last executing test programs: 5.043413268s ago: executing program 2 (id=3): syz_usb_connect$uac1(0x2, 0x96, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x84, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x2, 0x2, 0x10, 0x1, "e80300"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x2, 0x2, 0x10, 0x1, "e80300"}]}, {{0x9, 0x5, 0x81, 0x5, 0x3ff, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x1, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x2, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x3, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x4, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x5, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x6, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x7, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x8, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x9, 0x100, [0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xa, 0x100, [0x0]}) 4.737319693s ago: executing program 3 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000001b00)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000001700)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./nfsd/v4_end_grace\x00', 0x2, 0x0) write(r3, &(0x7f0000001900)='Y\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000700)='nfsd 127.0.0.1 2147483647 127.0.0.1\n', 0x24) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r5, &(0x7f0000000900)='127.0.0.1 / 2147483647 74754 0 0 0\n', 0x23) write(0xffffffffffffffff, &(0x7f0000000b00)='127.0.0.1 1 \\x00\\x00\\x00\\x00 2147483647 /\n', 0x2d) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./debug\x00', 0x1ff) nanosleep(&(0x7f0000001c00)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt\x00', 0x1ff) mount(&(0x7f0000001100)=@filename='127.0.0.1:/\x00', &(0x7f0000001000)='./mnt\x00', &(0x7f0000001200)='nfs4\x00', 0x0, &(0x7f0000001300)='addr=127.0.0.1,clientaddr=127.0.0.1,port=2049,sec=sys\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/test\x00', 0x42, 0x1ff) write(r6, &(0x7f0000001500)='test\x00', 0x4) 4.387000049s ago: executing program 1 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='700\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='0\x00', 0x1, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0) 3.924823396s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/usb_storage/parameters/delay_use\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='0\n\x00', 0x2) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408f0587630001010203010902200001010080320904000002080650000705810200020007050202000200"], 0x0) syz_usb_disconnect(r1) 3.704193544s ago: executing program 0 (id=8): mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./ram1\x00', 0x8000, 0x101) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./ram1\x00', 0x2, 0x0) ioctl(r0, 0x127b, &(0x7f0000000000)="00003f00000000000010000000000000") pwrite64(r0, &(0x7f0000000000)="fc4e2ba9", 0x4, 0x3f0000) pwrite64(r0, &(0x7f0000000000)='Z\x00\x00\x00', 0x4, 0x3f0008) pwrite64(r0, &(0x7f0000000000)="01000000", 0x4, 0x3f0028) pwrite64(r0, &(0x7f0000000000)="5d4f2ba9", 0x4, 0x3f0098) pwrite64(r0, &(0x7f0000000000)="06000000", 0x4, 0x3f0210) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./md0\x00', 0x8000, 0x900) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./md0\x00', 0x2, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000000)='\x00'/72) ioctl(r1, 0x40140921, &(0x7f0000000000)="000000000100"/20) 3.594357841s ago: executing program 0 (id=9): mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x4032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0xe) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x17) 3.555842701s ago: executing program 0 (id=10): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./md0\x00', 0x8180, 0x900) openat(0xffffffffffffff9c, &(0x7f0000000080)='./md0\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/self/fdinfo\x00', 0x0, 0x0) 3.482539059s ago: executing program 0 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='proc\x00', &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000740)='10\n', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r2, &(0x7f00000007c0)='10\n', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='tcp 2049\n', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000240)='1\n', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r5, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 testdomain\n', 0x25) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r6, &(0x7f0000000340)='testdomain / 2147483647 8194 0 0 0\n', 0x23) r7 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r7, &(0x7f00000003c0)='testdomain 1 \\x00000000 2147483647 /\n', 0x25) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000800)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3f0, 0x6c17, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x7, 0x1, 0x3, 0x0, "", {{}, [{}]}}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00']) openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/file1\x00', 0x42, 0x1ff) rename(&(0x7f0000000580)='./mnt/file1\x00', &(0x7f00000005c0)='./mnt/file2\x00') 3.389301123s ago: executing program 3 (id=12): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./dm_control_test6\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./dm_control_test6\x00', 0x2, 0x0) read(r0, &(0x7f0000002000), 0x10) 2.702735306s ago: executing program 3 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/pm_test\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='core', 0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ed) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/kernel/printk\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='1 1 1 1', 0x7) 2.635363917s ago: executing program 3 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/block/sda/device/scsi_disk/0:0:0:0/max_write_same_blocks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='4294967295\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) fallocate(r1, 