [ 386.220673][T12307] ? __pfx_vfs_read+0x10/0x10 [ 386.220694][T12307] ? __fget_files+0x215/0x3d0 [ 386.220724][T12307] ? __fget_files+0x21f/0x3d0 [ 386.220755][T12307] ksys_read+0x12a/0x250 [ 386.220777][T12307] ? __pfx_ksys_read+0x10/0x10 [ 386.220805][T12307] do_syscall_64+0x115/0x870 [ 386.220828][T12307] ? clear_bhb_loop+0x40/0x90 [ 386.220849][T12307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.220866][T12307] RIP: 0033:0x7ff90bd5e68e [ 386.220879][T12307] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 386.220895][T12307] RSP: 002b:00007ff909ff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 386.220910][T12307] RAX: ffffffffffffffda RBX: 00007ff909ff66c0 RCX: 00007ff90bd5e68e [ 386.220921][T12307] RDX: 000000000000000f RSI: 00007ff909ff60a0 RDI: 0000000000000004 [ 386.220931][T12307] RBP: 00007ff909ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 386.220939][T12307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 386.220949][T12307] R13: 00007ff90c026038 R14: 00007ff90c025fa0 R15: 00007ffceac16d38 [ 386.220972][T12307] [ 388.062881][T12332] netlink: 'syz.2.1810': attribute type 5 has an invalid length. [ 388.196392][T12340] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1812'. [ 388.205604][T12339] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1813'. [ 388.627750][T12341] bridge0: port 3(erspan0) entered disabled state [ 389.846549][ T29] audit: type=1400 audit(1783190430.060:945): avc: denied { getattr } for pid=12375 comm="syz.0.1820" name="/" dev="nullfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 390.650811][T12387] overlayfs: missing 'lowerdir' [ 390.909513][T11403] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 390.940603][T12396] netlink: 'syz.0.1825': attribute type 10 has an invalid length. [ 390.948420][T12396] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1825'. [ 390.957703][T11403] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.967156][T11403] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 391.003525][T12345] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.015129][T12345] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.026932][T12345] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 391.052078][T12396] team0: Port device geneve1 added [ 391.057694][T11403] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.068054][T11403] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.077137][T11403] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 391.086330][T11403] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.096549][T11403] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.106694][T11403] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 391.184903][T12402] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 391.195786][T12402] overlayfs: missing 'lowerdir' [ 391.868685][ T7701] IPVS: starting estimator thread 0... [ 392.002807][T12413] IPVS: using max 78 ests per chain, 187200 per kthread [ 393.386837][T12429] overlayfs: missing 'lowerdir' [ 395.182962][T12452] kAFS: Can only specify source 'none' with -o dyn [ 396.500534][T12475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1840'. [ 396.519710][T12475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1840'. [ 396.536280][T12475] netlink: 'syz.2.1840': attribute type 19 has an invalid length. [ 396.552293][T12475] netlink: 'syz.2.1840': attribute type 20 has an invalid length. [ 396.587982][ T51] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 396.603408][ T51] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 396.628407][ T51] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 396.662931][ T51] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 396.952279][ T806] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 397.113995][ T806] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 397.143271][ T806] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 397.168762][ T806] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 397.188254][ T806] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.215409][ T806] usb 5-1: config 0 descriptor?? [ 397.331478][T12492] lo speed is unknown, defaulting to 1000 [ 397.360394][T12492] lo speed is unknown, defaulting to 1000 [ 397.479802][ T29] audit: type=1400 audit(1783190437.690:946): avc: denied { create } for pid=12495 comm="syz.0.1855" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 397.518614][T12496] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1855'. [ 397.534259][ T29] audit: type=1400 audit(1783190437.710:947): avc: denied { write } for pid=12495 comm="syz.0.1855" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 397.545696][T12496] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 397.647126][ T806] cm6533_jd 0003:0D8C:0022.0008: unknown main item tag 0x0 [ 397.688026][ T806] cm6533_jd 0003:0D8C:0022.0008: unknown main item tag 0x0 [ 397.738665][ T806] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0D8C:0022.0008/input/input15 [ 397.940780][T12480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.751966][ T806] cm6533_jd 0003:0D8C:0022.0008: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.4-1/input0 [ 398.773682][T12480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.463002][ T7705] usb 5-1: reset high-speed USB device number 46 using dummy_hcd [ 401.440321][T12543] overlayfs: missing 'workdir' [ 403.466999][T12557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.538309][T12557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.695916][T12557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.735125][T12557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.723233][ T7705] usb 5-1: device descriptor read/64, error -110 [ 405.672312][ T7705] usb 5-1: reset high-speed USB device number 46 using dummy_hcd [ 406.062397][ T7705] usb 5-1: device descriptor read/64, error -32 [ 406.288419][T12606] fuse: fd is not a fuse device [ 406.434271][ T7705] usb 5-1: reset high-speed USB device number 46 using dummy_hcd [ 406.797840][ T7705] usb 5-1: device descriptor read/8, error -32 [ 407.862388][ T7705] usb 5-1: reset high-speed USB device number 46 using dummy_hcd [ 407.882209][ T0] NOHZ tick-stop error: local softirq work is pending, handler #204!!! [ 407.932506][ T7705] usb 5-1: device descriptor read/8, error -32 [ 408.076545][ T7705] raw-gadget.0 gadget.4: failed to queue suspend event [ 408.117261][ T806] usb 5-1: USB disconnect, device number 46 [ 408.223220][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 408.334522][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 408.402375][ T806] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 408.437641][ C0] raw-gadget.0 gadget.4: ignoring, device is not running [ 408.445447][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 408.454136][T12637] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 408.474198][T12637] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 409.126381][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 409.232271][ T806] usb 5-1: device descriptor read/64, error -32 [ 409.427902][ T29] audit: type=1400 audit(1783190449.640:948): avc: denied { map } for pid=12648 