last executing test programs: 29.557066205s ago: executing program 1 (id=433): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x500, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 29.257122356s ago: executing program 1 (id=434): r0 = socket(0x1e, 0x4, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$rdma_cm(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_open_dev$I2C(&(0x7f0000000240), 0x1, 0x4cc201) userfaultfd(0x80001) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x9, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0xffffffffffffffff, 0x8, &(0x7f00000002c0)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x70bd2d, 0x0, {0xa, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10010}}, 0x1c}}, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r6) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYRES32=r1, @ANYRES32=r7, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c000500080005"], 0x3}}, 0x0) bind$can_raw(r0, &(0x7f0000000180)={0x1d, r7}, 0x10) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000340)={'#! ', './file0', [], 0xa, "dadbffac54f77af7c06edd1b45851f4cc72aa3422cb4ac6c71faa6e969a15bb2126cec7f06940bf41fb6abb00c1d98b07f5f50a339686d0200000034ef34bba9e6e2624b03ea629eb8f7cff57899bf7362cf92a0553eec42b57e3c3c085554419aa10bee43b132088ab8f4770db50d70"}, 0x7b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r8, 0x0) preadv(r8, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) 28.321163747s ago: executing program 1 (id=439): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000280)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup(r2) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000b00), 0x800, 0x0) keyctl$session_to_parent(0x12) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x500000000000000) 27.287535503s ago: executing program 1 (id=441): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000340)=0x5) ioctl$TIOCVHANGUP(r0, 0x5437, 0x7000000) 26.781174533s ago: executing program 1 (id=443): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007200000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r4}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) read$FUSE(r5, &(0x7f0000000880)={0x2020}, 0x2020) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f060f8300900f01cb0f71e6c9baa10066ed0f01f9f26e0f0966b9fd0300000f32f30f1a13", 0x25}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f0000000040)=0x10) ioctl$LOOP_SET_FD(r7, 0x4c00, r5) 26.649231501s ago: executing program 1 (id=444): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x330, 0x150, 0x940c, 0x3002, 0x150, 0x2c0, 0x260, 0x3d8, 0x3d8, 0x260, 0x3d8, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @empty, [0x8000007f, 0xff000000, 0xffffffff, 0xffffff00], [0xff000000, 0xffffff00, 0x0, 0xffffffff], 'vcan0\x00', 'veth1_to_hsr\x00', {0xff}, {0xff}, 0x32, 0x7f, 0x3, 0x4}, 0x0, 0x108, 0x150, 0x0, {}, [@common=@ipv6header={{0x28}, {0x82, 0x20, 0x1}}, @common=@unspec=@devgroup={{0x38}, {0x10, 0x2, 0x9, 0x0, 0xce49}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00', {0x4}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x10, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}], {{'\x00', 0x40000, 0xa8, 0xd0}, {0x28}}}}, 0x390) 11.472890022s ago: executing program 32 (id=444): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x330, 0x150, 0x940c, 0x3002, 0x150, 0x2c0, 0x260, 0x3d8, 0x3d8, 0x260, 0x3d8, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @empty, [0x8000007f, 0xff000000, 0xffffffff, 0xffffff00], [0xff000000, 0xffffff00, 0x0, 0xffffffff], 'vcan0\x00', 'veth1_to_hsr\x00', {0xff}, {0xff}, 0x32, 0x7f, 0x3, 0x4}, 0x0, 0x108, 0x150, 0x0, {}, [@common=@ipv6header={{0x28}, {0x82, 0x20, 0x1}}, @common=@unspec=@devgroup={{0x38}, {0x10, 0x2, 0x9, 0x0, 0xce49}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00', {0x4}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x10, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}], {{'\x00', 0x40000, 0xa8, 0xd0}, {0x28}}}}, 0x390) 10.56478281s ago: executing program 4 (id=500): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000102312073f00000000000109022400010000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0xd0}, 0x1, 0x0, 0x0, 0xc041}, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}, 0x20e0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f0000000000)={{0x6, @rose}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r3, 0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) 8.310760385s ago: executing program 2 (id=506): syz_open_dev$radio(&(0x7f0000000040), 0x1, 0x2) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000500)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @loopback}, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x2, 0x0, 0xb645, 0x0, 0x808, 0x300}) socket(0x1, 0x803, 0x0) mbind(&(0x7f0000074000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x7fe0, 0x5) sched_setscheduler(0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) iopl(0x3) r2 = gettid() r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001200210200000000000000000700", @ANYBLOB="000000000000fb"], 0x24}, 0x1, 0x0, 0x0, 0x22004005}, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0xfffe, 0x0, @empty, 0x4}, {0xa, 0x0, 0x0, @loopback, 0xfffffffc}, r5, 0x400}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f0000000980)={0x16, 0x98, 0xfa00, {0x0, 0x2, r5, 0x30, 0x1, @ib={0x1b, 0x1, 0x1, {"c6b7b7e198082124066b72a4ca8bf843"}, 0x7, 0x7, 0x3}}}, 0xa0) timer_create(0x6, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000000)=0x0) timer_settime(r6, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) pread64(r1, 0x0, 0x0, 0xce2) r7 = eventfd(0x0) r8 = epoll_create(0x80) epoll_ctl$EPOLL_CTL_ADD(r8, 0x300, r7, &(0x7f0000000080)={0x10000000}) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r9 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) syz_emit_ethernet(0x46, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffffffffddaaaaaaaaaabb86dd6012000800103afffe800000c4000000004fd2b8f8607e8158008ac3f2000000012000bbff02000000000000000000000000080186009078000004000000000000000000"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000880)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010448", 0x20, 0x3a, 0xff, @remote, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, "36dad83aea8d"}]}}}}}}, 0x0) keyctl$get_persistent(0x16, 0xffffffffffffffff, r9) 8.236324416s ago: executing program 4 (id=507): socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) syz_open_dev$vim2m(0x0, 0x3, 0x2) (async, rerun: 32) r0 = socket(0x1a, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) inotify_init1(0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x4e, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000000000180000fe800000000000000000001c0000002cfe8000000000000000000000000004017f040100050204530000000000000a990b5d1f3b862af02a4ef413c498c6e17fa5b22c17804e"], 0x0) (async, rerun: 64) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)}, 0x2141) (async, rerun: 64) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = epoll_create1(0x0) read$msr(r2, &(0x7f0000000200)=""/87, 0x57) (async, rerun: 64) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) (rerun: 64) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000180)={0xc0002000}) (async) ioctl$TCSETSW2(r4, 0x402c542c, &(0x7f0000000040)={0x4, 0x80000000, 0x5, 0x0, 0x0, "362e851f84882fb90efa3fa665d2eb144970e2", 0x8, 0x81}) (async, rerun: 32) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) (async, rerun: 32) r5 = socket$unix(0x1, 0x1, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x10) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) (async) r8 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002abd7000fcdbdf250100000008000100", @ANYRES32=r9, @ANYBLOB="686173685f737461747300000000000000000000000000000002000000050003000b0000000800040003000000080007000000000000000000000000000000000000000028db9d2304de374faba62165b5b41b25862aece2f75ef252fb0e28514a1d33e1d60db43947d2d41620a55a6eefeb45af67579e4df3baaea33ef0f1eac9cb8978ceb518dd3f0fcf9dfad2ee474214e2cd316f3074252ad53f96697a11123b4d988289b8faabd01e41967aa2db1d7ed0738106739dfbe50a0e20505c79129223941c8a56cdefb84fdeaa864ec8249f1a5893515f3cf438ed9a0015dada44dd48eb9bc8d27e7a6660d59e14350b469e0d71433f9aa0b5614c"], 0x60}, 0x1, 0x0, 0x0, 0x24004000}, 0x24044880) bind$unix(r5, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) mknod(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x0, &(0x7f0000000980)='norecovery') 8.12772667s ago: executing program 4 (id=508): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) io_uring_setup(0x1581, 0x0) prlimit64(0x0, 0x3, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) msgsnd(0x0, &(0x7f0000000080)=ANY=[], 0x8, 0x0) msgrcv(0x0, &(0x7f0000000280)={0x0, ""/55}, 0x3f, 0x0, 0x86b1b18158a7cb82) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x1c3302) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000000)={0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r4, &(0x7f00000000c0)={0x0, 0xc, 0x1}) bind$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @any, 0x4}, 0xe) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000700000061220000020000000000fc00", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r1, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r6, 0x0, 0x0}, 0x20) syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') fsopen(&(0x7f0000000040)='afs\x00', 0x0) 7.121953662s ago: executing program 0 (id=512): openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x201, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$UFFDIO_COPY(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000548000/0x1000)=nil, &(0x7f0000fee000/0x11000)=nil, 0x1000}) 7.107360006s ago: executing program 4 (id=513): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101142, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={{r0}, 0x0, 0x0, 0x100000}) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x2) pwritev2(r1, &(0x7f00000000c0)=[{&(0x7f0000000200)="df", 0x1}], 0x1, 0x800002, 0x0, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c00000000000000120000f1850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) keyctl$set_timeout(0xa, 0x0, 0x20ffffff) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b00"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x51, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) request_key(0x0, 0x0, 0x0, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f00000000c0)={0x0, {0x2, 0x4e22, @private=0xa010100}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x20}}, {0x2, 0x4e20, @local}, 0x114, 0x0, 0x8000000, 0x0, 0x5, 0x0, 0x3, 0x3, 0x2}) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x80243, 0x1) 7.07020722s ago: executing program 0 (id=514): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet(0x2, 0x1, 0x100) r5 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000280)="dee7030022cf5c6c7bc31bd2599759fafa9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976edec860ab49c3a4f51ab0124b50c3362201a307df03000", 0x83, r5) keyctl$search(0xa, r5, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1, 0x2e}, 0xffffffffffffffff) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) sendto$inet(r4, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec", 0x4b, 0x11, 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB='+cpu'], 0x5) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000500)=ANY=[@ANYBLOB='-cpu'], 0x5) socket$nl_generic(0x10, 0x3, 0x10) 6.137549233s ago: executing program 3 (id=515): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300), 0x4000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {}, 0x5, 0x1080000001}}}, 0x90) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00'}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'wg0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="2400020000000000000004000120000000000000", @ANYRES32=r6, @ANYBLOB="300000000000000004001680"], 0x24}, 0x1, 0x0, 0x0, 0x40091}, 0x4000014) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r8 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x4, 0x0, 0x10, 0x8001, 0x3, 0x0, 0x3, 0xb}}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 6.115572629s ago: executing program 0 (id=516): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000102312073f00000000000109022400010000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0xd0}, 0x1, 0x0, 0x0, 0xc041}, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}, 0x20e0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f0000000000)={{0x6, @rose}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r3, 0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) 6.016404433s ago: executing program 4 (id=517): syz_open_dev$radio(&(0x7f0000000040), 0x1, 0x2) syz_usb_connect(0x5, 0x24, &(0x7f00000009c0)={{0x12, 0x1, 0x250, 0x1a, 0x3e, 0xa6, 0x10, 0xb48, 0x2003, 0x7f22, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0x7, 0x90, 0x8, [{{0x9, 0x4, 0xd4, 0x76, 0x0, 0x43, 0x5f, 0xce, 0x9}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001740)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) 5.643349047s ago: executing program 2 (id=518): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x1}, 0x24}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400600142603600e1208000b0000000401a8001600a400014009000200036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r5 = gettid() syz_open_dev$vbi(&(0x7f0000000e40), 0x3, 0x2) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) process_vm_writev(r5, &(0x7f0000000140)=[{&(0x7f0000000600)=""/159, 0x9f}, {&(0x7f0000000780)=""/235, 0xeb}, {&(0x7f0000000980)=""/216, 0xd8}, {&(0x7f0000000040)=""/38, 0x26}], 0x4, &(0x7f0000000d80)=[{&(0x7f0000000a80)=""/245, 0xf5}, {&(0x7f0000000880)=""/171, 0xab}, {&(0x7f0000000480)=""/84, 0x54}, {&(0x7f0000000b80)=""/205, 0xcd}, {&(0x7f00000003c0)=""/29, 0x1d}, {&(0x7f00000006c0)=""/80, 0x50}, {&(0x7f0000000580)=""/7, 0x7}, {&(0x7f0000000c80)=""/148, 0x94}, {&(0x7f0000000d40)=""/64, 0x40}], 0x9, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) ioperm(0x2, 0xf, 