0x10, 0x0, 0x10000000) 2.630485051s ago: executing program 1 (id=15): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0x1, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r0, 0xc01864b1, &(0x7f0000000200)={r1, 0x2, 0x7, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1e0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0x2c58, 0x80, 0x20002, 0x16c}, &(0x7f00000000c0)=0x0, 0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, 0x0, r6, &(0x7f0000000980)=@IORING_OP_UNLINKAT={0x24, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x1}) syz_ublk_add_dev(r4, r5, 0x0, r6, &(0x7f00000031c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x840, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) socket$inet_icmp_raw(0x2, 0x3, 0x1) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) close(r7) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0x43, 0x8}, 0xc) 2.470439454s ago: executing program 3 (id=16): unshare(0x40000000) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000004c0)={'lo\x00', 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./rpc_pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./rpc_pipefs\x00', &(0x7f0000000940)='rpc_pipefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x1, 0x0) write(r1, &(0x7f0000000540)='-2 -3 +4\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='nfsd 127.0.0.1 2147483647 *\n', 0x1c) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='* ./ 2147483647 139296 0 0 0\n', 0x1d) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='* 1 \\x00000000 2147483647 ./\n', 0x1d) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='tcp 2049\n', 0x9) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r6, &(0x7f0000000340)='1\n', 0x2) (async) nanosleep(&(0x7f0000000380)={0x0, 0x1dcd6500}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./rpc_pipefs/nfsd/cld\x00', 0x2, 0x0) write(r7, &(0x7f00000009c0)='garbage\n', 0x8) nanosleep(&(0x7f0000000380)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000400)='127.0.0.1:/\x00', &(0x7f00000003c0)='./mnt\x00', &(0x7f0000000440), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1,vers=4.1\x00']) 2.415587335s ago: executing program 2 (id=17): r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)={0x84, &(0x7f0000000210)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000310), 0x0, 0x2) 2.235610406s ago: executing program 4 (id=18): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40109710780001010203010902270001010080fa0904000003ffffff00070581031000010705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 781.813392ms ago: executing program 1 (id=19): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x5c, 0x10, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}}}}}]}, 0x5c}}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x2, &(0x7f0000000140)=@raw=[@alu={0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x0, 0x9}], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'veth1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r1, r3, 0x25, 0x0, @void}, 0x10) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000500)="12345678901234", 0x7, 0x0, &(0x7f0000000600)={0x11, 0x300, r5}, 0x14) 776.287835ms ago: executing program 0 (id=20): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./md0\x00', 0x81b6, 0x900) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./md0\x00', 0x2, 0x0) ioctl(r0, 0x40480923, &(0x7f0000000100)="0000000000000000000000000000000001000000001000000000000001000000000000000100"/72) ioctl(r0, 0x40140921, &(0x7f0000000200)="0000000001000000010000000000000003000000") ioctl(r0, 0x400c0930, &(0x7f0000000300)='\x00'/12) 674.814259ms ago: executing program 1 (id=21): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)) ioctl$TIOCSRS485(r0, 0x542f, &(0x7f0000000200)={0x1}) write(r0, &(0x7f0000000300)='hello\x00', 0x5) 654.6106ms ago: executing program 1 (id=22): pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) write$P9_RATTACH(r1, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff) mount$9p_fd(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt/file\x00', 0x42, 0x1ff) write(r2, &(0x7f00000001c0)='data', 0x4) 600.680236ms ago: executing program 1 (id=23): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a3100000000080041007278650014003300766574683000"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x48, 0xfa00, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, {0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, r2, 0x3e8}}, 0x50) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000600)={0xc, 0x18, 0xfa00, {&(0x7f0000000700)}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000800)={0xc, 0x18, 0xfa00, {&(0x7f0000000900)}}, 0x18) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x6, 0xf, '\x00', 0x0, 0x40, 0x4, 0xa8, 0x3, 0xf, 0x4, 0x1}, r2}}, 0x120) 283.022843ms ago: executing program 3 (id=24): r0 = syz_usb_connect(0x2, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff401e041c400001010203010902220001010080fa0904000000ffffff000904000101ffffff0007058101000201"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)={0x84, &(0x7f0000000210)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000120)={0x84, &(0x7f0000000220)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000130)={0x84, &(0x7f0000000230)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000240)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000150)={0x84, &(0x7f0000000250)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000160)={0x84, &(0x7f0000000260)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000170)={0x84, &(0x7f0000000270)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000280)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000190)={0x84, &(0x7f0000000290)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000001a0)={0x84, &(0x7f00000002a0)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000001b0)={0x84, &(0x7f00000002b0)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000001c0)={0x84, &(0x7f00000002c0)={0x40, 