comm="syz.1.1896" path="socket:[29999]" dev="sockfs" ino=29999 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 409.463863][ T806] raw-gadget.0 gadget.4: failed to queue suspend event [ 409.854122][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 409.954027][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 410.042470][ T806] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 410.068745][ C0] raw-gadget.0 gadget.4: ignoring, device is not running [ 410.076086][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 410.133595][T12667] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=12667 comm=syz.3.1901 [ 410.152358][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 410.211400][T12670] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1902'. [ 410.249419][T12668] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1899'. [ 410.262868][T12670] tipc: Enabling of bearer rejected, failed to enable media [ 410.283584][ T806] usb 5-1: device descriptor read/64, error -32 [ 410.350264][T12676] netlink: 'syz.0.1905': attribute type 29 has an invalid length. [ 410.503624][ T806] raw-gadget.0 gadget.4: failed to queue suspend event [ 410.517928][ T806] usb usb5-port1: attempt power cycle [ 410.534283][ T806] raw-gadget.0 gadget.4: failed to queue disconnect event [ 410.542628][T12681] netlink: 'syz.0.1905': attribute type 29 has an invalid length. [ 411.262730][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 411.295688][T12676] netlink: 548 bytes leftover after parsing attributes in process `syz.0.1905'. [ 411.369914][T12676] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=12676 comm=syz.0.1905 [ 411.402053][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 411.412672][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 411.666291][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 412.382211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 412.548996][ T806] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 412.582859][ C0] raw-gadget.0 gadget.4: ignoring, device is not running [ 412.590133][ T806] usb 5-1: device descriptor read/8, error -32 [ 412.734964][ T806] raw-gadget.0 gadget.4: failed to queue suspend event [ 412.781361][ T806] raw-gadget.0 gadget.4: failed to queue reset event [ 412.883291][ T806] raw-gadget.0 gadget.4: failed to queue resume event [ 412.941381][ T29] audit: type=1400 audit(1783190453.150:949): avc: denied { getopt } for pid=12707 comm="syz.2.1912" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 412.973750][ T806] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 413.022411][ C0] raw-gadget.0 gadget.4: ignoring, device is not running [ 413.048995][ T806] usb 5-1: device descriptor read/8, error -32 [ 413.168594][ T806] raw-gadget.0 gadget.4: failed to queue suspend event [ 413.183191][ T806] usb usb5-port1: unable to enumerate USB device [ 413.841116][T12730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.883309][T12730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.910354][ T29] audit: type=1400 audit(1783190454.120:950): avc: denied { listen } for pid=12725 comm="syz.4.1919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 413.946013][ T29] audit: type=1400 audit(1783190454.150:951): avc: denied { accept } for pid=12725 comm="syz.4.1919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 414.118678][T12737] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1921'. [ 415.276079][T12505] raw-gadget.0 gadget.4: failed to queue disconnect event [ 417.312211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 417.372205][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 417.432207][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 417.492205][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 417.829101][T12763] IPVS: length: 105 != 24 [ 418.875456][T12793] overlayfs: missing 'lowerdir' [ 419.071271][T12801] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1940'. [ 420.595069][T12835] overlayfs: upper fs does not support file handles, falling back to index=off. [ 421.322820][T12856] lo speed is unknown, defaulting to 1000 [ 421.334595][T12856] lo speed is unknown, defaulting to 1000 [ 421.700185][T12863] lo speed is unknown, defaulting to 1000 [ 422.208330][T12863] lo speed is unknown, defaulting to 1000 [ 422.470629][ T29] audit: type=1400 audit(1783190462.670:952): avc: denied { getopt } for pid=12861 comm="syz.2.1959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 423.751648][ T49] Bluetooth: hci4: unexpected event for opcode 0x4ad0 [ 423.941418][T12891] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1966'. [ 424.435623][ T7705] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 425.312263][ T7705] usb 5-1: Using ep0 maxpacket: 16 [ 425.340757][ T7705] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 425.366599][ T7705] usb 5-1: config 0 has no interface number 0 [ 425.393782][ T7705] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 425.430308][ T7705] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 425.455143][ T7705] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 425.474513][ T7705] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.503734][ T7705] usb 5-1: Product: syz [ 425.524821][ T7705] usb 5-1: Manufacturer: syz [ 425.539687][ T7705] usb 5-1: SerialNumber: syz [ 425.570212][ T7705] usb 5-1: config 0 descriptor?? [ 425.602836][T12902] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 425.617371][T12902] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 425.879977][T12902] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 425.924526][T12902] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 426.153239][ T7705] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 426.567609][ T7705] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 426.604435][ T7705] asix 5-1:0.34: probe with driver asix failed with error -32 [ 427.308618][ T29] audit: type=1800 audit(1783190467.520:953): pid=12957 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.1983" name="nullb0" dev="tmpfs" ino=2711 res=0 errno=0 [ 427.501231][T12963] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1985'. [ 427.524079][T12961] overlayfs: upper fs does not support file handles, falling back to index=off. [ 427.631288][ T7705] usb 5-1: USB disconnect, device number 51 [ 428.181278][T12982] trusted_key: encrypted_key: insufficient parameters specified [ 428.352154][T12988] lo speed is unknown, defaulting to 1000 [ 428.385898][T12988] lo speed is unknown, defaulting to 1000 [ 430.325101][ T29] audit: type=1400 audit(1783190470.530:954): avc: denied { listen } for pid=13024 comm="syz.0.2002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 430.377065][ T29] audit: type=1400 audit(1783190470.590:955): avc: denied { ioctl } for pid=13024 comm="syz.0.2002" path="socket:[31537]" dev="sockfs" ino=31537 ioctlcmd=0x8905 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 430.557520][T13027] netlink: 'syz.3.2004': attribute type 1 has an invalid length. [ 430.892146][T13035] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2005'. [ 431.027810][T13027] 8021q: adding VLAN 0 to HW filter on device bond5 [ 