0x9e8f) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) write$RDMA_USER_CM_CMD_MIGRATE_ID(r6, &(0x7f0000000440)={0x12, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, r6}}, 0x18) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) fspick(0xffffffffffffffff, &(0x7f0000000f40)='./cgroup\x00', 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd29, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xa, 0xfff3}, {}, {0xc}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x4, 0x1}}]}}]}, 0x3c}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f00000000c0), 0x180018, &(0x7f0000000000)=ANY=[@ANYRES16=r2]) setxattr$incfs_id(&(0x7f0000000e80)='./file1\x00', &(0x7f0000000ec0), &(0x7f0000000f00)={'0000000000000000000000000000000', 0x33}, 0x20, 0x2) 5.634075713s ago: executing program 3 (id=519): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mbind(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x7d, 0x0) set_mempolicy_home_node(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000500)='sys_exit\x00', r2}, 0x10) msgrcv(0x0, 0x0, 0x0, 0x2, 0x1000) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) pidfd_getfd(r5, 0xffffffffffffffff, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') unshare(0x62010c00) read$qrtrtun(r6, &(0x7f00000004c0)=""/57, 0x39) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)={0x18, 0x1, 0x9, 0x401, 0x0, 0x0, {0x5, 0x0, 0x7}, [@NFCTH_TUPLE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 5.250932466s ago: executing program 2 (id=520): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r4, 0x0, 0x1000000000000000}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001480)={0x11, 0x3, &(0x7f0000001540)=ANY=[@ANYRES64=r0, @ANYRES8=r3, @ANYRES64=r3, @ANYRES64=r5, @ANYRES16=r5, @ANYRES32=0x0, @ANYRES64=0x0], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) write$UHID_INPUT(r1, &(0x7f0000000400)={0x8, {"940de312c9be105c33394390ce360adcb8443d1ca2464ad29fe46c8717a823e29b12011e867516a9c1b63394e6b4922549ac2f98b0bafc013757371b5762e5b03b4c8cfcc5d34368b21917740955f80e80fa98a68cb052b102c03e72a4c6702778dfcc5bb74ce23d914f8b143bd94d7382a385be93f61eef509d6cbffa81afee0e3524b8b768a0ef0ae00ad2a23728722436d1c150b512b6c642cb2eeaecb085719014332015474a4ddf7098bb5ac398c0ce256e4dcfd4613dbe9a34b96439546a28db9ce97b344b6c97289b3854e127b4f533f56439a74fcffc41dfeffc5d7a99c01a0fedfd937af595c05a942216581f8efd1ffa1c23c6f08d6987be16bb52420c80bda5da46987fbf7209487defe0374226a526d3588660192d921bfe407f1d1833f390dd8b41b30c53b4deba5a086c516d9bc8ca572d8f0f875303c85bd16570e89f74d7c4ef547a07dd62f334fee76e2e0ca31cca1ad0528d7448ceecd4c9785c302a40bc114335dea8775958a3beff8eeb31afcb9a2c7561980f8554220769e5e90fdfb2f5a905518ef1667a91e2dd474383e4312ea219fe65d421006734fe04661f75e69ae825120b33fb74293e3b83e7f7f563b475cd6e08fd6878ee424fa141d3aee86d952c212c2e7730796510a463a8da486852b23a1d62b714a11301499029d9efb715a11b64f24cd2660c9a47573ce4dd042e333e433ee28b2bce545cf067040193057de290965c1d547fed137e5eb22f5c0a06ad4de6b78204bf053f37c5d96b8053ea445b640360da8fce3391514dc3d1f4e4b35047138cd8c2717bcba278a4f8c27bac01b469ee3fd04004f58287a18307b0ad4120f2c26b08c3267249bfbe1064a3f171e0cfe595f7ab146f3148c73228edf694dc0c400c36e3493b1aca5f85972dadb8d02bddb607b7a431750ca4863812b8020000000000000042db2971e280541cbfa446c6c6d85b77e3327a2d327c25b7619647374e76b1be266cb68959d2651d0c7438cb1b53982191858c66500d8536013701194a9f02dd77216f932e07a4c4b4558b2a38d7e5c39a453c8fb5fae0d00550a2d143f721cd676d842f2ae39ecbf99e027b4cf9f3c2a9bf3b663e51a0b29cf4cfb0877d5b89fdfa93fd9bf33392e6a2c8df36f9f2faa3716d293b7d94c93458c17df99aaadd218fe4c7b967b43f48725e6bac67bf9176e8c63f94862b036b1870bc314b51fea9d0c92020427abaf5be10d3faad2f684d46a2461f2a92350d6f204f03ad2a9fa54cbd8a7a3e7ba2d54f3615ac5ea47f120572f8ef941e81b0812bfc4227ef5719093afbf90040ef1a5eda64563eb7fd015ea54342340ec8648d911a8f3f358ca124ef8c70685bce2fbaeeebf54d059cefd53751b5cf33fe2d92c9df6a63821b6db5188210565e132768b192fb27e745605c529e3648060a98d656f35e36dc4be3102bd678db0ceb0301c5cb0f7f7a08c55cd038a5f751a7c96116f0bd9c9a349558a7a8fc6a73cce1132549169822bf32d742fc4f4e2e50f59eb669f2384282247c60253edc98f9bc802a288a94e1011a066ce9f6eca5f87d2afd893900c3aff87be959451269bc9ac735c43c1e5ecf5d5bff262a27f0c8a1ad401492ffec662e27b12399096fee9910d0fadfd1e1bcf1f20f8f7e5ff1cce9e8db0fd71dda6f228aa96bba6b4120361a6f6acc832be5daa1aabd03a9ae810f0d21466c1a652a47c11db6a8e52580a8347326113b54a4beeaeb21b45e5ef0aa3cfbfb22d99640b7b935bce8e37cebce586f7fe72208b491795a9fbb220ec9b98dd7811ced86292189ce351e8a64c6afde9c1dccbaaebf7e5e3d5e529e926e814b381342c13ea0757ce52a0b0a155d1c85c4108deffa719a22bef7b681a17504e22d6fe9197699e0a16a7104f412e3a681c8ee41d8fbddc8610c161f1fad9e4a5e526e20ac61496e9f3596cc94b79e9680a64a832dc26d6e33e127abe5c405b16978bc4297a85ccaf1599b195db9d66b698c770d84fa90d89b51eca02ed3a3465b8eca9589af034bd6b9c8f6329e393e4753887696ae5158e8ca3ef2e66fac38a6d6a1b61e81d5b6a3c1cb007d64a33f1fe01cf39b82b270e9083ce13b1a32f0c98376d43cdbf9f17b74655f3000343fe051a75ac658a84629b1245107652d6dfa54b1a7d77922becb74539ffb11292794f12ebfd3ea8888c7cd10692d52c85340f92c5d01464fe36deaaec6ad6cc22870372d61485e2d76accd9bf93e0842efe5652e73100a6627b3a4ce4d1594c8ddb5742897d05fd6f6333fa1b90afeaab9fc7426251d24deeef43784f12c0bb09f102962ee9ab427a53fd8da8e1e3c8000ac7164e61d6258c515dcdd911fb1a519d7b38e556457da330ceda8e948aeaf7421d37faf50071f0d38c08fc938278f247084195e778ac90ab7bfafb59c2a1c643cd18d883a46a6cc41410f505ba209746d6b12c015eddf31b6c9ebf2f04605518033721cdf02b1da210ca1465129b443c0c46247b5f8cceb000af2c551fcea1c1bef29c5859e95bcf0956b9092279b47dc652134d2bc54c3688978fd4d7c203749da5e4824fe314aa57e76f58fadfafcc7660b68b1a6043acf8f9f0c259d16fe236b5906f88816e7ab69b67f762ad79a5f654c507cc49be181525ff05cde4d56b53790151efa8060c4685e2b1dd0ad89551a41e0d3dda33c2b528922849a8dfcd7246c242c3b2aa38a69e3e5a37c5806c4bcff53e08ffc7a830d925e3394b688ffffffffcbfe387c9e7df19cfb2b54303c101557aa2ed080194fe0af76d672ed77dfa4c5c0c0f9693f4e8c446d3bc19c0a8654bb4ba8b4daae69edf414615473ec2aadaa6871b7d08a51e349acc7b16fddf741f71670da4c2b0eadcf19f46f0fd18b59ecf7b943a2a5c90125638a3b3270a366c074868e62fe2e8751ff3e60411d7e1b3fb6a873f7843489f661f1bc401765cdfacbd76e1b52e15fb10fc19dc4803d3a4743ab977fae35eed00d59ddf64fcbc61f5fa0cf4098d0babde4a397d2ef100c23ca9f836656d5f25b018606e148e3f66400a682472ed5d28b7de624ed838277432623c11027da18378e46c3fd340585b4835ab1d771266322eee56c3e6bf3300f5d48b6b01f515ba7f3fb726cfc6fdf6c07a2f46bbc3f36fc9ba6e551a46335337c881cc4a73e79e76638411adcaa81ee3b6d0e6e6c721da36dcab68bfb0ca6ba7b2c267b80120143a5c4be333b2cf85b3bd2425ca691ff367d130dbbd8e5f6a833e093eae9d176c1c3fb61557f9e5080ee7703fe2ca1061b52d0a40d7ee2f408b3ceac303e302d96d929c17026793c66423d748a81adfd7cb29027f327b0dac4055e88e385f0400f97988aa1fa40cdf776f9f07991fb55d9d4bf62ebefced240d821bd4fbba62c1b62320228c6a4ca613878e3eb538eea28e92b5d909fc7e63ed5a544e7698d0b7d3d99415d4028a5da4cc67fcba3b744acd4f92938027f42b785405228a38d85fd678703b9d41a6a54cd48303a6be64408101fc5471641c1c5a747244da684fef97aa48bf1a225007f26d9f4002a0dc14d01191ef1d749ea2ea05c42c173c3244c1039c04341b0cf37574d8b78e357b451bfcfb79762ed6a4fbc689690bf37afaa92702a0349ed9aecd9111df9fd57b97749bbf5003991029344497c9ff85adaa7a2e566647ba5bad341eed62034b581981dd7c9de9fd4c241a54ad4d6e9e1cf7ca984b13c628cc65eca0829e69d4d390581e43cd2ed5c56608b45c109f35350fb875316e71f79c433319462d4b589a1f7f2d14d43092655da23d63c63298ed62dd481ab0bc58e97f397b39c94b32fad6a1e0cd9da2dfbe6897ee4986fdbafdb0e4b575f800df5da43cf318ea7a5e83a0136b3bde3296b2bd230ed212f79500c6a4458522c3881532b7bfd170647ee65931760f35a1c1f95b8c93e4233f0de2a13c83f31522f2bee05a57c8378ac6bdd3c9e30dc188b30dadb936f35a3fa247732ebae6a8d762992f8a96c1d26981bda157f2b676ac9d61bb786ac8c349da94dbf75a21b786cdceb47a92597b6d2b22f7dc1187cdb4681ce9bebd69977bab9eabf2a68c1d3b3463d6c7f1392e12a17deb97f2ce5c9ef4021d3b4e0df6b3f4b693e136e3931837e91617cd85846f3019a74d2d65f36369e73a461753631d72f9e2834c446ae7e173d6b1935adc0ce65eb0eac830d442a0344f2cbaedf8d48cb0a6959d07f208fbb2dae434f4fdf35b265fbdbde4138b455b7941096d55808de601ddd8a41a70b12968862d0b4086d4ff55152aee65eaa761a9588bb25bce193b4e55ebb183807f118bff0ccbd85ea761e7c3b6cccb64f97b3f1bf7a96eecc7ab40e770a1620209b50ba23aab0f769a16c9b8092326987f0cd1de94b911ea6bef5cf15a93829b7cbf03aa85ef577633e058f81e9653fc47d15ab8bead567ed2affbbf5a470302c065086324dc304c777228050ea9f717e45b6676fc9002ccd0428fcb27d839e4139fb17d4ee72e2fe8394e5de0cc814d92663f8c5f87e131a34ef7094078be0cf54763c82004af9727c7972ff1ea6162b279beea87bc2741e996d14f549d0474aabe780c5b80a35eed311cb734c23d01c160e439662c813126747c7d09068e32fa72605d71abc2a332cb59d81071818d5e0944194285f4cfc050392e505dd93c8c882f46fb6b70b4660784d543a6bf34653487840fdc298c8280241174805bf3cf38083224d213cd6076beac135ed3f010000800000000047750cb0f4d2be6beada1c481a0152d80c0b520d2f090455494c83ba78eb91e6558d52ceceb23c956bb382bb280e6382d2cb679eecd2bcfb6107e2e4f568f1be293eaa0d2ebb77169b103d5fe74d745cf082c36022108b4c430a87fa8535f1c56d0c1d5dae50c549b1b08911e2d2619eef61131c7804b35c3ca4dac1f2595c68941b013b5ded8bfd52ed41da13c0886b7f9c61a5244a815711253aad7ea74eae788b1beea9bc15addb199d2fc79e81a34b887a0e4b935ad154e961c8b6972f124cae7742e82db1e714af15f34908960dbb4ea24e44ffd750c9d11dd45bfaae73028bc88fddf74b2d24de205980ba14f4889119f8a6291b3724497503ddf95222d5d050414e487a3dc65e5eda3169e10570a50440be346cc1f1b0c848410b46610c738636707c5d740a8e3a9b688c2c1ea54135bffd2ffd87d9dfa902f3dd97b2a6078fa65f5a5f95da2b9f6124fe07682e27ab65ab96573e762f5060439e18649798e0b9d7864f91dbc4f4ed3a4ab30671f8f7f3c49c7ac504a755f9420fd9b22421afd7203f7cd6dd8c8e7a33709e12d004e402672af2b3f9046bc57854f98482538ad48723cd153cf03103c157cdb1a63e839a02c3f0041d7020280f96f3f7e0ce89c408be10d344540808dee1bfcb01f5293ab606c71ffc09f9e63b93b37e8d8007ad8432d2e81c3d1d40a57711bdb798ee91a3f05f93f4f46f883db0613bf95fabd523d955d0d4a5518e1bb3dae7646af8af8d4a4d7dcfac633c6efa3164f9e05bbb4b05947ac0e6c4edd99a768eda4c7149cf38a460b522d6405aa47fada1c78f56fbd33669719b1496427f290532334b69d0a7cf6c46cefe5ecd0fd923b14929fd3db8a1a94ba63954b58ceb9b1e0f8471a02c13a160aa763083a5fd36c199075a769768e164f17911f5a416bb96198aa0954a7d27e30c480691ce80dc71a49100", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r1, 0x7, {0x2a00, 0x80010000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab780ef39fa3910d96072000001ea800000000fdffffff0000faffffffffffffff00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac000000000000000000000000001700", "90be8bf4bd00000000000000000000000000001000", [0x4]}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x4, &(0x7f0000000180)=ANY=[@ANYRES8=r1], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x17fe, @void, @value}, 0x94) r8 = creat(&(0x7f00000001c0)='./file0\x00', 0x10) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000280)={{0x1, 0x1, 0x18, r8, {0x3}}, './file0\x00'}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000002400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000e00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000100)={0x4004, r10, 0x2}) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0xffffffffffffff1e, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x16, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r11}, 0x10) 4.682185715s ago: executing program 2 (id=521): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000380), 0x4) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f0000000280)={0x9, {0x6, 0x9, 0x8}}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) flistxattr(r4, 0x0, 0x0) 4.622812914s ago: executing program 3 (id=522): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) io_uring_setup(0x1581, 0x0) prlimit64(0x0, 0x3, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) msgsnd(0x0, &(0x7f0000000080)=ANY=[], 0x8, 0x0) msgrcv(0x0, &(0x7f0000000280)={0x0, ""/55}, 0x3f, 0x0, 0x86b1b18158a7cb82) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x1c3302) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000000)={0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r4, &(0x7f00000000c0)={0x0, 0xc, 0x1}) bind$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @any, 0x4}, 0xe) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000700000061220000020000000000fc00", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r1, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r6, 0x0, 0x0}, 0x20) syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') fsopen(&(0x7f0000000040)='afs\x00', 0x0) 3.545535817s ago: executing program 3 (id=523): openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x201, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$UFFDIO_COPY(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000548000/0x1000)=nil, &(0x7f0000fee000/0x11000)=nil, 0x1000}) 3.433058956s ago: executing program 2 (id=524): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x10, 0x3, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x4400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x123a67) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r1, 0x40184150, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000380), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) socket$inet_udp(0x2, 0x2, 0x0) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x0, 0x1, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x7f, 0x800000, 0x3, 0x7, 0xc3ad, 0x4}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x40, 0x2, 0xd, 0x0, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x7, 0x0, 0x5, 0x7}, 0x0, 0x0) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x80200, 0x43, 0x10}, 0x18) sendfile(r5, r2, &(0x7f0000000100)=0x6, 0x5) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x4, &(0x7f0000000080)=ANY=[@ANYRES8=r3], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000b00)=0x6) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000140)=0xef) fsetxattr$security_ima(r6, &(0x7f00000024c0), &(0x7f0000002500)=ANY=[@ANYBLOB="b92b02fa40778309e4ecbedbf787318b"], 0x10, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000000480)={0x2020}, 0x2020) 3.368386004s ago: executing program 3 (id=525): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet(0x2, 0x1, 0x100) r5 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000280)="dee7030022cf5c6c7bc31bd2599759fafa9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976edec860ab49c3a4f51ab0124b50c3362201a307df03000", 