0xa1, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000001d0)={0x84, &(0x7f00000002d0)={0x40, 0xa1, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000001e0)={0x84, &(0x7f00000002e0)={0x40, 0xa1, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$video(&(0x7f0000000080), 0x0, 0x2) read(r1, &(0x7f0000000300)=""/4096, 0x1000) 0s ago: executing program 0 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000880)='naa.6001405123456789\x00', 0x14) symlinkat(&(0x7f00000008c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000980)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r6 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f0000000200)=""/28}, &(0x7f0000000300)="5f000000000000001c00", &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): [ 54.334316][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 54.334330][ T30] audit: type=1400 audit(1785853077.834:119): avc: denied { write } for pid=5516 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.389250][ T30] audit: type=1400 audit(1785853077.894:120): avc: denied { write } for pid=5527 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.599545][ T30] audit: type=1400 audit(1785853078.104:121): avc: denied { write } for pid=5530 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.653371][ T30] audit: type=1400 audit(1785853078.154:122): avc: denied { write } for pid=5541 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.819424][ T30] audit: type=1400 audit(1785853078.324:123): avc: denied { write } for pid=5544 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.871355][ T30] audit: type=1400 audit(1785853078.374:124): avc: denied { write } for pid=5555 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.037851][ T30] audit: type=1400 audit(1785853078.544:125): avc: denied { write } for pid=5558 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.096218][ T30] audit: type=1400 audit(1785853078.604:126): avc: denied { write } for pid=5569 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.263924][ T30] audit: type=1400 audit(1785853078.764:127): avc: denied { write } for pid=5573 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.323182][ T30] audit: type=1400 audit(1785853078.824:128): avc: denied { write } for pid=5584 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.115' (ED25519) to the list of known hosts. [ 61.284551][ T30] audit: type=1400 audit(1785853084.784:129): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 61.308424][ T30] audit: type=1400 audit(1785853084.814:130): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 61.311049][ T5595] cgroup: Unknown subsys name 'net' [ 61.337351][ T30] audit: type=1400 audit(1785853084.844:131): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 61.457538][ T5595] cgroup: Unknown subsys name 'cpuset' [ 61.465768][ T5595] cgroup: Unknown subsys name 'rlimit' [ 61.563657][ T30] audit: type=1400 audit(1785853085.064:132): avc: denied { setattr } for pid=5595 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 61.587231][ T30] audit: type=1400 audit(1785853085.064:133): avc: denied { create } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 61.634494][ T30] audit: type=1400 audit(1785853085.064:134): avc: denied { write } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 61.655403][ T30] audit: type=1400 audit(1785853085.064:135): avc: denied { read } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 61.676394][ T30] audit: type=1400 audit(1785853085.064:136): avc: denied { mounton } for pid=5595 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 61.698824][ T5598] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 61.701615][ T30] audit: type=1400 audit(1785853085.064:137): avc: denied { mount } for pid=5595 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 61.733269][ T30] audit: type=1400 audit(1785853085.224:138): avc: denied { relabelto } for pid=5598 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 62.692531][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.629363][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.637559][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.646941][ T5616] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.652980][ T5617] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.654912][ T5616] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.662506][ T5617] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.671126][ T5616] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.677860][ T5617] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.682804][ T5616] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.689906][ T5617] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.701049][ T5616] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.712860][ T5616] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.720883][ T5616] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.731165][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.739389][ T5616] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.746790][ T5620] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 64.757479][ T5616] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 64.772592][ T5616] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 64.779845][ T5613] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.790291][ T5613] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.800797][ T5613] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 64.809791][ T5613] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.818081][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.826069][ T5613] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.836069][ T5613] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.927605][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.936435][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.957712][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.965730][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.972903][ T5607] bridge_slave_0: entered allmulticast mode [ 65.981297][ T5607] bridge_slave_0: entered promiscuous mode [ 66.029110][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.036847][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.043960][ T5607] bridge_slave_1: entered allmulticast mode [ 66.050821][ T5607] bridge_slave_1: entered promiscuous mode [ 66.080444][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.087652][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.095442][ T5618] bridge_slave_0: entered allmulticast mode [ 66.102121][ T5618] bridge_slave_0: entered promiscuous mode [ 66.128844][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.136033][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.143128][ T5618] bridge_slave_1: entered allmulticast mode [ 66.149954][ T5618] bridge_slave_1: entered promiscuous mode [ 66.171398][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.204728][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.242137][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.255426][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.262560][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.269780][ T5608] bridge_slave_0: entered allmulticast mode [ 66.277041][ T5608] bridge_slave_0: entered promiscuous mode [ 66.297888][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.317231][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.324323][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.331666][ T5608] bridge_slave_1: entered allmulticast mode [ 66.338475][ T5608] bridge_slave_1: entered promiscuous mode [ 66.353179][ T5607] team0: Port device team_slave_0 added [ 66.378391][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.385603][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.392707][ T5615] bridge_slave_0: entered allmulticast mode [ 66.399724][ T5615] bridge_slave_0: entered promiscuous mode [ 66.407812][ T5607] team0: Port device team_slave_1 added [ 66.419506][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.426703][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.433856][ T5614] bridge_slave_0: entered allmulticast mode [ 66.440822][ T5614] bridge_slave_0: entered promiscuous mode [ 66.453846][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.460988][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.468395][ T5615] bridge_slave_1: entered allmulticast mode [ 66.475409][ T5615] bridge_slave_1: entered promiscuous mode [ 66.489391][ T5618] team0: Port device team_slave_0 added [ 66.495283][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.502358][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.509542][ T5614] bridge_slave_1: entered allmulticast mode [ 66.516352][ T5614] bridge_slave_1: entered promiscuous mode [ 66.524837][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.548148][ T5618] team0: Port device team_slave_1 added [ 66.561023][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.578024][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.585619][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.611684][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.642077][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.654910][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.661880][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.687945][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.706493][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.723693][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.733122][ T5617] Bluetooth: hci0: command tx timeout [ 66.748764][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.755833][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.781762][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.794164][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.805509][ T5617] Bluetooth: hci1: command tx timeout [ 66.805532][ T5613] Bluetooth: hci2: command tx timeout [ 66.811783][ T5608] team0: Port device team_slave_0 added [ 66.830985][ T5615] team0: Port device team_slave_0 added [ 66.837266][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.844241][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.870513][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.889750][ T5613] Bluetooth: hci4: command tx timeout [ 66.891712][ T5608] team0: Port device team_slave_1 added [ 66.895792][ T5617] Bluetooth: hci3: command tx timeout [ 66.911258][ T5615] team0: Port device team_slave_1 added [ 66.954114][ T5614] team0: Port device team_slave_0 added [ 66.971596][ T5607] hsr_slave_0: entered promiscuous mode [ 66.978009][ T5607] hsr_slave_1: entered promiscuous mode [ 66.992637][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.999712][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.025874][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.038145][ T5614] team0: Port device team_slave_1 added [ 67.044142][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.051323][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.077685][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.089714][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.096771][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.122725][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.140341][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.147356][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.173558][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.203740][ T5618] hsr_slave_0: entered promiscuous mode [ 67.210051][ T5618] hsr_slave_1: entered promiscuous mode [ 67.216097][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 67.221874][ T5618] Cannot create hsr debugfs directory [ 