431.340187][T13028] bond5: (slave geneve2): making interface the new active one [ 431.418894][T13028] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 432.001664][ T80] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.023210][ T80] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.126664][ T80] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.150405][ T80] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.235024][T13064] netlink: 428 bytes leftover after parsing attributes in process `syz.0.2012'. [ 432.244881][T13064] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2012'. [ 433.941045][T13091] overlayfs: upper fs does not support file handles, falling back to index=off. [ 434.432862][T13104] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2017'. [ 434.442091][T13104] tipc: Enabling of bearer rejected, media not registered [ 434.586538][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 434.596567][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 435.922323][ T7705] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 436.493696][ T7705] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 436.517968][ T29] audit: type=1400 audit(1783190476.720:956): avc: denied { create } for pid=13129 comm="syz.0.2026" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 436.550800][ T7705] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.578036][ T7705] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 436.601361][ T29] audit: type=1400 audit(1783190476.750:957): avc: denied { setopt } for pid=13129 comm="syz.0.2026" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 436.636779][ T7705] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 436.668265][ T7705] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.783191][ T7705] usb 5-1: config 0 descriptor?? [ 437.177961][T13142] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2031'. [ 437.214492][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.236653][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.254453][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.273722][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.297935][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.315564][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.333231][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.358162][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.376486][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.395347][ T7705] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 437.446476][ T7705] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 437.493615][ T7705] usb 5-1: USB disconnect, device number 52 [ 437.567259][T13148] fido_id[13148]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 439.264910][T13170] overlayfs: upper fs does not support file handles, falling back to index=off. [ 440.088594][T13182] batadv_slave_1: entered promiscuous mode [ 445.492727][ T29] audit: type=1400 audit(1783190485.700:958): avc: denied { accept } for pid=13236 comm="syz.4.2059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 445.603982][ T29] audit: type=1400 audit(1783190485.820:959): avc: denied { create } for pid=13252 comm="syz.2.2063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 445.747624][T13253] tipc: Enabling of bearer rejected, failed to enable media [ 445.944265][ T29] audit: type=1326 audit(1783190486.150:960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13231 comm="syz.0.2057" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f16bdd9de59 code=0x0 [ 446.325637][T13269] fuse: fd is not a fuse device [ 446.332461][ T29] audit: type=1400 audit(1783190486.540:961): avc: denied { mounton } for pid=13268 comm="syz.1.2067" path="/520/file0" dev="tmpfs" ino=2777 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 446.429065][ T29] audit: type=1400 audit(1783190486.640:962): avc: denied { read write } for pid=13268 comm="syz.1.2067" name="file0" dev="tmpfs" ino=2777 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 446.511121][ T29] audit: type=1400 audit(1783190486.640:963): avc: denied { open } for pid=13268 comm="syz.1.2067" path="/520/file0" dev="tmpfs" ino=2777 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 447.049774][T13277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2071'. [ 447.717301][T13297] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2075'. [ 447.789810][ T29] audit: type=1400 audit(1783190488.000:964): avc: denied { write } for pid=13295 comm="syz.1.2073" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 447.810809][T13301] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=65298 sclass=netlink_xfrm_socket pid=13301 comm=syz.1.2073 [ 449.748918][T13337] fuse: fd is not a fuse device [ 450.373988][T13342] lo speed is unknown, defaulting to 1000 [ 450.441726][T13342] lo speed is unknown, defaulting to 1000 [ 451.022468][ T29] audit: type=1400 audit(1783190491.200:965): avc: denied { map } for pid=13363 comm="syz.3.2085" path="socket:[32044]" dev="sockfs" ino=32044 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 451.259400][ T7701] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 451.332164][T13369] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2087'. [ 452.260233][T13372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 452.294576][ T7701] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 452.310081][T13379] overlayfs: failed to resolve './file2': -2 [ 452.319331][ T7701] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 452.332791][ T7701] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 452.360479][ T7701] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 452.378735][ T7701] usb 5-1: SerialNumber: syz [ 452.509859][T13384] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2091'. [ 452.529922][T13381] overlayfs: upper fs does not support file handles, falling back to index=off. [ 452.562046][T13384] openvswitch: netlink: Missing key (keys=40, expected=80) [ 452.793219][ T7701] usb 5-1: 0:2 : does not exist [ 453.553726][ T7701] usb 5-1: USB disconnect, device number 53 [ 453.680154][ T29] audit: type=1400 audit(1783190493.890:966): avc: denied { create } for pid=13392 comm="syz.2.2093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 453.683117][T13286] udevd[13286]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 453.754623][T13409] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2093'. [ 453.788573][T13409] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2093'. [ 453.847791][T13412] tipc: Enabling of bearer rejected, failed to enable media [ 455.090950][ T29] audit: type=1400 audit(1783190495.300:967): avc: denied { listen } for pid=13406 comm="syz.1.2098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 455.395515][T13433] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2103'. [ 455.490559][T13433] o2cb: This node has not been configured. [ 455.494639][ T29] audit: type=1400 audit(1783190495.670:968): avc: denied { write } for pid=13432 comm="syz.3.2103" name="/" dev="ocfs2_dlmfs" ino=32108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 455.519498][T13433] o2cb: Cluster check failed. Fix errors before retrying. [ 