0x83, r5) keyctl$search(0xa, r5, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1, 0x2e}, 0xffffffffffffffff) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) sendto$inet(r4, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66", 0x4c, 0x11, 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB='+cpu'], 0x5) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000500)=ANY=[@ANYBLOB='-cpu'], 0x5) socket$nl_generic(0x10, 0x3, 0x10) 3.153721023s ago: executing program 4 (id=526): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000400000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r3], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x300, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xe, 0x9}, {0xfff1, 0x5}, {0x3, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0xffffffff00000000) 2.618189761s ago: executing program 0 (id=527): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}}, 0x0) recvmmsg$unix(r0, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1004}], 0x1}, 0x5865}], 0x8, 0x34000, 0x0) 2.536466993s ago: executing program 2 (id=528): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x4, &(0x7f00000000c0)=[{0x48}, {0x28, 0x0, 0x0, 0x1000000}, {0x6}, {0x9, 0xff, 0xc, 0x5}]}, 0x10) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="c67effa3", @ANYRES16=r2, @ANYBLOB="01012cbd7000ffdbdf252b00000008000300", @ANYRES32=r3, @ANYBLOB="05003400c400000004000801"], 0x30}, 0x1, 0x0, 0x0, 0x200000d0}, 0x40000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000240)="04", 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @empty}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x2}, 0xc) sched_setscheduler(0x0, 0x3, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) r6 = socket$inet(0x2, 0x0, 0x6) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000480)) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) preadv(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f00000008c0)=""/201, 0xc9}], 0x1, 0x0, 0x0) listen(r6, 0x3) socket$inet(0x2, 0x80001, 0x84) syz_usb_connect(0x1, 0x3d, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000010000811000000000000000850000004f00000095000000d553932c01cd9d9bd971080ba291d200000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000140)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x1000, 0x3a, '\xf4\xb5\xb2\xed\xc6;\xc7,4\\xev/bus/us\xae\xd1\x93\xc1\bm\xe9\xf3#\x00:\xbem\x02H;\x90\xa5\x1f\x8d\xc6\xae\xcc\x95a7\xc3\x168%\xc3\xc6\n\x8d\xbc\x81\x1a\x80\x16jY\x9f~\x12\x94]\x1e\x8c\x1d\xe7\xfe\"y\xa6O\xf5\xa2\xb6\xe7\xe3]%)l\x90\xe9\x026\xe4\xabX\xa0+\x86\nB&\xab\xef\xea\xa3\tUc\xc3\xad\x84\xa3vK{\xb2\xa3\xfc\x1f', 0x3a, '/dev/bus/usb/00#/00#\x00', 0x3a, './file0'}, 0xaf) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1400) 2.453128049s ago: executing program 0 (id=529): socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dri(&(0x7f0000000100), 0x1ff, 0x430000) userfaultfd(0x80000) r0 = socket(0x11, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x2000000) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') preadv(r2, &(0x7f0000000140)=[{&(0x7f0000000000)=""/151, 0x97}], 0x1, 0xd, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001200010a001800000000000080"], 0x14}}, 0x0) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000140), 0x15) 86.654575ms ago: executing program 3 (id=530): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000580)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x400000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000240)={0x0, &(0x7f00000000c0)}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f00000003c0)=""/76) r3 = dup(r2) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000}) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) socket(0xa, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$KVM_RUN(r4, 0xae80, 0x0) 0s ago: executing program 0 (id=531): r0 = accept(0xffffffffffffffff, &(0x7f0000000180)=@rc, &(0x7f0000000200)=0x80) close(r0) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) r2 = fsmount(r1, 0x1, 0x0) (async) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r4 = socket(0x2b, 0x1, 0x1) ioctl$VFAT_IOCTL_READDIR_SHORT(r4, 0x541b, 0x0) (async) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000400)={@broadcast, @multicast2, 0xffffffffffffffff, "254b40ed328a65c3998f3238e1c5b3a98f18c11426ca3e57984c6301d6ad830d", 0xb00, 0xfffffff8, 0x7fff, 0x80000001}, 0x3c) (async) r5 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x3) (async) r6 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000080)={r2, 0xffffffff, 0x0, 0x20cf02d131bc822d}) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x13, r6, 0x0) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000002940)={@cgroup, 0xffffffffffffffff, 0x34, 0x0, 0x0, @void, @value}, 0x20) (async) creat(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000040)={0x2, 0x1, 0x0, 0xfdfdffff, 0x4}) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r7, 0x0) (async) r8 = socket$inet_smc(0x2b, 0x1, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='statm\x00') (async) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x40, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x3, 0x8000, 0xfffffff9, 0x8000, r9, 0xfffffffc, '\x00', 0x0, r10, 0x2, 0x5, 0x2, 0x0, @value=r7, @void, @void, @value}, 0x50) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000240)={'filter\x00', 0xb001, 0x4, 0x3a8, 0x0, 0x1d0, 0x0, 0x2c0, 0x2c0, 0x2c0, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d0}}, {{@uncond, 0xc0, 0xe8, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x3f8) (async) ioctl$CEC_TRANSMIT(r7, 0xc0386105, &(0x7f0000000140)={0x101, 0xd53, 0xfffffff8, 0x3, 0x2, 0x2, "14176480faaf5302a1c3ab7e42fddfe5", 0x1, 0x4, 0x0, 0x0, 0x4, 0x5, 0x3}) kernel console output (not intermixed with test programs): { setopt } for pid=6204 comm="syz.3.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 87.272051][ T6207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.81'. [ 87.571726][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 87.600427][ T6171] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.623216][ T30] audit: type=1400 audit(1744862089.025:231): avc: denied { write } for pid=6204 comm="syz.3.80" name="ip_mr_vif" dev="proc" ino=4026533270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 87.659396][ T30] audit: type=1400 audit(1744862089.035:232): avc: denied { create } for pid=6204 comm="syz.3.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 87.687826][ T5813] udevd[5813]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 88.043876][ T30] audit: type=1400 audit(1744862089.075:233): avc: denied { write } for pid=6204 comm="syz.3.80" name="001" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 88.090316][ T30] audit: type=1400 audit(1744862089.805:234): avc: denied { read write } for pid=6213 comm="syz.1.84" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 88.095771][ T6215] fuse: Bad value for 'fd' [ 88.141527][ T30] audit: type=1400 audit(1744862089.805:235): avc: denied { open } for pid=6213 comm="syz.1.84" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 88.370019][ T6171] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.374814][ T6171] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.377885][ T30] audit: type=1400 audit(1744862089.825:236): avc: denied { mounton } for pid=6213 comm="syz.1.84" path="/13/file0" dev="tmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 88.377932][ T30] audit: type=1400 audit(1744862089.905:237): avc: denied { create } for pid=6213 comm="syz.1.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 88.823164][ T6171] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.851358][ T6171] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.118490][ T30] audit: type=1400 audit(1744862090.835:238): avc: denied { connect } for pid=6231 comm="syz.2.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 91.175956][ T5831] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 91.376886][ T5831] usb 1-1: too many configurations: 72, using maximum allowed: 8 [ 91.431503][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 91.431517][ T30] audit: type=1400 audit(1744862093.165:243): avc: denied { create } for pid=6266 comm="syz.4.98" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 91.479073][ T5831] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 91.495009][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.506908][ T30] audit: type=1326 audit(1744862093.205:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 91.538690][ T5831] usb 1-1: Product: syz [ 91.543070][ T5831] usb 1-1: Manufacturer: syz [ 91.572283][ T5831] usb 1-1: SerialNumber: syz [ 91.645952][ T30] audit: type=1326 audit(1744862093.205:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 91.669132][ C0] vkms_vblank_simulate: vblank timer overrun [ 91.951584][ T5831] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 92.027386][ T30] audit: type=1326 audit(1744862093.205:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 92.050815][ T30] audit: type=1326 audit(1744862093.205:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 92.073920][ C0] vkms_vblank_simulate: vblank timer overrun [ 92.081435][ T30] audit: type=1326 audit(1744862093.205:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 92.104521][ C0] vkms_vblank_simulate: vblank timer overrun [ 92.145481][ T30] audit: type=1326 audit(1744862093.205:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 92.178381][ T30] audit: type=1326 audit(1744862093.205:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 92.863714][ T9] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 92.969272][ T30] audit: type=1326 audit(1744862093.205:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 93.046190][ T30] audit: type=1326 audit(1744862093.205:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6267 comm="syz.3.97" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f983ad8e169 code=0x7ffc0000 [ 93.069343][ C0] vkms_vblank_simulate: vblank timer overrun [ 93.401276][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 93.555597][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 93.616627][ T10] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 97.426947][ T9] usb 1-1: Service connection timeout for: 256 [ 97.426966][ T34] sched: DL replenish lagged too much [ 97.465153][ T10] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 97.488047][ T9] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 98.306948][ T5831] usb 1-1: USB disconnect, device number 5 [ 98.312830][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 98.740104][ T9] ath9k_htc: Failed to initialize the device [ 98.746715][ T10] usb 3-1: config 1 has no interface number 0 [ 98.753484][ T10] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 98.764688][ T10] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 98.782206][ T5831] usb 1-1: ath9k_htc: USB layer deinitialized [ 98.792728][ T10] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 98.802334][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.847521][ T10] usb 3-1: can't set config #1, error -71 [ 98.880837][ T10] usb 3-1: USB disconnect, device number 3 [ 99.527465][ T10] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 99.784162][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 99.784237][ T30] audit: type=1400 audit(1744862101.485:310): avc: denied { create } for pid=6321 comm="syz.0.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 99.818258][ T6325] ptrace attach of "./syz-executor exec"[5828] was attempted by "./syz-executor exec"[6325] [ 100.026730][ T6326] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 100.090929][ T30] audit: type=1400 audit(1744862101.595:311): avc: denied { map } for pid=6321 comm="syz.0.109" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 100.116497][ T30] audit: type=1400 audit(1744862101.605:312): avc: denied { execute } for pid=6321 comm="syz.0.109" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 100.140118][ C0] vkms_vblank_simulate: vblank timer overrun [ 100.157581][ T10] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 100.165901][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.180503][ T10] usb 3-1: config 0 has no interface number 0 [ 100.190772][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 100.205765][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.214155][ T10] usb 3-1: Product: syz [ 100.223351][ T10] usb 3-1: Manufacturer: syz [ 100.370695][ T10] usb 3-1: SerialNumber: syz [ 100.553906][ T10] usb 3-1: config 0 descriptor?? [ 100.581765][ T10] hub 3-1:0.31: bad descriptor, ignoring hub [ 100.607923][ T10] hub 3-1:0.31: probe with driver hub failed with error -5 [ 100.642336][ T10] usb 3-1: Found UVC 0.04 device syz (046d:08c3) [ 100.758506][ T30] audit: type=1400 audit(1744862102.495:313): avc: denied { create } for pid=6332 comm="syz.3.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 100.796482][ T10] uvcvideo 3-1:0.31: Entity type for entity Output 6 was not initialized! [ 101.241943][ T10] usb 3-1: Failed to create links for entity 6 [ 101.248174][ T10] usb 3-1: Failed to register entities (-22). [ 101.255166][ T30] audit: type=1400 audit(1744862102.495:314): avc: denied { read write } for pid=6332 comm="syz.3.111" dev="sockfs" ino=9131 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 101.296750][ T10] usb 3-1: USB disconnect, device number 4 [ 101.349312][ T6338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.113'. [ 101.357984][ T30] audit: type=1400 audit(1744862103.085:315): avc: denied { write } for pid=6336 comm="syz.0.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.456907][ T30] audit: type=1400 audit(1744862103.085:316): avc: denied { nlmsg_write } for pid=6336 comm="syz.0.