67.255717][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.262717][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.288830][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.301079][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.308055][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.333941][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.396143][ T5608] hsr_slave_0: entered promiscuous mode [ 67.402173][ T5608] hsr_slave_1: entered promiscuous mode [ 67.408242][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 67.413969][ T5608] Cannot create hsr debugfs directory [ 67.445094][ T5615] hsr_slave_0: entered promiscuous mode [ 67.451151][ T5615] hsr_slave_1: entered promiscuous mode [ 67.457311][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 67.463055][ T5615] Cannot create hsr debugfs directory [ 67.509121][ T5614] hsr_slave_0: entered promiscuous mode [ 67.515246][ T5614] hsr_slave_1: entered promiscuous mode [ 67.521210][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 67.527327][ T5614] Cannot create hsr debugfs directory [ 67.822453][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 67.833709][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.841740][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 67.850268][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.867179][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 67.877431][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.886262][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 67.896359][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.941298][ T5608] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.950444][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.958602][ T5608] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.968625][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.976518][ T5608] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.985188][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.002742][ T5608] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 68.011375][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.089136][ T5614] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 68.099755][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.108652][ T5614] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 68.117685][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.125765][ T5614] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 68.135068][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.142763][ T5614] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.151713][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.232405][ T5618] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.240959][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.249348][ T5618] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.258765][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.267308][ T5618] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.276469][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.292152][ T5618] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.301513][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.315749][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.387294][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.398362][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.406200][ T5615] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.415972][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.424111][ T5615] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.433483][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.449596][ T5615] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.458448][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.466558][ T5615] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.475534][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.486396][ T1050] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.493608][ T1050] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.525612][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.532711][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.553039][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.570063][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.577202][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.591619][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.598719][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.657063][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.690107][ T5607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.712694][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.747181][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.754358][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.780022][ T1050] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.787195][ T1050] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.804880][ T5617] Bluetooth: hci0: command tx timeout [ 68.839789][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.888583][ T5613] Bluetooth: hci1: command tx timeout [ 68.894691][ T5617] Bluetooth: hci2: command tx timeout [ 68.954867][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.970756][ T5613] Bluetooth: hci4: command tx timeout [ 68.976425][ T5617] Bluetooth: hci3: command tx timeout [ 68.983111][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.991792][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.998869][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.044379][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.051597][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.082378][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.142138][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.149297][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.171851][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.179015][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.401964][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.481298][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.560414][ T5608] veth0_vlan: entered promiscuous mode [ 69.618765][ T5608] veth1_vlan: entered promiscuous mode [ 69.695556][ T5607] veth0_vlan: entered promiscuous mode [ 69.753351][ T5607] veth1_vlan: entered promiscuous mode [ 69.771172][ T5608] veth0_macvtap: entered promiscuous mode [ 69.791671][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.809116][ T5608] veth1_macvtap: entered promiscuous mode [ 69.868574][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.892221][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.916651][ T5607] veth0_macvtap: entered promiscuous mode [ 69.949953][ T5607] veth1_macvtap: entered promiscuous mode [ 70.020718][ T5614] veth0_vlan: entered promiscuous mode [ 70.043558][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.058599][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.071683][ T5614] veth1_vlan: entered promiscuous mode [ 70.088597][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.098811][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.228009][ T1178] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.236482][ T93] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.245839][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.246463][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.262859][ T1178] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.274035][ T5614] veth0_macvtap: entered promiscuous mode [ 70.318733][ T5614] veth1_macvtap: entered promiscuous mode [ 70.354809][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.380084][ T93] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.389693][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.391487][ T93] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.400602][ T5618] veth0_vlan: entered promiscuous mode [ 70.426571][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.441363][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 70.441379][ T30] audit: type=1400 audit(1785853093.944:152): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.KhmpBd/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 70.496598][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.505330][ T30] audit: type=1400 audit(1785853093.944:153): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 70.517629][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.540590][ T5618] veth1_vlan: entered promiscuous mode [ 70.553211][ T30] audit: type=1400 audit(1785853093.944:154): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.KhmpBd/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 70.581205][ T30] audit: type=1400 audit(1785853093.954:155): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 70.583444][ T5608] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 70.619083][ T30] audit: type=1400 audit(1785853093.954:156): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.KhmpBd/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 70.648242][ T30] audit: type=1400 audit(1785853093.954:157): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.KhmpBd/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=8277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 70.675882][ T30] audit: type=1400 audit(1785853093.984:158): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 70.696111][ T30] audit: type=1400 audit(1785853093.994:159): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 70.719291][ T30] audit: type=1400 audit(1785853093.994:160): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="gadgetfs" ino=8298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 70.743270][ T30] audit: type=1400 audit(1785853093.994:161): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 70.789750][ T1178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.821732][ T1178] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.830337][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.842403][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.860505][ T5615] veth0_vlan: entered promiscuous mode [ 70.874930][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.888162][ T5617] Bluetooth: hci0: command tx timeout [ 70.924157][ T5615] veth1_vlan: entered promiscuous mode [ 70.964718][ T5617] Bluetooth: hci2: command tx timeout [ 70.969181][ T5618] veth0_macvtap: entered promiscuous mode [ 70.970150][ T5613] Bluetooth: hci1: command tx timeout [ 71.010293][ T5618] veth1_macvtap: entered promiscuous mode [ 71.029062][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.046974][ T5617] Bluetooth: hci4: command tx timeout [ 71.051305][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.052999][ T5613] Bluetooth: hci3: command tx timeout [ 71.077948][ T29] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 71.126976][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.139041][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.146479][ T5615] veth0_macvtap: entered promiscuous mode [ 71.150139][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.185679][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.198351][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.209980][ T5615] veth1_macvtap: entered promiscuous mode [ 71.247913][ T29] usb 3-1: unable to get BOS descriptor or descriptor too short [ 71.261476][ T29] usb 3-1: not running at top speed; connect to a high speed hub [ 71.262649][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.278651][ T29] usb 3-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 71.290400][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.304676][ T454] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.335359][ T1050] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.346130][ T29] usb 3-1: Product: syz [ 71.356720][ T29] usb 3-1: Manufacturer: syz [ 71.360421][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.367083][ T29] usb 3-1: SerialNumber: syz [ 71.472945][ T454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.486534][ T454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.506119][ T93] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.520337][ T93] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.616996][ T1050] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.625976][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.636426][ T1050] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.651104][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.665294][ T1178] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.728549][ T454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.738382][ T93] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.749454][ T454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.757263][ T93] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.856902][ T1178] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.868420][ T1178] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.894992][ T454] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.928386][ T454] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.024661][ T1178] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.285108][ T5712] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 72.316480][ T5801] NFSD: Unable to initialize client recovery tracking! (-110) [ 72.341620][ T5801] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 72.368093][ T5801] NFSD: starting 90-second grace period (net f00003c6) [ 72.462248][ T5712] usb 5-1: New USB device found, idVendor=058f, idProduct=6387, bcdDevice= 1.00 [ 72.483524][ T5712] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.511682][ T5712] usb 5-1: Product: syz [ 72.516265][ T5712] usb 5-1: Manufacturer: syz [ 72.520970][ T5712] usb 5-1: SerialNumber: syz [ 72.554328][ T5712] usb-storage 5-1:1.0: USB Mass Storage device detected [ 72.578841][ T5712] scsi host1: usb-storage 5-1:1.0 [ 72.667129][ T29] usb 3-1: 1:1: cannot set freq 1000 to ep 0x1 [ 72.679017][ T29] usb 3-1: 2:1: cannot set freq 1000 to ep 0x81 [ 72.753354][ T29] usb 3-1: USB disconnect, device number 2 [ 72.754668][ T994] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 72.922483][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 72.967816][ T994] usb 1-1: Using ep0 maxpacket: 32 [ 72.973406][ T5613] Bluetooth: hci0: command tx timeout [ 72.986450][ T994] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 73.004605][ T994] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 73.014998][ T994] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 73.025143][ T994] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 73.037924][ T994] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 73.052086][ T5613] Bluetooth: hci1: command tx timeout [ 73.057624][ T5617] Bluetooth: hci2: command tx timeout [ 73.075028][ T994] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 73.094335][ T994] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.116341][ T994] usb 1-1: config 0 descriptor?? [ 73.128891][ T5617] Bluetooth: hci3: command tx timeout [ 73.134368][ T5613] Bluetooth: hci4: command tx timeout [ 75.941426][ T5882] [ 75.943796][ T5882] ====================================================== [ 75.950804][ T5882] WARNING: possible circular locking dependency detected [ 75.957837][ T5882] syzkaller #0 Not tainted [ 75.962256][ T5882] ------------------------------------------------------ [ 75.969278][ T5882] syz.0.25/5882 is trying to acquire lock: [ 75.975080][ T5882] ffffffff90253240 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 75.983965][ T5882] [ 75.983965][ T5882] but task is already holding lock: [ 75.991344][ T5882] ffff8880233b0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 76.000323][ T5882] [ 76.000323][ T5882] which lock already depends on the new lock. [ 76.000323][ T5882] [ 76.010721][ T5882] [ 76.010721][ T5882] the existing dependency chain (in reverse order) is: [ 76.019733][ T5882] [ 76.019733][ T5882] -> #3 (&gi->lock){+.+.}-{4:4}: [ 76.026869][ T5882] lock_acquire+0x1b9/0x370 [ 76.031932][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 76.034657][ T5609] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 76.037044][ T5882] config_usb_cfg_link+0x57/0x3a0 [ 76.037072][ T5882] configfs_symlink+0x540/0x11f0 [ 76.055513][ T5882] vfs_symlink+0x178/0x4d0 [ 76.060464][ T5882] filename_symlinkat+0x2a6/0x560 [ 76.066010][ T5882] __x64_sys_symlinkat+0x9c/0xe0 [ 76.071483][ T5882] do_syscall_64+0x115/0x870 [ 76.076618][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.083032][ T5882] [ 76.083032][ T5882] -> #2 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: [ 76.091750][ T5882] lock_acquire+0x1b9/0x370 [ 76.096796][ T5882] down_write+0x8b/0x1f0 [ 76.101567][ T5882] configfs_depend_item_unlocked+0xf3/0x6a0 [ 76.108008][ T5882] usbg_make_tpg+0x261/0x620 [ 76.113128][ T5882] target_fabric_make_tpg+0xab/0x8c0 [ 76.118947][ T5882] configfs_mkdir+0x51e/0xb70 [ 76.124150][ T5882] vfs_mkdir+0x361/0x850 [ 76.128908][ T5882] filename_mkdirat+0x48b/0x5e0 [ 76.134285][ T5882] __x64_sys_mkdirat+0x89/0xc0 [ 76.139568][ T5882] do_syscall_64+0x115/0x870 [ 76.144673][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.151079][ T5882] [ 76.151079][ T5882] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 76.158727][ T5882] lock_acquire+0x1b9/0x370 [ 76.163740][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 76.168861][ T5882] usbg_make_tpg+0x1a4/0x620 [ 76.173992][ T5882] target_fabric_make_tpg+0xab/0x8c0 [ 76.179779][ T5882] configfs_mkdir+0x51e/0xb70 [ 76.184986][ T5882] vfs_mkdir+0x361/0x850 [ 76.189754][ T5882] filename_mkdirat+0x48b/0x5e0 [ 76.195141][ T5882] __x64_sys_mkdirat+0x89/0xc0 [ 76.195312][ T5609] usb 4-1: not running at top speed; connect to a high speed hub [ 76.200455][ T5882] do_syscall_64+0x115/0x870 [ 76.200485][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.200501][ T5882] [ 76.200501][ T5882] -> #0 (tpg_instances_lock){+.+.