455.526619][T13433] (syz.3.2103,13433,1):user_dlm_register:674 ERROR: status = -22 [ 455.534316][T13433] (syz.3.2103,13433,1):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file0" [ 455.608651][ T29] audit: type=1400 audit(1783190495.670:969): avc: denied { create } for pid=13432 comm="syz.3.2103" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 455.665423][ T29] audit: type=1400 audit(1783190495.670:970): avc: denied { associate } for pid=13432 comm="syz.3.2103" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 455.747030][T13453] netlink: 'syz.1.2106': attribute type 2 has an invalid length. [ 456.752279][ T7705] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 457.040648][ T7705] usb 5-1: Using ep0 maxpacket: 32 [ 457.047797][ T7705] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.060737][ T7705] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 457.073483][ T7705] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.081488][ T7705] usb 5-1: Product: syz [ 457.086023][ T7705] usb 5-1: Manufacturer: syz [ 457.092396][ T7705] usb 5-1: SerialNumber: syz [ 457.107858][ T7705] usb 5-1: config 0 descriptor?? [ 457.123863][ T7705] usb 5-1: expecting 3 got 0 endpoints! Bailing out. [ 458.017400][T13467] overlayfs: upper fs does not support file handles, falling back to index=off. [ 458.176035][T13476] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=62335 sclass=netlink_route_socket pid=13476 comm=syz.1.2114 [ 458.807957][ T7705] usb 5-1: USB disconnect, device number 54 [ 458.874431][T13490] netlink: 'syz.0.2117': attribute type 10 has an invalid length. [ 458.882631][T13490] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2117'. [ 459.259944][T13503] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2122'. [ 460.390517][T13522] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 460.610137][T13531] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2129'. [ 460.903986][T13538] lo speed is unknown, defaulting to 1000 [ 460.924007][T13538] lo speed is unknown, defaulting to 1000 [ 462.239613][T13554] netlink: 'syz.2.2133': attribute type 4 has an invalid length. [ 465.032737][ T5703] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 465.052136][T13580] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2141'. [ 465.197961][T13580] xfrm1: entered promiscuous mode [ 465.206627][ T5703] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 465.232637][T13580] xfrm1: entered allmulticast mode [ 465.233045][ T5703] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 465.262976][ T5703] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 465.292131][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.323427][ T5703] usb 5-1: config 0 descriptor?? [ 465.557339][T13576] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2139'. [ 465.578836][T13576] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.602028][T13576] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 467.039609][T13615] netlink: 'syz.2.2147': attribute type 4 has an invalid length. [ 467.285258][T13619] overlayfs: upper fs does not support file handles, falling back to index=off. [ 472.263987][T13685] 9p: Bad value for 'rfdno' [ 472.276054][ T7701] usb 5-1: USB disconnect, device number 55 [ 472.605705][T13685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2164'. [ 475.362292][T13723] batman_adv: batadv0: Adding interface: dummy0 [ 475.377951][T13723] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.625731][T13723] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 475.905006][T13735] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2176'. [ 478.791216][T13781] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2191'. [ 479.028575][T13781] ip6gre1: entered promiscuous mode [ 479.051845][T13781] ip6gre1: entered allmulticast mode [ 479.426347][T13781] netlink: 'syz.1.2191': attribute type 6 has an invalid length. [ 479.439218][T13781] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2191'. [ 479.540972][T13786] lo speed is unknown, defaulting to 1000 [ 479.566286][T13786] lo speed is unknown, defaulting to 1000 [ 480.031128][T13803] fuse: fd is not a fuse device [ 482.602846][T13833] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2203'. [ 483.349778][T13853] openvswitch: netlink: IP tunnel dst address not specified [ 484.391259][T13863] overlayfs: upper fs does not support file handles, falling back to index=off. [ 486.185459][T13893] batman_adv: batadv0: Adding interface: macvtap0 [ 486.202126][T13893] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 486.239968][T13893] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 486.325670][T13896] batman_adv: batadv0: Removing interface: macvtap0 [ 487.973697][T13934] openvswitch: netlink: Message has 12 unknown bytes. [ 487.996093][T13934] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.527631][ T29] audit: type=1400 audit(1783190528.740:971): avc: denied { shutdown } for pid=13945 comm="syz.2.2238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 488.826027][ T29] audit: type=1400 audit(1783190529.040:972): avc: denied { bind } for pid=13952 comm="syz.1.2240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 491.619967][T14000] overlayfs: upper fs does not support file handles, falling back to index=off. [ 492.042942][ T5703] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 492.142169][T14010] netlink: 'syz.1.2253': attribute type 1 has an invalid length. [ 492.172282][T14010] 8021q: adding VLAN 0 to HW filter on device bond2 [ 492.185573][T14010] fuse: fd is not a fuse device [ 492.306782][ T5703] usb 5-1: Using ep0 maxpacket: 16 [ 492.325887][ T5703] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 492.367844][ T5703] usb 5-1: config 0 has no interface number 0 [ 492.396927][ T5703] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 492.432292][ T5703] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 492.584912][ T5703] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 492.595732][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.604203][ T5703] usb 5-1: Product: syz [ 492.608418][ T5703] usb 5-1: Manufacturer: syz [ 492.613410][ T5703] usb 5-1: SerialNumber: syz [ 492.621308][ T5703] usb 5-1: config 0 descriptor?? [ 492.867619][T13992] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 492.881480][T13992] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 493.366468][T13992] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 493.415124][T13992] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 493.709977][ T5703] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 495.957228][ T5703] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 496.092952][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 496.144559][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 496.646826][ T5703] asix 5-1:0.34: probe with driver asix failed with error -71 [ 496.807772][ T5703] usb 5-1: USB disconnect, device number 56 [ 496.868865][T14068] netlink: 'syz.0.2266': attribute type 30 has an invalid length. [ 497.770042][ T5703] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 497.824267][T14083] openvswitch: netlink: Flow key