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.692803][ T6346] netlink: 20 bytes leftover after parsing attributes in process `syz.1.114'. [ 101.923097][ T972] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 102.156758][ T972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.173975][ T972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.184248][ T972] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 102.645549][ T972] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.664947][ T972] usb 1-1: config 0 descriptor?? [ 102.799473][ T30] audit: type=1400 audit(1744862104.535:317): avc: denied { rename } for pid=5179 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 102.821681][ C0] vkms_vblank_simulate: vblank timer overrun [ 102.915331][ T6358] tmpfs: Unknown parameter 'quo' [ 103.348787][ T6345] netlink: 12 bytes leftover after parsing attributes in process `syz.0.115'. [ 103.381532][ T30] audit: type=1400 audit(1744862104.535:318): avc: denied { unlink } for pid=5179 comm="syslogd" name="messages.0" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 103.403892][ C0] vkms_vblank_simulate: vblank timer overrun [ 103.437867][ T30] audit: type=1400 audit(1744862104.535:319): avc: denied { create } for pid=5179 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 103.630509][ T972] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 104.080113][ T6367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.088647][ T6367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.150511][ T6367] netlink: 'syz.0.115': attribute type 1 has an invalid length. [ 104.158185][ T6367] netlink: 'syz.0.115': attribute type 2 has an invalid length. [ 104.167285][ T6367] netlink: 20 bytes leftover after parsing attributes in process `syz.0.115'. [ 104.177626][ T6367] netlink: 'syz.0.115': attribute type 1 has an invalid length. [ 104.185269][ T6367] netlink: 'syz.0.115': attribute type 2 has an invalid length. [ 104.192969][ T6367] netlink: 20 bytes leftover after parsing attributes in process `syz.0.115'. [ 104.210400][ T972] arvo 0003:1E7D:30D4.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.0-1/input0 [ 104.766876][ T5871] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 105.013016][ T6375] netlink: 80 bytes leftover after parsing attributes in process `syz.2.122'. [ 105.034989][ T6375] netlink: 80 bytes leftover after parsing attributes in process `syz.2.122'. [ 105.101735][ T5871] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= b.00 [ 105.122958][ T5871] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.147700][ T5871] usb 2-1: Product: syz [ 105.161176][ T5871] usb 2-1: Manufacturer: syz [ 105.180235][ T5871] usb 2-1: SerialNumber: syz [ 105.197043][ T5871] usb 2-1: config 0 descriptor?? [ 105.841354][ T24] usb 1-1: USB disconnect, device number 6 [ 106.429884][ T5871] usb 2-1: USB disconnect, device number 5 [ 107.579532][ T6405] tmpfs: Unknown parameter 'quo' [ 108.858132][ T30] audit: type=1400 audit(1744862110.575:320): avc: denied { search } for pid=6416 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.949731][ T30] audit: type=1400 audit(1744862110.585:321): avc: denied { read } for pid=6419 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1708 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.972655][ C0] vkms_vblank_simulate: vblank timer overrun [ 109.033423][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 109.073002][ T30] audit: type=1400 audit(1744862110.595:322): avc: denied { open } for pid=6419 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1708 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.105634][ T30] audit: type=1400 audit(1744862110.595:323): avc: denied { getattr } for pid=6419 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1708 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.207684][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 109.230247][ T6427] bridge0: port 3(team0) entered blocking state [ 109.236462][ T9] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 109.236631][ T6427] bridge0: port 3(team0) entered disabled state [ 109.244696][ T9] usb 1-1: config 0 has no interface number 0 [ 109.250996][ T6427] team0: entered allmulticast mode [ 109.262230][ T6427] team_slave_0: entered allmulticast mode [ 109.268099][ T6427] team_slave_1: entered allmulticast mode [ 109.280314][ T6427] team0: entered promiscuous mode [ 109.286221][ T6427] team_slave_0: entered promiscuous mode [ 109.293591][ T6427] team_slave_1: entered promiscuous mode [ 109.304661][ T6427] bridge0: port 3(team0) entered blocking state [ 109.310939][ T6427] bridge0: port 3(team0) entered forwarding state [ 109.322236][ T30] audit: type=1400 audit(1744862110.595:324): avc: denied { getattr } for pid=6419 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1748 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 109.367697][ T30] audit: type=1400 audit(1744862110.635:325): avc: denied { write } for pid=6389 comm="syz.2.128" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 109.429189][ T30] audit: type=1400 audit(1744862110.805:326): avc: denied { read } for pid=6421 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=1748 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 109.455473][ T30] audit: type=1400 audit(1744862110.805:327): avc: denied { open } for pid=6421 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1748 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 109.668914][ T9] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 109.678104][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.695500][ T6413] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 109.698281][ T9] usb 1-1: Product: syz [ 109.715768][ T6413] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 109.765081][ T9] usb 1-1: Manufacturer: syz [ 109.798137][ T9] usb 1-1: SerialNumber: syz [ 109.829045][ T6413] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 109.834951][ T6413] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 109.850744][ T9] usb 1-1: config 0 descriptor?? [ 109.867607][ T9] smsc95xx v2.0.0 [ 109.951240][ T6413] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 109.959650][ T30] audit: type=1400 audit(1744862111.665:328): avc: denied { write } for pid=6416 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1707 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.985544][ T6413] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 110.003291][ T30] audit: type=1400 audit(1744862111.665:329): avc: denied { add_name } for pid=6416 comm="dhcpcd-run-hook" name="resolv.conf.lapb4.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.977859][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 110.995461][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 111.030691][ T6451] netlink: 56 bytes leftover after parsing attributes in process `syz.4.140'. [ 111.050937][ T6413] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 111.075715][ T6413] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 111.107585][ T6413] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 111.113519][ T6413] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 111.519219][ T6465] capability: warning: `syz.4.143' uses deprecated v2 capabilities in a way that may be insecure [ 112.156465][ T6486] syzkaller0: create flow: hash 803695510 index 1 [ 112.328446][ T6485] netlink: 12 bytes leftover after parsing attributes in process `syz.4.143'. [ 112.338227][ T6466] sctp: [Deprecated]: syz.4.143 (pid 6466) Use of int in max_burst socket option deprecated. [ 112.338227][ T6466] Use struct sctp_assoc_value instead [ 112.374544][ T6485] netlink: 12 bytes leftover after parsing attributes in process `syz.4.143'. [ 112.474480][ T6479] syzkaller0: delete flow: hash 803695510 index 1 [ 113.160067][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000006c: -71 [ 113.186727][ T9] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 113.209971][ T9] usb 1-1: USB disconnect, device number 7 [ 113.426436][ T24] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 113.594082][ T24] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 113.613746][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 113.639463][ T24] usb 3-1: config 0 has no interface number 0 [ 113.658226][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 113.675617][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.705496][ T24] usb 3-1: Product: syz [ 113.709831][ T24] usb 3-1: Manufacturer: syz [ 113.730012][ T24] usb 3-1: SerialNumber: syz [ 113.770124][ T24] usb 3-1: config 0 descriptor?? [ 113.783725][ T24] hub 3-1:0.31: bad descriptor, ignoring hub [ 113.792692][ T24] hub 3-1:0.31: probe with driver hub failed with error -5 [ 113.807177][ T24] usb 3-1: Found UVC 0.04 device syz (046d:08c3) [ 113.830006][ T24] uvcvideo 3-1:0.31: Entity type for entity Output 6 was not initialized! [ 113.842015][ T24] usb 3-1: Failed to create links for entity 6 [ 113.851217][ T24] usb 3-1: Failed to register entities (-22). [ 114.145882][ T24] usb 3-1: USB disconnect, device number 5 [ 114.770769][ T6543] tmpfs: Unknown parameter 'quot' [ 115.707788][ T6557] netlink: 'syz.2.155': attribute type 10 has an invalid length. [ 115.734471][ T6557] batman_adv: batadv0: Adding interface: team0 [ 115.740797][ T6557] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 115.766060][ T6557] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 116.661443][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 116.661457][ T30] audit: type=1400 audit(1744862118.395:339): avc: denied { unmount } for pid=5820 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 117.030168][ T6593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.055560][ T30] audit: type=1400 audit(1744862118.775:340): avc: denied { sys_module } for pid=6581 comm="syz.1.160" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 117.107094][ T30] audit: type=1400 audit(1744862118.825:341): avc: denied { bind } for pid=6582 comm="syz.2.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 117.125639][ T6593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.155449][ T30] audit: type=1400 audit(1744862118.825:342): avc: denied { name_bind } for pid=6582 comm="syz.2.161" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 117.212161][ T30] audit: type=1400 audit(1744862118.825:343): avc: denied { node_bind } for pid=6582 comm="syz.2.161" saddr=fe88::103 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 117.234143][ C0] vkms_vblank_simulate: vblank timer overrun [ 117.257922][ T10] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 117.340050][ T30] audit: type=1400 audit(1744862118.865:344): avc: denied { ioctl } for pid=6591 comm="syz.4.162" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 117.415476][ T10] usb 5-1: device descriptor read/64, error -71 [ 117.805247][ T6617] tmpfs: Unknown parameter 'quot' [ 118.560285][ T30] audit: type=1400 audit(1744862120.285:345): avc: denied { read } for pid=6628 comm="syz.4.171" name="ocfs2_control" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 119.054088][ T30] audit: type=1400 audit(1744862120.285:346): avc: denied { open } for pid=6628 comm="syz.4.171" path="/dev/ocfs2_control" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 120.369051][ T6643] netlink: 8 bytes leftover after parsing attributes in process `syz.4.172'. [ 120.378888][ T6643] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 120.389402][ T6643] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 120.398031][ T30] audit: type=1400 audit(1744862122.125:347): avc: denied { firmware_load } for pid=6642 comm="syz.4.172" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 120.663958][ T30] audit: type=1400 audit(1744862122.175:348): avc: denied { create } for pid=6640 comm="syz.2.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 121.421699][ T6661] veth0_vlan: entered allmulticast mode [ 121.429030][ T6663] netlink: 'syz.0.164': attribute type 1 has an invalid length. [ 121.526507][ T6666] veth0_vlan: left promiscuous mode [ 121.532421][ T6666] veth0_vlan: entered promiscuous mode [ 121.800671][ T6671] tmpfs: Unknown parameter 'quot' [ 123.199199][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 123.199199][ T6678] ======================================================= [ 123.199199][ T6678] WARNING: The mand mount option has been deprecated and [ 123.199199][ T6678] and is ignored by this kernel. Remove the mand [ 123.199199][ T6678] option from the mount to silence this warning. [ 123.199199][ T6678] ======================================================= [ 123.199212][ T30] audit: type=1400 audit(1744862124.935:353): avc: denied { mounton } for pid=6677 comm="syz.4.182" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 123.240245][ T6678] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 123.241812][ T6678] VFS: Can't find a romfs filesystem on dev nullb0. [ 123.241812][ T6678] [ 123.822593][ T6684] netlink: 'syz.1.183': attribute type 10 has an invalid length. [ 123.955480][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 123.970004][ T6689] FAULT_INJECTION: forcing a failure. [ 123.970004][ T6689] name failslab, interval 1, probability 0, space 0, times 1 [ 123.988160][ T6689] CPU: 1 UID: 0 PID: 6689 Comm: syz.3.186 Not tainted 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 PREEMPT(full) [ 123.988183][ T6689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 123.988193][ T6689] Call Trace: [ 123.988198][ T6689] [ 123.988205][ T6689] dump_stack_lvl+0x16c/0x1f0 [ 123.988232][ T6689] should_fail_ex+0x512/0x640 [ 123.988250][ T6689] ? fs_reclaim_acquire+0xae/0x150 [ 123.988275][ T6689] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 123.988299][ T6689] should_failslab+0xc2/0x120 [ 123.988318][ T6689] __kmalloc_noprof+0xd2/0x510 [ 123.988341][ T6689] tomoyo_realpath_from_path+0xc2/0x6e0 [ 123.988367][ T6689] ? tomoyo_profile+0x47/0x60 [ 123.988385][ T6689] tomoyo_path_number_perm+0x245/0x580 [ 123.988404][ T6689] ? tomoyo_path_number_perm+0x237/0x580 [ 123.988426][ T6689] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 123.988448][ T6689] ? find_held_lock+0x2b/0x80 [ 123.988491][ T6689] ? find_held_lock+0x2b/0x80 [ 123.988511][ T6689] ? hook_file_ioctl_common+0x145/0x410 [ 123.988538][ T6689] ? __fget_files+0x20e/0x3c0 [ 