}-{4:4} [ 76.211700][ T5609] usb 4-1: New USB device found, idVendor=041e, idProduct=401c, bcdDevice= 1.00 [ 76.213319][ T5882] : [ 76.213327][ T5882] check_prev_add+0xeb/0xe60 [ 76.221267][ T5609] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.227518][ T5882] __lock_acquire+0x136c/0x1a40 [ 76.227550][ T5882] lock_acquire+0x1b9/0x370 [ 76.227566][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 76.227590][ T5882] tcm_alloc+0x20/0x440 [ 76.227607][ T5882] usb_get_function+0x5e/0xd0 [ 76.237856][ T5609] usb 4-1: Product: syz [ 76.239015][ T5882] config_usb_cfg_link+0x1ed/0x3a0 [ 76.239043][ T5882] configfs_symlink+0x540/0x11f0 [ 76.244193][ T5609] usb 4-1: Manufacturer: syz [ 76.252107][ T5882] vfs_symlink+0x178/0x4d0 [ 76.252139][ T5882] filename_symlinkat+0x2a6/0x560 [ 76.252156][ T5882] __x64_sys_symlinkat+0x9c/0xe0 [ 76.252173][ T5882] do_syscall_64+0x115/0x870 [ 76.252191][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.252207][ T5882] [ 76.252207][ T5882] other info that might help us debug this: [ 76.252207][ T5882] [ 76.252212][ T5882] Chain exists of: [ 76.252212][ T5882] tpg_instances_lock --> &sb->s_type->i_mutex_key#28 --> &gi->lock [ 76.252212][ T5882] [ 76.252247][ T5882] Possible unsafe locking scenario: [ 76.252247][ T5882] [ 76.252252][ T5882] CPU0 CPU1 [ 76.252257][ T5882] ---- ---- [ 76.252262][ T5882] lock(&gi->lock); [ 76.252274][ T5882] lock(&sb->s_type->i_mutex_key#28); [ 76.252291][ T5882] lock(&gi->lock); [ 76.252303][ T5882] lock(tpg_instances_lock); [ 76.252314][ T5882] [ 76.252314][ T5882] *** DEADLOCK *** [ 76.252314][ T5882] [ 76.252318][ T5882] 3 locks held by syz.0.25/5882: [ 76.252327][ T5882] #0: ffff88801e3c2450 (sb_writers#15){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 76.252381][ T5882] #1: ffff8880520c5900 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 76.252436][ T5882] #2: ffff8880233b0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 76.252481][ T5882] [ 76.252481][ T5882] stack backtrace: [ 76.252491][ T5882] CPU: 0 UID: 0 PID: 5882 Comm: syz.0.25 Not tainted syzkaller #0 PREEMPT(full) [ 76.252510][ T5882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 76.252520][ T5882] Call Trace: [ 76.252526][ T5882] [ 76.252533][ T5882] dump_stack_lvl+0x100/0x190 [ 76.252554][ T5882] print_circular_bug.cold+0x178/0x1c7 [ 76.252589][ T5882] check_noncircular+0x146/0x160 [ 76.252612][ T5882] check_prev_add+0xeb/0xe60 [ 76.252630][ T5882] __lock_acquire+0x136c/0x1a40 [ 76.252652][ T5882] lock_acquire+0x1b9/0x370 [ 76.252668][ T5882] ? tcm_alloc+0x20/0x440 [ 76.252686][ T5882] ? __pfx___might_resched+0x10/0x10 [ 76.252707][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 76.252726][ T5882] ? tcm_alloc+0x20/0x440 [ 76.252743][ T5882] ? tcm_alloc+0x20/0x440 [ 76.252760][ T5882] ? __mutex_lock+0x26d/0x1bd0 [ 76.252777][ T5882] ? config_usb_cfg_link+0x57/0x3a0 [ 76.252796][ T5882] ? __pfx___mutex_lock+0x10/0x10 [ 76.252817][ T5882] ? __pfx_selinux_inode_permission+0x10/0x10 [ 76.252837][ T5882] ? tcm_alloc+0x20/0x440 [ 76.252854][ T5882] tcm_alloc+0x20/0x440 [ 76.252872][ T5882] usb_get_function+0x5e/0xd0 [ 76.252894][ T5882] config_usb_cfg_link+0x1ed/0x3a0 [ 76.252913][ T5882] ? mntput_no_expire+0xe7/0x220 [ 76.252929][ T5882] configfs_symlink+0x540/0x11f0 [ 76.252951][ T5882] ? __pfx_configfs_symlink+0x10/0x10 [ 76.252973][ T5882] vfs_symlink+0x178/0x4d0 [ 76.252994][ T5882] filename_symlinkat+0x2a6/0x560 [ 76.253012][ T5882] ? __pfx_filename_symlinkat+0x10/0x10 [ 76.253030][ T5882] ? strncpy_from_user+0x19d/0x2d0 [ 76.253050][ T5882] ? do_getname+0x191/0x390 [ 76.253070][ T5882] __x64_sys_symlinkat+0x9c/0xe0 [ 76.253088][ T5882] do_syscall_64+0x115/0x870 [ 76.253106][ T5882] ? clear_bhb_loop+0x40/0x90 [ 76.253123][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.253138][ T5882] RIP: 0033:0x7f5d8d99e019 [ 76.253152][ T5882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.253166][ T5882] RSP: 002b:00007f5d8e7e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 76.253180][ T5882] RAX: ffffffffffffffda RBX: 00007f5d8dc25fa0 RCX: 00007f5d8d99e019 [ 76.253190][ T5882] RDX: 0000200000000900 RSI: ffffffffffffff9c RDI: 00002000000008c0 [ 76.253200][ T5882] RBP: 00007f5d8da3500c R08: 0000000000000000 R09: 0000000000000000 [ 76.253209][ T5882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.253218][ T5882] R13: 00007f5d8dc26038 R14: 00007f5d8dc25fa0 R15: 00007ffe33da1ab8 [ 76.253231][ T5882] [ 76.286156][ T5795] mos7840 5-1:1.0: probe with driver mos7840 failed with error -71 [ 76.299391][ T5609] usb 4-1: SerialNumber: syz [ 76.317158][ T5795] usb 5-1: USB disconnect, device number 3 [ 76.326532][ T5882] udc dummy_udc.0: failed to start g1: -19 [ 76.326974][ T5882] UDC core: g1: couldn't find an available UDC or it's busy [ 76.732859][ T5609] gspca_main: gspca_zc3xx-2.14.0 probing 041e:401c [ 76.967402][ T5712] em28xx 3-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 76.975491][ T5712] em28xx 3-1:1.0: board has no eeprom [ 77.034463][ T5712] em28xx 3-1:1.0: Identified as Terratec Cinergy T XS (MT2060) (card=44) [ 77.043003][ T5712] em28xx 3-1:1.0: dvb set to bulk mode. [ 77.049280][ T5768] em28xx 3-1:1.0: Binding DVB extension [ 77.058023][ T5768] em28xx 3-1:1.0: writing to i2c device at 0x1e failed (error=-5) [ 77.066008][ T5768] zl10353_read_register: readreg error (reg=127, ret==-5) [ 77.073263][ T5768] em28xx 3-1:1.0: frontend initialization failed [ 77.080312][ T5768] em28xx 3-1:1.0: Remote control support is not available for this card. [ 77.241562][ T994] usb 3-1: USB disconnect, device number 3 [ 77.247927][ T994] em28xx 3-1:1.0: Disconnecting em28xx [ 77.253412][ T994] em28xx 3-1:1.0: Closing input extension [ 77.260753][ T994] em28xx 3-1:1.0: Freeing device [ 79.541906][ T5609] gspca_zc3xx: i2c_r status error 01 [ 79.944046][ T5609] gspca_zc3xx: reg_r err -71 [ 80.554502][ T5609] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 80.560841][ T5609] gspca_zc3xx 4-1:1.0: probe with driver gspca_zc3xx failed with error -71 [ 80.572221][ T5609] usb 4-1: USB disconnect, device number 2 [ 81.288530][ T805] cfg80211: failed to load regulatory.db