attr not present in new flow. [ 497.977652][ T5703] usb 5-1: config index 0 descriptor too short (expected 7768, got 18) [ 497.990000][ T5703] usb 5-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=52.4d [ 498.005714][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.071219][ T5703] usb 5-1: config 0 descriptor?? [ 498.454812][ T7701] usb 5-1: USB disconnect, device number 57 [ 501.368587][T14119] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2281'. [ 501.397105][T14114] overlayfs: missing 'lowerdir' [ 504.333925][T14157] overlayfs: upper fs does not support file handles, falling back to index=off. [ 505.117413][T14161] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=10090 sclass=netlink_route_socket pid=14161 comm=syz.1.2288 [ 511.913275][T14241] lo speed is unknown, defaulting to 1000 [ 511.944965][T14241] lo speed is unknown, defaulting to 1000 [ 513.520619][T14181] Set syz1 is full, maxelem 65536 reached [ 518.764407][ T7701] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 519.456762][ T7701] usb 5-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 519.522103][ T7701] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.538378][ T7701] usb 5-1: Product: syz [ 519.555612][ T7701] usb 5-1: Manufacturer: syz [ 519.589568][ T7701] usb 5-1: SerialNumber: syz [ 519.650610][ T7701] usb 5-1: config 0 descriptor?? [ 519.786662][ T7701] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 520.100094][ T7701] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 520.107515][ T7701] sq905c 5-1:0.0: Get version command failed [ 520.113553][ T7701] sq905c 5-1:0.0: probe with driver sq905c failed with error -71 [ 520.177285][ T7701] usb 5-1: USB disconnect, device number 58 [ 521.089116][T14340] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2331'. [ 521.113251][T14329] lo speed is unknown, defaulting to 1000 [ 521.159200][T14329] lo speed is unknown, defaulting to 1000 [ 524.978982][T14375] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2343'. [ 527.944128][T14408] overlayfs: upper fs does not support file handles, falling back to index=off. [ 528.959711][T14428] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2356'. [ 533.190702][T14471] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2368'. [ 537.689056][T14500] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2371'. [ 538.243462][T14538] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2384'. [ 540.785308][T14566] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2392'. [ 541.357620][T14580] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2395'. [ 544.808222][T14634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2412'. [ 544.990337][T14640] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2414'. [ 545.743817][ T29] audit: type=1326 audit(1783190585.940:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14637 comm="syz.2.2415" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f887b59de59 code=0x0 [ 553.734754][T14747] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 553.759265][T14747] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 557.373256][T14783] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 557.385815][T14783] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 557.395313][T14783] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 557.405851][T14783] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 557.416528][T14783] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 557.463593][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 557.470160][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 558.308237][T14781] lo speed is unknown, defaulting to 1000 [ 558.344927][T14781] lo speed is unknown, defaulting to 1000 [ 559.398244][T10372] syz_tun (unregistering): left allmulticast mode [ 559.431949][T10372] bond0: (slave syz_tun): Releasing backup interface [ 559.462732][T14783] Bluetooth: hci5: command tx timeout [ 560.889140][T14781] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.911211][T14781] bridge0: port 1(bridge_slave_0) entered disabled state [ 560.932574][T14781] bridge_slave_0: entered allmulticast mode [ 560.950655][T14781] bridge_slave_0: entered promiscuous mode [ 560.978549][T14781] bridge0: port 2(bridge_slave_1) entered blocking state [ 561.002571][T14781] bridge0: port 2(bridge_slave_1) entered disabled state [ 561.022437][T14781] bridge_slave_1: entered allmulticast mode [ 561.038865][T14781] bridge_slave_1: entered promiscuous mode [ 561.187757][T14781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 561.226417][T14781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 561.292250][T14781] team0: Port device team_slave_0 added [ 561.500698][T14781] team0: Port device team_slave_1 added [ 561.585823][T14783] Bluetooth: hci5: command tx timeout [ 562.270036][T14781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 562.279016][T14781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 562.319580][T14781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 562.367050][T11401] erspan0: left allmulticast mode [ 562.383864][T11401] erspan0: left promiscuous mode [ 562.405893][T11401] bridge0: port 3(erspan0) entered disabled state [ 563.057595][ T29] audit: type=1400 audit(1783190603.270:974): avc: denied { write } for pid=14875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 563.338896][ T29] audit: type=1400 audit(1783190603.550:975): avc: denied { write } for pid=14899 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 563.598873][T11401] bond0 (unregistering): left promiscuous mode [ 563.612308][T11401] bond_slave_0: left promiscuous mode [ 563.620467][T11401] bond_slave_1: left promiscuous mode [ 563.626720][T14783] Bluetooth: hci5: command tx timeout [ 563.653183][T11401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 563.664410][T11401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 563.674335][T11401] bond0 (unregistering): Released all slaves [ 563.685800][T11401] bond1 (unregistering): Released all slaves [ 563.701848][T11401] bond2 (unregistering): Released all slaves [ 563.763122][T14781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 563.770136][T14781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 563.802481][T14781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 563.853312][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 563.946053][T14781] hsr_slave_0: entered promiscuous mode [ 563.952462][T14781] hsr_slave_1: entered promiscuous mode [ 563.959096][T14781] debugfs: 'hsr0' already exists in 'hsr' [ 563.994852][T14781] Cannot create hsr debugfs directory [ 564.195540][T11401] tipc: Disabling bearer [ 564.213319][T11401] tipc: Left network mode [ 564.637624][ T29] audit: type=1400 audit(1783190604.850:976): avc: denied { write } for pid=14917 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 565.190982][ T29] audit: type=1400 audit(1783190605.400:977): avc: denied { write } for pid=14938 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 565.614750][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 565.702750][T14783] Bluetooth: hci5: command tx timeout [ 566.009829][T14971] netlink: 'syz.0.2488': attribute