123.988560][ T6689] security_file_ioctl+0x9b/0x240 [ 123.988585][ T6689] __x64_sys_ioctl+0xb7/0x200 [ 123.988610][ T6689] do_syscall_64+0xcd/0x260 [ 123.988635][ T6689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.988651][ T6689] RIP: 0033:0x7f983ad8e169 [ 123.988664][ T6689] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 123.988678][ T6689] RSP: 002b:00007f983bb4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 123.988695][ T6689] RAX: ffffffffffffffda RBX: 00007f983afb5fa0 RCX: 00007f983ad8e169 [ 123.988706][ T6689] RDX: 00002000000002c0 RSI: 00000000c0405602 RDI: 0000000000000003 [ 123.988715][ T6689] RBP: 00007f983bb4a090 R08: 0000000000000000 R09: 0000000000000000 [ 123.988725][ T6689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.988734][ T6689] R13: 0000000000000000 R14: 00007f983afb5fa0 R15: 00007ffe4a465ee8 [ 123.988757][ T6689] [ 123.988763][ T6689] ERROR: Out of memory at tomoyo_realpath_from_path. [ 124.146781][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 124.361383][ T10] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 124.370711][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.384081][ T30] audit: type=1400 audit(1744862126.115:354): avc: denied { append } for pid=6693 comm="syz.1.188" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 124.437667][ T10] usb 3-1: Product: syz [ 124.452143][ T10] usb 3-1: Manufacturer: syz [ 124.462221][ T10] usb 3-1: SerialNumber: syz [ 124.493026][ T10] usb 3-1: config 0 descriptor?? [ 124.569022][ T30] audit: type=1400 audit(1744862126.305:355): avc: denied { setopt } for pid=6698 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 124.793913][ T30] audit: type=1400 audit(1744862126.305:356): avc: denied { bind } for pid=6698 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 124.813184][ T10] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 124.995331][ T30] audit: type=1400 audit(1744862126.305:357): avc: denied { name_bind } for pid=6698 comm="syz.0.189" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 125.025165][ T30] audit: type=1400 audit(1744862126.305:358): avc: denied { node_bind } for pid=6698 comm="syz.0.189" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 125.254157][ T30] audit: type=1400 audit(1744862126.305:359): avc: denied { write } for pid=6698 comm="syz.0.189" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 125.315569][ T9] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 125.642761][ T30] audit: type=1400 audit(1744862126.305:360): avc: denied { connect } for pid=6698 comm="syz.0.189" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 125.688337][ T30] audit: type=1400 audit(1744862126.305:361): avc: denied { name_connect } for pid=6698 comm="syz.0.189" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 125.712352][ T30] audit: type=1400 audit(1744862126.705:362): avc: denied { accept } for pid=6682 comm="syz.2.184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 125.736797][ T9] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 125.744878][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 125.758981][ T9] usb 5-1: config 0 has no interface number 0 [ 125.760899][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 125.776187][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.784210][ T9] usb 5-1: Product: syz [ 125.832765][ T9] usb 5-1: Manufacturer: syz [ 125.857855][ T9] usb 5-1: SerialNumber: syz [ 125.886284][ T10] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 125.917376][ T9] usb 5-1: config 0 descriptor?? [ 125.938265][ T9] hub 5-1:0.31: bad descriptor, ignoring hub [ 125.944259][ T9] hub 5-1:0.31: probe with driver hub failed with error -5 [ 125.980031][ T9] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 125.981583][ T6718] netlink: 36 bytes leftover after parsing attributes in process `syz.1.195'. [ 126.009756][ T9] uvcvideo 5-1:0.31: Entity type for entity Output 6 was not initialized! [ 126.036701][ T6718] netlink: 8 bytes leftover after parsing attributes in process `syz.1.195'. [ 126.160437][ T6722] Zero length message leads to an empty skb [ 126.161851][ T9] usb 5-1: Failed to create links for entity 6 [ 126.167459][ T3433] bond0: (slave bond_slave_0): interface is now down [ 126.172823][ T9] usb 5-1: Failed to register entities (-22). [ 126.225251][ T3433] bond0: (slave bond_slave_1): interface is now down [ 126.236681][ T3433] bond0: now running without any active interface! [ 126.277830][ T9] usb 5-1: USB disconnect, device number 8 [ 126.466066][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 126.510985][ T972] usb 3-1: USB disconnect, device number 6 [ 126.626088][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 126.698848][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 126.735659][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 126.771775][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 126.784344][ T6740] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 126.785516][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 126.997146][ T10] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 127.012257][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.044770][ T10] usb 2-1: Product: syz [ 127.060676][ T10] usb 2-1: Manufacturer: syz [ 127.065282][ T10] usb 2-1: SerialNumber: syz [ 127.090967][ T10] usb 2-1: config 0 descriptor?? [ 127.102220][ T6727] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 127.343220][ T10] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 127.368750][ T10] input: Griffin SoundKnob as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input8 [ 127.422416][ T6753] mmap: syz.2.201 (6753) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 127.615605][ T5831] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 127.627402][ T9] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 127.765009][ C0] powermate: config urb returned -71 [ 127.767076][ T972] usb 2-1: USB disconnect, device number 6 [ 127.770306][ C0] powermate: usb_submit_urb(config) failed [ 127.770344][ C0] powermate 2-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 127.790837][ C0] vkms_vblank_simulate: vblank timer overrun [ 127.815499][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 127.822333][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 127.832288][ T9] usb 1-1: config 0 has an invalid interface number: 232 but max is 0 [ 127.841399][ T5831] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 127.854144][ T9] usb 1-1: config 0 has no interface number 0 [ 127.860793][ T5831] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 127.875166][ T9] usb 1-1: config 0 interface 232 altsetting 0 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 127.886948][ T5831] usb 5-1: config 0 has no interface number 0 [ 127.945426][ T5831] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 127.954511][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.963108][ T5831] usb 5-1: Product: syz [ 127.967802][ T9] usb 1-1: New USB device found, idVendor=24c6, idProduct=6bbc, bcdDevice=22.a6 [ 127.982913][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.995446][ T5831] usb 5-1: Manufacturer: syz [ 128.000060][ T5831] usb 5-1: SerialNumber: syz [ 128.004716][ T9] usb 1-1: Product: syz [ 128.015468][ T9] usb 1-1: Manufacturer: æ£à­¿çªšá„ᤧê­ï»‚妪ᩄᤗࣇ㿆ï⧻궚껜ঃ旎ኲ뚭닞蓷呬àªê¿âƒ—⊼æ¶ï…œì‰®ï“Žå·¾ì—Œï¶Ÿé®žê€æž¯ä›“ॖ [ 128.035161][ T9] usb 1-1: SerialNumber: syz [ 128.040549][ T5831] usb 5-1: config 0 descriptor?? [ 128.047560][ T5831] hub 5-1:0.31: bad descriptor, ignoring hub [ 128.053576][ T5831] hub 5-1:0.31: probe with driver hub failed with error -5 [ 128.064127][ T5831] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 128.071598][ T9] usb 1-1: config 0 descriptor?? [ 128.081428][ T5831] uvcvideo 5-1:0.31: Entity type for entity Output 6 was not initialized! [ 128.090185][ T5831] usb 5-1: Failed to create links for entity 6 [ 128.096535][ T5831] usb 5-1: Failed to register entities (-22). [ 128.196198][ T6766] netlink: 80 bytes leftover after parsing attributes in process `syz.2.208'. [ 128.282952][ T24] usb 1-1: USB disconnect, device number 8 [ 128.371077][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 128.371091][ T30] audit: type=1400 audit(1744862130.105:371): avc: denied { read } for pid=6769 comm="syz.1.209" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 128.385644][ T5831] usb 5-1: USB disconnect, device number 9 [ 128.400753][ T30] audit: type=1400 audit(1744862130.105:372): avc: denied { open } for pid=6769 comm="syz.1.209" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 128.450410][ T30] audit: type=1400 audit(1744862130.185:373): avc: denied { shutdown } for pid=6768 comm="syz.3.210" laddr=::1 lport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 128.455609][ T972] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 128.712272][ T972] usb 3-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 128.721405][ T972] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.222678][ T972] usb 3-1: config 0 descriptor?? [ 129.238342][ T972] usb 3-1: selecting invalid altsetting 1 [ 129.272552][ T972] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 129.278651][ T30] audit: type=1400 audit(1744862131.015:374): avc: denied { write } for pid=6778 comm="syz.0.212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 129.294466][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 129.301640][ C0] vkms_vblank_simulate: vblank timer overrun [ 129.362878][ T30] audit: type=1400 audit(1744862131.015:375): avc: denied { nlmsg_read } for pid=6778 comm="syz.0.212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 129.415057][ T6782] macvlan0: entered allmulticast mode [ 129.465585][ T6782] veth1_vlan: entered allmulticast mode [ 129.492376][ T6785] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 129.541265][ T30] audit: type=1400 audit(1744862131.275:376): avc: denied { execute } for pid=6784 comm="syz.1.215" name="file0" dev="tmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 129.571437][ T30] audit: type=1400 audit(1744862131.275:377): avc: denied { execute_no_trans } for pid=6784 comm="syz.1.215" path="/44/file0" dev="tmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 129.619464][ T30] audit: type=1400 audit(1744862131.355:378): avc: denied { connect } for pid=6787 comm="syz.0.216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 129.753581][ T6791] netlink: 56 bytes leftover after parsing attributes in process `syz.4.218'. [ 129.795513][ T5871] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 130.046791][ T5871] usb 2-1: config 0 has an invalid interface number: 113 but max is 0 [ 130.089990][ T5871] usb 2-1: config 0 has no interface number 0 [ 130.111031][ T5871] usb 2-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 130.122782][ T6799] netlink: 4 bytes leftover after parsing attributes in process `syz.4.220'. [ 130.134472][ T5871] usb 2-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 130.145215][ T5871] usb 2-1: config 0 interface 113 has no altsetting 0 [ 130.152105][ T24] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 130.162570][ T5871] usb 2-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 130.171824][ T5871] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.183134][ T5871] usb 2-1: Product: syz [ 130.187513][ T5871] usb 2-1: Manufacturer: syz [ 130.192287][ T5871] usb 2-1: SerialNumber: syz [ 130.201557][ T5871] usb 2-1: config 0 descriptor?? [ 130.209582][ C0] usb 2-1: NFC: Urb failure (status -71) [ 130.218006][ T5871] usb 2-1: NFC: Unable to get FW version [ 130.227374][ T5871] pn533_usb 2-1:0.113: probe with driver pn533_usb failed with error -90 [ 130.325727][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 130.332054][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 130.342501][ T30] audit: type=1400 audit(1744862132.075:379): avc: denied { search } for pid=5179 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.344265][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 130.404943][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 130.414911][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 130.427234][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 130.440441][ T972] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 130.471247][ T6785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.484789][ T6785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.485749][ T24] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 130.501931][ T24] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 130.511008][ T24] usb 1-1: Manufacturer: syz [ 130.513668][ T5831] usb 2-1: USB disconnect, device number 7 [ 130.545027][ T24] usb 1-1: config 0 descriptor?? [ 130.629921][ T972] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 130.639056][ T972] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.653991][ T972] usb 5-1: Product: syz [ 130.664429][ T972] usb 5-1: Manufacturer: syz [ 130.674315][ T972] usb 5-1: SerialNumber: syz [ 130.686821][ T972] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 130.702811][ T5913] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 130.965593][ T24] rc_core: IR keymap rc-hauppauge not found [ 131.016733][ T24] Registered IR keymap rc-empty [ 131.069659][ T972] usb 5-1: USB disconnect, device number 10 [ 131.113264][ T5831] usb 3-1: USB disconnect, device number 7 [ 131.141066][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.205298][ T30] audit: type=1326 audit(1744862132.935:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6809 comm="syz.1.