type 1 has an invalid length. [ 566.167935][T14971] 8021q: adding VLAN 0 to HW filter on device bond2 [ 566.854989][ T29] audit: type=1400 audit(1783190607.070:978): avc: denied { write } for pid=14973 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 567.636614][ T29] audit: type=1400 audit(1783190607.840:979): avc: denied { write } for pid=15007 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 567.721107][T15009] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2494'. [ 567.827717][ T29] audit: type=1400 audit(1783190608.040:980): avc: denied { setattr } for pid=15008 comm="syz.2.2494" path="socket:[39623]" dev="sockfs" ino=39623 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 568.127093][T15016] openvswitch: netlink: Missing key (keys=40, expected=100) [ 568.367947][T14781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 568.446412][T14781] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 568.472886][T14781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 568.529375][T14781] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 568.575906][T14781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 568.758444][T14781] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 568.814401][T14781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 568.870996][T14781] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 569.016069][ T29] audit: type=1400 audit(1783190609.230:981): avc: denied { write } for pid=15020 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 569.125433][T11401] hsr_slave_0: left promiscuous mode [ 569.139803][T15055] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2503'. [ 569.149941][T11401] hsr_slave_1: left promiscuous mode [ 569.169659][ T29] audit: type=1400 audit(1783190609.380:982): avc: denied { write } for pid=15054 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 570.113011][T11401] team0 (unregistering): Port device team_slave_1 removed [ 570.187596][T15080] openvswitch: netlink: IP tunnel dst address not specified [ 570.196457][T11401] team0 (unregistering): Port device team_slave_0 removed [ 570.327934][ T29] audit: type=1400 audit(1783190610.540:983): avc: denied { write } for pid=15059 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 570.540426][ T29] audit: type=1400 audit(1783190610.740:984): avc: denied { write } for pid=15096 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 570.898144][T14781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 571.030192][T14781] 8021q: adding VLAN 0 to HW filter on device team0 [ 571.069565][T11399] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.076769][T11399] bridge0: port 1(bridge_slave_0) entered forwarding state [ 571.144244][T11399] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.151454][T11399] bridge0: port 2(bridge_slave_1) entered forwarding state [ 571.211120][T11401] IPVS: stop unused estimator thread 0... [ 571.306539][ T29] audit: type=1400 audit(1783190611.520:985): avc: denied { write } for pid=15103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 571.361171][T15115] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2516'. [ 571.588162][ T29] audit: type=1400 audit(1783190611.800:986): avc: denied { write } for pid=15122 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 573.858633][ T29] audit: type=1400 audit(1783190614.070:987): avc: denied { write } for pid=15137 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 573.997777][ T29] audit: type=1400 audit(1783190614.210:988): avc: denied { write } for pid=15180 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 574.096015][T15183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2526'. [ 574.126486][T15183] xfrm1: entered promiscuous mode [ 574.153197][T15183] xfrm1: entered allmulticast mode [ 574.167526][T14781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 574.177389][T15183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2526'. [ 574.276556][T14781] veth0_vlan: entered promiscuous mode [ 574.299466][T14781] veth1_vlan: entered promiscuous mode [ 574.391347][T14781] veth0_macvtap: entered promiscuous mode [ 574.414164][T14781] veth1_macvtap: entered promiscuous mode [ 574.454082][T14781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 574.503391][T14781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 574.530245][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.555170][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.581888][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.602908][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.784214][T11402] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.802328][T11402] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 574.918882][T11402] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.978234][T11402] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.126644][ T29] audit: type=1400 audit(1783190615.240:989): avc: denied { mounton } for pid=14781 comm="syz-executor" path="/root/syzkaller.10B7Tc/syz-tmp" dev="sda1" ino=2048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 575.459667][ T29] audit: type=1400 audit(1783190615.240:990): avc: denied { mounton } for pid=14781 comm="syz-executor" path="/root/syzkaller.10B7Tc/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 575.505835][ T29] audit: type=1400 audit(1783190615.250:991): avc: denied { mounton } for pid=14781 comm="syz-executor" path="/root/syzkaller.10B7Tc/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=41327 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 575.580037][ T29] audit: type=1400 audit(1783190615.530:992): avc: denied { mounton } for pid=14781 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 575.980603][T15215] fuse: fd is not a fuse device [ 578.020144][ T49] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 578.034480][ T49] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 578.043813][ T49] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 578.051458][ T49] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 578.064970][ T49] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 580.103114][T14783] Bluetooth: hci3: command tx timeout [ 580.816546][T15257] lo speed is unknown, defaulting to 1000 [ 580.864584][T15257] lo speed is unknown, defaulting to 1000 [ 582.182212][T14783] Bluetooth: hci3: command tx timeout [ 582.257444][T15257] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.272438][T15257] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.279677][T15257] bridge_slave_0: entered allmulticast mode [ 582.287071][T15257] bridge_slave_0: entered promiscuous mode [ 582.300079][T15257] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.307293][T15257] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.314484][T15257] bridge_slave_1: entered allmulticast mode [ 582.321831][T15257] bridge_slave_1: entered promiscuous mode [ 582.352243][T15257] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 582.364191][T15257] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 582.834166][T15257] team0: Port device team_slave_0 added [ 582.860992][T15257] team0: Port device team_slave_1 added [ 