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cd878e169 code=0x7ffc0000 [ 131.206657][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.296839][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 131.311473][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input9 [ 131.419435][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.445592][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.465555][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.485571][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.505750][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.685683][ T5867] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 131.693892][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.725537][ T5913] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 131.732891][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.833235][ T5913] ath9k_htc: Failed to initialize the device [ 131.843359][ T972] usb 5-1: ath9k_htc: USB layer deinitialized [ 131.855600][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.886938][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.906309][ T5867] usb 2-1: Using ep0 maxpacket: 16 [ 131.918047][ T5867] usb 2-1: unable to get BOS descriptor or descriptor too short [ 131.925964][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 131.937680][ T5867] usb 2-1: config 9 has an invalid interface number: 212 but max is 0 [ 131.947225][ T5867] usb 2-1: config 9 has no interface number 0 [ 131.953366][ T5867] usb 2-1: config 9 interface 212 has no altsetting 0 [ 131.962599][ T24] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 131.989100][ T5867] usb 2-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 132.001971][ T24] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 132.014397][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.041183][ T5867] usb 2-1: Product: syz [ 132.052072][ T5867] usb 2-1: Manufacturer: syz [ 132.063213][ T5867] usb 2-1: SerialNumber: syz [ 132.356952][ T5867] ttusbir 2-1:9.212: cannot find expected altsetting [ 132.466617][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.473234][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.550412][ T5867] usb 2-1: USB disconnect, device number 8 [ 133.127802][ T5871] usb 1-1: USB disconnect, device number 9 [ 133.150153][ T6837] netlink: 36 bytes leftover after parsing attributes in process `syz.1.233'. [ 133.504789][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 133.504799][ T30] audit: type=1400 audit(1744862135.235:390): avc: denied { create } for pid=6841 comm="syz.0.234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 133.676638][ T30] audit: type=1400 audit(1744862135.265:391): avc: denied { getopt } for pid=6841 comm="syz.0.234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 133.846643][ T24] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 134.129021][ T30] audit: type=1400 audit(1744862135.865:392): avc: denied { getopt } for pid=6856 comm="syz.4.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 134.153984][ T24] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 134.357755][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 134.370997][ T24] usb 3-1: config 0 has no interface number 0 [ 134.382371][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 134.416076][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.433664][ T24] usb 3-1: Product: syz [ 134.438455][ T24] usb 3-1: Manufacturer: syz [ 134.442550][ T6865] vlan2: entered promiscuous mode [ 134.449304][ T24] usb 3-1: SerialNumber: syz [ 134.561063][ T24] usb 3-1: config 0 descriptor?? [ 134.570226][ T24] hub 3-1:0.31: bad descriptor, ignoring hub [ 134.576756][ T24] hub 3-1:0.31: probe with driver hub failed with error -5 [ 134.581540][ T6865] veth1_virt_wifi: entered promiscuous mode [ 134.592285][ T24] usb 3-1: Found UVC 0.04 device syz (046d:08c3) [ 134.599840][ T30] audit: type=1400 audit(1744862136.335:393): avc: denied { name_bind } for pid=6866 comm="syz.4.242" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 134.682104][ T24] uvcvideo 3-1:0.31: Entity type for entity Output 6 was not initialized! [ 134.708805][ T24] usb 3-1: Failed to create links for entity 6 [ 134.727388][ T24] usb 3-1: Failed to register entities (-22). [ 134.819460][ T24] usb 3-1: USB disconnect, device number 8 [ 135.093054][ T5871] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 135.408237][ T5871] usb 2-1: unable to get BOS descriptor or descriptor too short [ 135.425703][ T5871] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 135.434742][ T5871] usb 2-1: can't read configurations, error -71 [ 135.726032][ T6883] Illegal XDP return value 2556666715 on prog (id 68) dev syz_tun, expect packet loss! [ 136.333371][ T6887] xt_CT: You must specify a L4 protocol and not use inversions on it [ 136.694362][ T6899] FAULT_INJECTION: forcing a failure. [ 136.694362][ T6899] name failslab, interval 1, probability 0, space 0, times 0 [ 136.711167][ T6899] CPU: 0 UID: 0 PID: 6899 Comm: syz.1.252 Not tainted 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 PREEMPT(full) [ 136.711191][ T6899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 136.711201][ T6899] Call Trace: [ 136.711207][ T6899] [ 136.711213][ T6899] dump_stack_lvl+0x16c/0x1f0 [ 136.711240][ T6899] should_fail_ex+0x512/0x640 [ 136.711258][ T6899] ? fs_reclaim_acquire+0xae/0x150 [ 136.711283][ T6899] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 136.711307][ T6899] should_failslab+0xc2/0x120 [ 136.711326][ T6899] __kmalloc_noprof+0xd2/0x510 [ 136.711349][ T6899] tomoyo_realpath_from_path+0xc2/0x6e0 [ 136.711375][ T6899] ? tomoyo_profile+0x47/0x60 [ 136.711393][ T6899] tomoyo_path_number_perm+0x245/0x580 [ 136.711412][ T6899] ? tomoyo_path_number_perm+0x237/0x580 [ 136.711435][ T6899] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 136.711456][ T6899] ? find_held_lock+0x2b/0x80 [ 136.711499][ T6899] ? find_held_lock+0x2b/0x80 [ 136.711518][ T6899] ? hook_file_ioctl_common+0x145/0x410 [ 136.711540][ T6899] ? __fget_files+0x20e/0x3c0 [ 136.711561][ T6899] security_file_ioctl+0x9b/0x240 [ 136.711586][ T6899] __x64_sys_ioctl+0xb7/0x200 [ 136.711611][ T6899] do_syscall_64+0xcd/0x260 [ 136.711639][ T6899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.711655][ T6899] RIP: 0033:0x7f7cd878e169 [ 136.711669][ T6899] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.711685][ T6899] RSP: 002b:00007f7cd96d0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 136.711702][ T6899] RAX: ffffffffffffffda RBX: 00007f7cd89b5fa0 RCX: 00007f7cd878e169 [ 136.711713][ T6899] RDX: 0000200000000100 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 136.711723][ T6899] RBP: 00007f7cd96d0090 R08: 0000000000000000 R09: 0000000000000000 [ 136.711733][ T6899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.711743][ T6899] R13: 0000000000000000 R14: 00007f7cd89b5fa0 R15: 00007ffe42ebe528 [ 136.711771][ T6899] [ 136.785448][ T6899] ERROR: Out of memory at tomoyo_realpath_from_path. [ 136.790391][ C0] vkms_vblank_simulate: vblank timer overrun [ 136.923237][ C0] vkms_vblank_simulate: vblank timer overrun [ 137.537289][ T6909] netlink: 28 bytes leftover after parsing attributes in process `syz.2.256'. [ 140.145367][ T30] audit: type=1400 audit(1744862140.995:394): avc: denied { write } for pid=6927 comm="syz.1.261" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 140.164787][ C0] vkms_vblank_simulate: vblank timer overrun [ 140.343454][ T30] audit: type=1400 audit(1744862142.035:395): avc: denied { ioctl } for pid=6924 comm="syz.0.260" path="net:[4026533224]" dev="nsfs" ino=4026533224 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 140.950929][ T6940] evm: overlay not supported [ 141.082083][ T30] audit: type=1400 audit(1744862142.815:396): avc: denied { write } for pid=6941 comm="syz.1.266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 141.601602][ T30] audit: type=1400 audit(1744862143.305:397): avc: denied { read } for pid=6941 comm="syz.1.266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 142.835447][ T9] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 142.970843][ T30] audit: type=1400 audit(1744862144.705:398): avc: denied { create } for pid=6965 comm="syz.3.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 143.099415][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 143.110168][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.121867][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.131915][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 143.147345][ T9] usb 2-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 143.158665][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.170983][ T9] usb 2-1: config 0 descriptor?? [ 143.222699][ T6972] IPVS: length: 221 != 24 [ 143.227333][ T30] audit: type=1400 audit(1744862144.955:399): avc: denied { getopt } for pid=6965 comm="syz.3.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 144.183631][ T9] cougar 0003:060B:500A.0003: unexpected long global item [ 144.277195][ T9] cougar 0003:060B:500A.0003: parse failed [ 144.317989][ T9] cougar 0003:060B:500A.0003: probe with driver cougar failed with error -22 [ 144.337367][ T30] audit: type=1400 audit(1744862146.065:400): avc: denied { setopt } for pid=6978 comm="syz.0.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 144.355437][ T9] usb 2-1: USB disconnect, device number 11 [ 144.408750][ T30] audit: type=1400 audit(1744862146.125:401): avc: denied { write } for pid=6978 comm="syz.0.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 144.443461][ T6980] xt_CT: No such helper "snmp" [ 145.525796][ T6991] vxcan1: entered allmulticast mode [ 145.545322][ T6993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.281'. [ 145.632768][ T6993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.281'. [ 145.642805][ T6990] vxcan1: left allmulticast mode [ 145.696468][ T6992] cgroup: fork rejected by pids controller in /syz0 [ 146.244549][ T7091] xt_hashlimit: size too large, truncated to 1048576 [ 146.737711][ T5913] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 146.987945][ T5913] usb 5-1: unable to get BOS descriptor or descriptor too short [ 146.998090][ T5913] usb 5-1: config 2 has an invalid interface number: 202 but max is 1 [ 147.013980][ T5913] usb 5-1: config 2 has an invalid interface association descriptor of length 5, skipping [ 147.027429][ T5913] usb 5-1: config 2 has no interface number 1 [ 147.027474][ T5913] usb 5-1: config 2 interface 202 has no altsetting 0 [ 147.040548][ T5913] usb 5-1: config 2 interface 0 has no altsetting 0 [ 147.052121][ T5913] usb 5-1: New USB device found, idVendor=0856, idProduct=ac25, bcdDevice=5b.5d [ 147.061471][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.069623][ T5913] usb 5-1: Product: syz [ 147.073812][ T5913] usb 5-1: Manufacturer: syz [ 147.078692][ T5913] usb 5-1: SerialNumber: syz [ 147.292058][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.298400][ T5913] ftdi_sio 5-1:2.202: FTDI USB Serial Device converter detected [ 147.320426][ T5913] ftdi_sio ttyUSB0: unknown device type: 0x5b5d [ 147.338313][ T5913] ftdi_sio 5-1:2.0: FTDI USB Serial Device converter detected [ 147.352858][ T5913] ftdi_sio ttyUSB1: unknown device type: 0x5b5d [ 147.373642][ T5913] usb 5-1: USB disconnect, device number 11 [ 147.389207][ T5913] ftdi_sio 5-1:2.202: device disconnected [ 147.405477][ T5922] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 147.430078][ T5913] ftdi_sio 5-1:2.0: device disconnected [ 147.479795][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.561815][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.619921][ T5922] usb 4-1: config 0 has an invalid interface number: 11 but max is 0 [ 147.629360][ T5922] usb 4-1: config 0 has no interface number 0 [ 147.658244][ T5922] usb 4-1: config 0 interface 11 altsetting 253 bulk endpoint 0x7 has invalid maxpacket 1024 [ 147.672824][ T5922] usb 4-1: config 0 interface 11 has no altsetting 0 [ 147.693743][ T5922] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 147.707778][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.725070][ T5922] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.744898][ T5922] usb 4-1: config 0 descriptor?? [ 147.754445][ T7114] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 147.777601][ T5922] keyspan 4-1:0.11: Keyspan 2 port adapter converter detected [ 147.791437][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 81 [ 147.817040][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 82 [ 147.845116][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 1 [ 147.875947][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 2 [ 147.883659][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 85 [ 147.988407][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 5 [ 148.510845][ T5922] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 148.523849][ T12] team0: left allmulticast mode [ 148.542182][ T12] team_slave_0: left allmulticast mode [ 148.556974][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 83 [ 148.564776][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 84 [ 148.572580][ T12] team_slave_1: left allmulticast mode [ 148.578210][ T12] team0: left promiscuous mode [ 148.583009][ T12] team_slave_0: left promiscuous mode [ 148.597597][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 3 [ 148.605306][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 4 [ 148.614878][ T12] team_slave_1: left promiscuous mode [ 148.623883][ T12] bridge0: port 3(team0) entered disabled state [ 148.632414][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 86 [ 148.641900][ T5922] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 6 [ 148.819446][ T5922] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 148.828422][ T12] bridge_slave_1: left allmulticast mode [ 148.834115][ T12] bridge_slave_1: left promiscuous mode [ 148.840459][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.337945][ T54] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 149.347774][ T54] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 149.352453][ T12] bridge_slave_0: left allmulticast mode [ 149.365672][ T54] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 149.377787][ T54] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 149.384662][ T12] bridge_slave_0: left promiscuous mode [ 149.392643][ T54] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 149.414641][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.427715][ T5821] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 149.436201][ T5821] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 