582.960295][T15257] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 582.974596][T15257] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 583.008642][T15257] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 583.020799][T15257] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 583.027752][T15257] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 583.053655][T15257] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 583.113138][T15257] hsr_slave_0: entered promiscuous mode [ 583.119618][T15257] hsr_slave_1: entered promiscuous mode [ 583.125844][T15257] debugfs: 'hsr0' already exists in 'hsr' [ 583.131569][T15257] Cannot create hsr debugfs directory [ 583.667629][T15257] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 583.686287][T15257] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.713976][T15339] trusted_key: encrypted_key: insufficient parameters specified [ 583.733596][T11399] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 583.754750][T11399] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 583.802394][ T7682] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 583.848337][T15257] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 583.868966][T15257] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.033888][ T7682] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 584.043522][ T7682] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.079915][ T7682] usb 2-1: config 0 descriptor?? [ 584.131260][T15257] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.146507][T15257] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.170308][T15350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2570'. [ 584.255568][T15354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2572'. [ 584.306553][T14783] Bluetooth: hci3: command tx timeout [ 584.314772][T15339] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 584.533405][ T7682] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 585.450313][ T7682] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 585.457327][ T7682] [drm] Initialized udl on minor 2 [ 585.634752][T15257] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.652386][T15257] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.791777][ T7682] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 585.801019][ T7682] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 585.939235][ T5703] usb 2-1: USB disconnect, device number 2 [ 586.012615][ T122] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 586.040329][ T122] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 586.434786][T14783] Bluetooth: hci3: command tx timeout [ 586.849946][T15257] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 587.193361][T15257] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 587.213986][T15257] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 587.234763][T15257] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 587.253787][T15257] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 587.260312][T15391] ieee802154 phy0 wpan0: encryption failed: -22 [ 587.260636][ T29] audit: type=1400 audit(1783190627.470:993): avc: denied { write } for pid=15389 comm="syz.1.2582" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 587.327017][T15257] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 587.335265][T15257] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 587.355163][T15394] fuse: fd is not a fuse device [ 587.362237][T15257] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 588.311320][T15257] 8021q: adding VLAN 0 to HW filter on device bond0 [ 588.645162][T15257] 8021q: adding VLAN 0 to HW filter on device team0 [ 588.691278][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.698470][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 588.744454][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 588.751611][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.387664][T15430] pim6reg: entered allmulticast mode [ 589.416606][T15430] pim6reg: left allmulticast mode [ 590.386341][T15257] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 591.000019][T15257] veth0_vlan: entered promiscuous mode [ 591.066637][T15257] veth1_vlan: entered promiscuous mode [ 591.074911][T15461] netlink: 17780 bytes leftover after parsing attributes in process `syz.4.2598'. [ 591.118765][ T7682] IPVS: starting estimator thread 0... [ 591.134530][T15464] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 591.192170][T15464] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 591.249263][T15257] veth0_macvtap: entered promiscuous mode [ 591.264403][T15257] veth1_macvtap: entered promiscuous mode [ 591.342258][T15465] IPVS: using max 44 ests per chain, 105600 per kthread [ 591.363213][T15257] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 591.387975][T15257] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 591.433335][T11402] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.459232][T11402] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.484161][T11402] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.511892][T11402] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.811780][T11401] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.838946][T11401] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.929916][T11401] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.960065][T11401] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 594.108439][T15507] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2545'. [ 594.122172][T15507] xfrm1: entered promiscuous mode [ 594.127237][T15507] xfrm1: entered allmulticast mode [ 594.128855][T15505] tmpfs: Bad value for 'mpol' [ 594.132684][T15507] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2545'. [ 594.524145][ T806] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 594.641732][T15505] netlink: 'syz.4.2609': attribute type 1 has an invalid length. [ 594.699529][T15505] 8021q: adding VLAN 0 to HW filter on device bond2 [ 594.717553][T15512] bond2: (slave syz_tun): unknown ethtool speed (1024) for port 1 (set it to 0) [ 594.741026][T15512] bond2: (slave syz_tun): speed changed to 0 on port 1 [ 594.780902][T15512] bond2: (slave syz_tun): Enslaving as a backup interface with an up link [ 594.782300][ T806] usb 2-1: Using ep0 maxpacket: 32 [ 699.762086][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 699.769067][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P37/1:b..l [ 699.777307][ C0] rcu: (detected by 0, t=10502 jiffies, g=73789, q=512 ncpus=2) [ 699.785012][ C0] task:khugepaged state:R running task stack:26872 pid:37 tgid:37 ppid:2 task_flags:0x200040 flags:0x00080000 [ 699.799047][ C0] Call Trace: [ 699.802324][ C0] [ 699.805249][ C0] __schedule+0x125c/0x6730 [ 699.809753][ C0] ? __pfx___css_rstat_updated+0x10/0x10 [ 699.815389][ C0] ? __pfx___schedule+0x10/0x10 [ 699.820236][ C0] ? rcu_read_unlock+0x17/0x60 [ 699.824994][ C0] ? find_held_lock+0x2b/0x80 [ 699.829666][ C0] ? rcu_read_unlock+0x17/0x60 [ 699.834422][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 699.839784][ C0] preempt_schedule_common+0x42/0xc0 [ 699.845062][ C0] preempt_schedule_thunk+0x16/0x40 [ 699.850254][ C0] _raw_spin_unlock+0x3e/0x50 [ 699.854926][ C0] collapse_huge_page+0x23dc/0x3c60 [ 699.860133][ C0] ? __pfx_collapse_huge_page+0x10/0x10 [ 699.865672][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 699.871042][ C0] ? __up_read+0x770/0x980 [ 699.875454][ C0] ? collapse_single_pmd+0x2ef1/0x45a0 [ 699.880906][ C0] ? collapse_single_pmd+0x2ef1/0x45a0 [ 699.886366][ C0] ? __bitmap_weight+0xd7/0x110 [ 699.891240][ C0] collapse_single_pmd+0x313c/0x45a0 [ 699.896535][ C0] ? __pfx_collapse_single_pmd+0x10/0x10 [ 699.902172][ C0] ? __pfx___might_resched+0x10/0x10 [ 699.907453][ C0] khugepaged+0x10e6/0x14e0 [ 699.911960][ C0] ? __pfx_khugepaged+0x10/0x10 [ 699.916814][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 699.922879][ C0] ? find_held_lock+0x2b/0x80 [ 699.927551][ C0] ? __kthread_parkme+0xbb/0x230 [ 699.932490][ C0] ? __kthread_parkme+0x18c/0x230 [ 699.937526][ C0] ? kthread+0x13a/0x450 [ 699.941766][ C0] ? __pfx_khugepaged+0x10/0x10 [ 699.946610][ C0] kthread+0x370/0x450 [ 699.950676][ C0] ? __pfx_kthread+0x10/0x10 [ 699.955279][ C0] ret_from_fork+0x72b/0xd50 [ 699.959866][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 699.964974][ C0] ? __switch_to+0x800/0x10f0 [ 699.969648][ C0] ? __pfx_kthread+0x10/0x10 [ 699.974250][ C0] ret_from_fork_asm+0x1a/0x30 [ 699.979021][ C0] [ 699.982027][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10497 jiffies! g73789 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 699.994333][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=38311 [ 700.002203][ C0] rcu: rcu_preempt kthread starved for 10498 jiffies! g73789 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 700.013553][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 700.023503][ C0] rcu: RCU grace-period kthread stack dump: [ 700.029372][ C0] task:rcu_preempt state:I stack:27592 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 700.041284][ C0] Call Trace: [ 700.044550][ C0] [ 700.047471][ C0] __schedule+0x125c/0x6730 [ 700.051983][ C0] ? __pfx___schedule+0x10/0x10 [ 700.056825][ C0] ? find_held_lock+0x2b/0x80 [ 700.061497][ C0] ? schedule+0x225/0x2c0 [ 700.065824][ C0] schedule+0xdd/0x2c0 [ 700.069886][ C0] schedule_timeout+0x127/0x280 [ 700.074727][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 700.080089][ C0] ? __pfx_process_timeout+0x10/0x10 [ 700.085374][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 700.091177][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 700.096628][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 700.101384][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 700.106665][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 700.111595][ C0] ? rcu_is_watching+0x12/0xc0 [ 700.116355][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 700.122168][ C0] rcu_gp_kthread+0x179/0x230 [ 700.126834][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 700.132020][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 700.137824][ C0] ? __kthread_parkme+0x18c/0x230 [ 700.142844][ C0] ? kthread+0x13a/0x450 [ 700.147089][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 700.152275][ C0] kthread+0x370/0x450 [ 700.156341][ C0] ? __pfx_kthread+0x10/0x10 [ 700.160940][ C0] ret_from_fork+0x72b/0xd50 [ 700.165524][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 700.170630][ C0] ? __switch_to+0x800/0x10f0 [ 700.175303][ C0] ? __pfx_kthread+0x10/0x10 [ 700.179889][ C0] ret_from_fork_asm+0x1a/0x30 [ 700.184659][ C0] [ 700.187663][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 700.193967][ C0] Sending NMI from CPU 0 to CPUs 1: [ 700.199163][ C1] NMI backtrace for cpu 1 [ 700.199175][ C1] CPU: 1 UID: 0 PID: 15497 Comm: syz.3.2607 Not tainted syzkaller #0 PREEMPT(full) [ 700.199191][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 700.199199][ C1] RIP: 0010:lock_acquire+0x4a/0x370 [ 700.199214][ C1] Code: 65 4c 8b 3d 20 df 7d 12 4c 89 7c 24 30 4d 89 cf 66 90 65 8b 05 3b df 7d 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 86 c4 3c 0f <0f> 82 ac 02 00 00 8b 35 4e f8 3c 0f 85 f6 0f 85 c7 00 00 00 48 8b [ 700.199227][ C1] RSP: 0018:ffffc90000a08e10 EFLAGS: 00000097 [ 700.199239][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 [ 700.199247][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880b8528418 [ 700.199255][ C1] RBP: ffff8880b8528418 R08: 0000000000000001 R09: 0000000000000000 [ 700.199264][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 700.199272][ C1] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 700.199280][ C1] FS: 00007f01e124c6c0(0000) GS:ffff888123eec000(0000) knlGS:0000000000000000 [ 700.199295][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 700.199304][ C1] CR2: 000000110c2647d1 CR3: 000000002ddd5000 CR4: 00000000003526f0 [ 700.199313][ C1] Call Trace: [ 700.199318][ C1] [ 700.199326][ C1] _raw_spin_lock_irq+0x36/0x50 [ 700.199340][ C1] ? __hrtimer_run_queues+0x1b7/0x9c0 [ 700.199358][ C1] __hrtimer_run_queues+0x1b7/0x9c0 [ 700.199379][ C1] hrtimer_interrupt+0x3e5/0x940 [ 700.199402][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 700.199422][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 700.199440][ C1] [ 700.199444][ C1] [ 700.199448][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 700.199464][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 700.199480][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 16 bf 29 f6 48 89 df e8 9e 0e 2a f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 95 1f 19 f6 65 8b 05 ee 98 a7 08 85 c0 74 16 5b [ 700.199492][ C1] RSP: 0018:ffffc90006eb7d78 EFLAGS: 00000246 [ 700.199503][ C1] RAX: 0000000000000006 RBX: ffffffff9b72f3d8 RCX: 0000000000000000 [ 700.199511][ C1] RDX: 0000000000000000 RSI: ffffffff8e1a29fc RDI: ffffffff8c400c80 [ 700.199519][ C1] RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000000 [ 700.199527][ C1] R10: 0000000000000001 R11: ffffffffffffffff R12: 1ffff92000dd6fb6 [ 700.199536][ C1] R13: 000000000cec3f94 R14: 000000000cec3f94 R15: 0000000000000000 [ 700.199551][ C1] do_settimeofday64+0x326/0x4d0 [ 700.199566][ C1] ? __pfx_do_settimeofday64+0x10/0x10 [ 700.199579][ C1] ? security_capable+0x80/0x260 [ 700.199593][ C1] ? cma_check_port+0x742/0x820 [ 700.199610][ C1] ? capable+0xd3/0xf0 [ 700.199625][ C1] do_sys_settimeofday64+0x1dc/0x260 [ 700.199642][ C1] __x64_sys_clock_settime+0x1c1/0x2a0 [ 700.199662][ C1] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 700.199683][ C1] do_syscall_64+0x115/0x870 [ 700.199701][ C1] ? clear_bhb_loop+0x40/0x90 [ 700.199715][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.199728][ C1] RIP: 0033:0x7f01e039de59 [ 700.199740][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 700.199752][ C1] RSP: 002b:00007f01e124c028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 700.199764][ C1] RAX: ffffffffffffffda RBX: 00007f01e0626090 RCX: 00007f01e039de59 [ 700.199773][ C1] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 700.199781][ C1] RBP: 00007f01e0433e6f R08: 0000000000000000 R09: 0000000000000000 [ 700.199789][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 700.199797][ C1] R13: 00007f01e0626128 R14: 00007f01e0626090 R15: 00007ffd2ed22628 [ 700.199811][ C1]