149.445173][ T5821] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 149.550400][ T5821] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 149.572482][ T5821] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 149.587035][ T30] audit: type=1400 audit(1744862151.315:402): avc: denied { mounton } for pid=7131 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 149.761831][ T972] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 150.368902][ T5871] usb 4-1: USB disconnect, device number 4 [ 150.382623][ T5871] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 150.414792][ T5871] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 150.425492][ T972] usb 2-1: Using ep0 maxpacket: 32 [ 150.434820][ T5871] keyspan 4-1:0.11: device disconnected [ 150.450306][ T972] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 150.465974][ T972] usb 2-1: config 0 has no interface number 0 [ 150.488522][ T972] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 150.503768][ T972] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.512359][ T972] usb 2-1: Product: syz [ 150.518930][ T972] usb 2-1: Manufacturer: syz [ 150.523580][ T972] usb 2-1: SerialNumber: syz [ 150.533610][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 150.544723][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 150.555150][ T12] bond0 (unregistering): Released all slaves [ 150.699739][ T972] usb 2-1: config 0 descriptor?? [ 150.726132][ T972] smsc95xx v2.0.0 [ 151.232625][ T972] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 151.390112][ T972] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 151.645882][ T5821] Bluetooth: hci4: command tx timeout [ 151.842229][ T7167] netlink: 'syz.3.301': attribute type 1 has an invalid length. [ 151.900815][ T7163] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.972720][ T7163] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.032710][ T7163] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.089832][ T12] hsr_slave_0: left promiscuous mode [ 152.185595][ T12] hsr_slave_1: left promiscuous mode [ 152.191564][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.230928][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 152.249741][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.423147][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 152.738803][ T12] veth1_macvtap: left promiscuous mode [ 152.744450][ T12] veth0_macvtap: left promiscuous mode [ 152.750664][ T12] veth1_vlan: left allmulticast mode [ 152.756876][ T12] veth1_vlan: left promiscuous mode [ 152.762571][ T12] veth0_vlan: left promiscuous mode [ 153.735623][ T5821] Bluetooth: hci4: command tx timeout [ 153.886681][ T12] team0 (unregistering): Port device team_slave_1 removed [ 153.910309][ T12] team0 (unregistering): Port device team_slave_0 removed [ 154.095350][ T972] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 154.107352][ T972] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 154.132231][ T972] usb 2-1: USB disconnect, device number 12 [ 155.203126][ T7203] netlink: 4 bytes leftover after parsing attributes in process `syz.3.309'. [ 155.213024][ T7163] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.866251][ T5821] Bluetooth: hci4: command tx timeout [ 156.095065][ T7131] chnl_net:caif_netlink_parms(): no params data found [ 156.142108][ T7163] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.211101][ T30] audit: type=1400 audit(1744862157.945:403): avc: denied { read } for pid=7202 comm="syz.3.309" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 156.238041][ T30] audit: type=1400 audit(1744862157.945:404): avc: denied { open } for pid=7202 comm="syz.3.309" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 156.261652][ T30] audit: type=1400 audit(1744862157.975:405): avc: denied { mount } for pid=7202 comm="syz.3.309" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 156.271671][ T7163] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.571222][ T7163] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.641130][ T7163] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.714807][ T7131] bridge0: port 1(bridge_slave_0) entered blocking state [ 156.941351][ T7131] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.948861][ T7131] bridge_slave_0: entered allmulticast mode [ 156.968587][ T7131] bridge_slave_0: entered promiscuous mode [ 156.984377][ T7131] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.012625][ T7131] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.041149][ T7131] bridge_slave_1: entered allmulticast mode [ 157.059804][ T7131] bridge_slave_1: entered promiscuous mode [ 157.189491][ T7131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 157.223146][ T7131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 157.475771][ T7131] team0: Port device team_slave_0 added [ 157.486164][ T7131] team0: Port device team_slave_1 added [ 157.987702][ T5821] Bluetooth: hci4: command tx timeout [ 158.163274][ T7131] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 158.174315][ T7253] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 158.180831][ T7253] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 158.221838][ T7131] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 158.251396][ T7258] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(6) [ 158.257915][ T7258] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 158.275502][ T7131] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 158.288750][ T7258] vhci_hcd vhci_hcd.0: Device attached [ 158.295236][ T7253] vhci_hcd vhci_hcd.0: Device attached [ 158.306631][ T7262] batman_adv: batadv0: Removing interface: team0 [ 158.329368][ T7262] team0: Cannot enslave team device to itself [ 158.385355][ T7131] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 158.395442][ T10] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 158.405093][ T7131] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 158.514001][ T30] audit: type=1400 audit(1744862160.175:406): avc: denied { getopt } for pid=7252 comm="syz.2.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 158.576411][ T7253] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(12) [ 158.583010][ T7253] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 158.598366][ T7131] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 158.646150][ T7253] vhci_hcd vhci_hcd.0: Device attached [ 158.773528][ T7269] vhci_hcd: connection closed [ 158.777157][ T5957] vhci_hcd: stop threads [ 158.798313][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 158.814261][ T7256] vhci_hcd: connection closed [ 158.823743][ T7259] vhci_hcd: connection closed [ 158.828476][ T5957] vhci_hcd: release socket [ 158.848067][ T9] vhci_hcd: vhci_device speed not set [ 158.861104][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 158.897299][ T7131] hsr_slave_0: entered promiscuous mode [ 158.925537][ T9] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 158.933330][ T7257] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 158.939496][ T5957] vhci_hcd: disconnect device [ 158.939652][ T7131] hsr_slave_1: entered promiscuous mode [ 158.949535][ T10] usb 5-1: config 9 has an invalid interface number: 212 but max is 0 [ 158.978502][ T7131] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 159.008724][ T5957] vhci_hcd: stop threads [ 159.012969][ T5957] vhci_hcd: release socket [ 159.019495][ T10] usb 5-1: config 9 has no interface number 0 [ 159.031831][ T10] usb 5-1: config 9 interface 212 has no altsetting 0 [ 159.040558][ T7131] Cannot create hsr debugfs directory [ 159.042157][ T10] usb 5-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 159.057750][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.077391][ T10] usb 5-1: Product: syz [ 159.085002][ T10] usb 5-1: Manufacturer: syz [ 159.205520][ T5957] vhci_hcd: disconnect device [ 159.210580][ T5957] vhci_hcd: stop threads [ 159.214817][ T5957] vhci_hcd: release socket [ 159.225067][ T10] usb 5-1: SerialNumber: syz [ 159.271486][ T5957] vhci_hcd: disconnect device [ 159.669930][ T10] ttusbir 5-1:9.212: cannot find expected altsetting [ 159.760465][ T10] usb 5-1: USB disconnect, device number 12 [ 162.522027][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 162.810571][ T7321] netlink: 68 bytes leftover after parsing attributes in process `syz.1.328'. [ 163.006915][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 163.025452][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 163.048576][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 163.708513][ T10] usb 4-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 163.717702][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.725957][ T10] usb 4-1: Product: syz [ 163.730174][ T10] usb 4-1: Manufacturer: syz [ 163.734880][ T10] usb 4-1: SerialNumber: syz [ 163.743141][ T10] usb 4-1: config 0 descriptor?? [ 163.755120][ T10] usb 4-1: Found UVC 34.00 device syz (8086:0b5b) [ 163.762333][ T10] usb 4-1: No valid video chain found. [ 164.057528][ T5831] usb 4-1: USB disconnect, device number 5 [ 164.115520][ T9] vhci_hcd: vhci_device speed not set [ 165.018452][ T30] audit: type=1400 audit(1744862166.745:407): avc: denied { create } for pid=7347 comm="syz.2.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 165.340709][ T7131] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 165.574806][ T7131] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 165.584593][ T7131] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 165.603430][ T10] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 165.607669][ T7131] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 165.795181][ T10] usb 2-1: config 3 has an invalid interface number: 204 but max is 0 [ 165.895637][ T10] usb 2-1: config 3 has no interface number 0 [ 166.065447][ T10] usb 2-1: config 3 interface 204 has no altsetting 0 [ 166.120828][ T10] usb 2-1: New USB device found, idVendor=1485, idProduct=0002, bcdDevice=e9.99 [ 166.591286][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.600822][ T10] usb 2-1: Product: syz [ 166.628844][ T10] usb 2-1: Manufacturer: syz [ 166.640697][ T10] usb 2-1: SerialNumber: syz [ 166.717521][ T7131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 166.766750][ T7131] 8021q: adding VLAN 0 to HW filter on device team0 [ 166.920353][ T7384] netlink: 68 bytes leftover after parsing attributes in process `syz.4.337'. [ 167.159721][ T2993] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.166824][ T2993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.197146][ T2993] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.204288][ T2993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 167.308942][ T10] kaweth 2-1:3.204: Firmware present in device. [ 167.346037][ T10] kaweth 2-1:3.204: Error reading configuration (-71), no net device created [ 167.709864][ T10] kaweth 2-1:3.204: probe with driver kaweth failed with error -5 [ 167.740574][ T7131] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 167.760857][ T10] usb 2-1: USB disconnect, device number 13 [ 168.036447][ T30] audit: type=1400 audit(1744862169.765:408): avc: denied { connect } for pid=7398 comm="syz.1.344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 168.237411][ T7131] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.298565][ T1202] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 168.392918][ T7131] veth0_vlan: entered promiscuous mode [ 168.506714][ T1202] usb 5-1: Using ep0 maxpacket: 32 [ 168.554833][ T1202] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 168.678677][ T1202] usb 5-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 168.740202][ T7131] veth1_vlan: entered promiscuous mode [ 168.789678][ T1202] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.836456][ T7430] netlink: 8 bytes leftover after parsing attributes in process `syz.2.351'. [ 168.857889][ T30] audit: type=1400 audit(1744862170.595:409): avc: denied { remount } for pid=7422 comm="syz.1.350" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 169.010942][ T7424] overlayfs: missing 'lowerdir' [ 169.138489][ T1202] usb 5-1: config 0 descriptor?? [ 169.218040][ T7131] veth0_macvtap: entered promiscuous mode [ 169.232690][ T7131] veth1_macvtap: entered promiscuous mode [ 169.342011][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.402561][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.425304][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.457472][ T7439] netlink: 104 bytes leftover after parsing attributes in process `syz.3.352'. [ 169.476606][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.617055][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.628103][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.638009][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.656284][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.667854][ T30] audit: type=1400 audit(1744862171.405:410): avc: denied { lock } for pid=7437 comm="syz.3.352" path="socket:[14518]" dev="sockfs" ino=14518 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 170.068062][ T7131] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 170.100356][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.111053][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.192222][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.229527][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.275585][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.302251][ T1202] dragonrise 0003:0079:0006.0004: hidraw0: USB HID v0.00 Device [HID 0079:0006] on usb-dummy_hcd.4-1/input0 [ 170.319439][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.330369][ T1202] dragonrise 0003:0079:0006.0004: no inputs found [ 170.339569][ T7131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.351726][ T1202] dragonrise 0003:0079:0006.0004: force feedback init failed [ 170.389159][ T7131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.469721][ T7131] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 170.517331][ T7131] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.568854][ T7131] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.585619][ T7131] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.594305][ T7131] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.777903][ T7456] netlink: 4 bytes leftover after parsing attributes in process `syz.2.354'. [ 171.058788][ T5867] usb 5-1: USB disconnect, device number 13 [ 171.247478][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.274212][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.525178][ T3433] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.538869][ T3433] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.568756][ T30] audit: type=1400 audit(1744862173.305:411): avc: denied { mounton } for pid=7131 comm="syz-executor" path="/root/syzkaller.zAeohI/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 171.940713][ T30] audit: type=1400 audit(1744862173.365:412): avc: denied { mount } for pid=7131 comm="syz-executor" name="/" dev="gadgetfs" ino=5911 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 172.583212][ T5913] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 173.805752][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 174.412136][ T5913] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=99.03 [ 174.815456][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.834122][ T5913] usb 5-1: Product: syz [ 174.868082][ T5913] usb 5-1: Manufacturer: syz [ 174.893677][ T5913] usb 5-1: SerialNumber: syz [ 174.895432][ T30] audit: type=1400 audit(1744862176.625:413): avc: denied { ioctl } for pid=7513 comm="syz.3.366" path="socket:[14817]" dev="sockfs" ino=14817 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 174.907242][ T5913] usb 5-1: config 0 descriptor?? [ 175.417816][ T7514] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=7514 comm=syz.3.366 [ 175.468533][ T5913] usb 5-1: can't set config #0, error -71 [ 175.485960][ T5913] usb 5-1: USB disconnect, device number 14 [ 175.534305][ T7507] netlink: 68 bytes leftover after parsing attributes in process `syz.1.365'. [ 175.548012][ T30] audit: type=1400 audit(1744862177.285:414): avc: denied { getopt } for pid=7513 comm="syz.3.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 175.679775][ T7527] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=7527 comm=syz.3.366 [ 175.706557][ T30] audit: type=1400 audit(1744862177.285:415): avc: denied { connect } for pid=7513 comm="syz.3.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 175.729128][ T7527] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1013 sclass=netlink_xfrm_socket pid=7527 comm=syz.3.366 [ 175.762044][ T30] audit: type=1400 audit(1744862177.285:416): avc: denied { accept } for pid=7513 comm="syz.3.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 176.135512][ T30] audit: type=1400 audit(1744862177.415:417): avc: denied { setopt } for pid=7513 comm="syz.3.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 176.135553][ T30] audit: type=1400 audit(1744862177.415:418): avc: denied { read } for pid=7513 comm="syz.3.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 176.284131][ T7536] netlink: 'syz.3.370': attribute type 4 has an invalid length. [ 177.816582][ T7563] netlink: 68 bytes leftover after parsing attributes in process `syz.1.374'. [ 177.871137][ T7551] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.891239][ T7586] FAULT_INJECTION: forcing a failure. [ 178.891239][ T7586] name failslab, interval 1, probability 0, space 0, times 0 [ 178.913625][ T30] audit: type=1400 audit(1744862180.645:419): avc: denied { ioctl } for pid=7582 comm="syz.2.380" path="socket:[14904]" dev="sockfs" ino=14904 ioctlcmd=0x89a0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 178.915904][ T7586] CPU: 0 UID: 0 PID: 7586 Comm: syz.1.381 Not tainted 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 PREEMPT(full) [ 178.915925][ T7586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 178.915933][ T7586] Call Trace: [ 178.915938][ T7586] [ 178.915944][ T7586] dump_stack_lvl+0x16c/0x1f0 [ 178.915969][ T7586] should_fail_ex+0x512/0x640 [ 178.915984][ T7586] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 178.916008][ T7586] should_failslab+0xc2/0x120 [ 178.916025][ T7586] __kmalloc_cache_noprof+0x6a/0x3e0 [ 178.916046][ T7586] ? alloc_fs_context+0x57/0x9c0 [ 178.916065][ T7586] alloc_fs_context+0x57/0x9c0 [ 178.916083][ T7586] path_mount+0xb06/0x1f30 [ 178.916100][ T7586] ? kmem_cache_free+0x2d4/0x4d0 [ 178.916114][ T7586] ? __pfx_path_mount+0x10/0x10 [ 178.916132][ T7586] ? putname+0x154/0x1a0 [ 178.916151][ T7586] __x64_sys_mount+0x28d/0x310 [ 178.916168][ T7586] ? __pfx___x64_sys_mount+0x10/0x10 [ 178.916190][ T7586] do_syscall_64+0xcd/0x260 [ 178.916212][ T7586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.916226][ T7586] RIP: 0033:0x7f7cd878e169 [ 178.916238][ T7586] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 178.916252][ T7586] RSP: 002b:00007f7cd96d0038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 178.916266][ T7586] RAX: ffffffffffffffda RBX: 00007f7cd89b5fa0 RCX: 00007f7cd878e169 [ 178.916275][ T7586] RDX: 00002000000000c0 RSI: 0000200000000540 RDI: 0000000000000000 [ 178.916284][ T7586] RBP: 00007f7cd96d0090 R08: 0000200000000000 R09: 0000000000000000 [ 178.916292][ T7586] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002 [ 178.916300][ T7586] R13: 0000000000000001 R14: 00007f7cd89b5fa0 R15: 00007ffe42ebe528 [ 178.916320][ T7586] [ 179.035472][ T1202] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 179.066023][ C0] vkms_vblank_simulate: vblank timer overrun [ 179.263688][ T7551] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.275977][ T10] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 179.368290][ T1202] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 179.377710][ T1202] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 179.396251][ T1202] usb 5-1: config 0 has no interface number 0 [ 179.401762][ T7551] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.402476][ T1202] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 179.426041][ T1202] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 179.486100][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 179.526363][ T10] usb 3-1: config 0 has an invalid interface number: 79 but max is 0 [ 179.547595][ T10] usb 3-1: config 0 has no interface number 0 [ 179.564787][ T10] usb 3-1: New USB device found, idVendor=093a, idProduct=2608, bcdDevice=3f.06 [ 179.575683][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.592384][ T1202] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 179.605447][ T10] usb 3-1: Product: syz [ 179.609652][ T10] usb 3-1: Manufacturer: syz [ 179.614266][ T10] usb 3-1: SerialNumber: syz [ 179.622531][ T1202] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.641104][ T7604] SELinux: failed to load policy [ 179.647015][ T1202] usb 5-1: Product: syz [ 179.651221][ T1202] usb 5-1: Manufacturer: syz [ 179.655961][ T30] audit: type=1400 audit(1744862181.375:420): avc: denied { load_policy } for pid=7602 comm="syz.1.384" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 179.685442][ T1202] usb 5-1: SerialNumber: syz [ 179.709742][ T10] usb 3-1: config 0 descriptor?? [ 179.716787][ T1202] usb 5-1: config 0 descriptor?? [ 179.739505][ T10] gspca_main: pac7311-2.14.0 probing 093a:2608 [ 179.853038][ T7551] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.998224][ T10] gspca_pac7311: reg_w() failed index 0xff, value 0x01, error -71 [ 180.013097][ T10] pac7311 3-1:0.79: probe with driver pac7311 failed with error -71 [ 180.027404][ T30] audit: type=1400 audit(1744862181.765:421): avc: denied { watch watch_reads } for pid=7576 comm="syz.4.378" path=2F6D656D66643A2D42D54E49C56A9A08202864656C6574656429 dev="tmpfs" ino=47 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 180.054075][ C0] vkms_vblank_simulate: vblank timer overrun [ 180.196451][ T10] usb 3-1: USB disconnect, device number 9 [ 180.557818][ T30] audit: type=1400 audit(1744862181.765:422): avc: denied { read } for pid=7576 comm="syz.4.378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 180.801357][ T30] audit: type=1400 audit(1744862182.505:423): avc: denied { ioctl } for pid=7576 comm="syz.4.378" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x70cb scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 180.929331][ T7551] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.953721][ T7551] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.970725][ T7551] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.987044][ T7551] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.185472][ T5913] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 182.065553][ T5913] usb 1-1: Using ep0 maxpacket: 16 [ 182.078874][ T5913] usb 1-1: unable to get BOS descriptor or descriptor too short [ 182.092324][ T5913] usb 1-1: config 9 has an invalid interface number: 212 but max is 0 [ 182.103062][ T5913] usb 1-1: config 9 has no interface number 0 [ 182.121374][ T7649] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.159110][ T5913] usb 1-1: config 9 interface 212 has no altsetting 0 [ 182.278922][ T5913] usb 1-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 182.288919][ T5867] usb 5-1: USB disconnect, device number 15 [ 182.299113][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.322467][ T5913] usb 1-1: Product: syz [ 182.344107][ T5913] usb 1-1: Manufacturer: syz [ 182.354688][ T7649] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.384067][ T5913] usb 1-1: SerialNumber: syz [ 182.402784][ T30] audit: type=1400 audit(1744862184.135:424): avc: denied { listen } for pid=7657 comm="syz.4.395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 182.439250][ T7649] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.506741][ T24] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 182.526936][ T7649] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.541465][ T7655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.612645][ T5913] ttusbir 1-1:9.212: cannot find expected altsetting [ 182.622069][ T5913] usb 1-1: USB disconnect, device number 10 [ 182.705499][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 182.714250][ T24] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 182.725314][ T24] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 182.734987][ T24] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 182.747603][ T24] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 182.756870][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.764839][ T24] usb 3-1: Product: syz [ 182.769672][ T24] usb 3-1: Manufacturer: syz [ 182.774241][ T24] usb 3-1: SerialNumber: syz [ 183.185198][ T24] usb 3-1: 2:1 : format type 0 is detected, processed as PCM [ 183.634039][ T7652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.649310][ T7652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.195809][ T7652] netlink: 4 bytes leftover after parsing attributes in process `syz.2.393'. [ 184.543691][ T7703] affs: No valid root block on device nullb0 [ 184.638276][ T1202] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 184.912197][ T7703] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 184.943313][ T7703] 9pnet_fd: Insufficient options for proto=fd [ 184.980253][ T7703] bond1: entered promiscuous mode [ 185.132708][ T24] usb 3-1: USB disconnect, device number 10 [ 185.431135][ T6211] udevd[6211]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 185.466985][ T1202] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 185.479158][ T1202] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 185.928364][ T1202] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 185.949814][ T1202] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.251029][ T1202] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 186.263548][ T1202] usb 2-1: invalid MIDI out EP 0 [ 186.312851][ T7721] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 186.397407][ T7649] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.439486][ T1202] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 186.452630][ T7649] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.483772][ T1202] usb 2-1: USB disconnect, device number 14 [ 186.708467][ T6037] udevd[6037]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 186.730684][ T7649] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.232850][ T7649] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.254791][ T7752] warning: `syz.4.417' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 188.518460][ T7768] fuse: Bad value for 'fd' [ 188.601560][ T1202] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 189.096996][ T1202] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 189.132909][ T1202] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.145696][ T7770] netlink: 68 bytes leftover after parsing attributes in process `syz.1.425'. [ 189.167593][ T1202] usb 5-1: config 0 interface 0 has no altsetting 0 [ 189.175315][ T1202] usb 5-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 189.535923][ T1202] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.578547][ T7779] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.642580][ T1202] usb 5-1: config 0 descriptor?? [ 189.884381][ T7779] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.315503][ T1202] saitek 0003:06A3:0621.0005: unknown main item tag 0x3 [ 190.351608][ T1202] saitek 0003:06A3:0621.0005: hidraw0: USB HID v0.00 Device [HID 06a3:0621] on usb-dummy_hcd.4-1/input0 [ 190.369213][ T7790] bridge3: entered promiscuous mode [ 190.380763][ T7790] bridge3: entered allmulticast mode [ 190.390001][ T7779] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.527727][ T7779] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.620368][ T5831] usb 5-1: USB disconnect, device number 16 [ 191.346159][ T7779] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.381791][ T7779] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.407635][ T7779] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.421718][ T7779] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.484318][ T30] audit: type=1400 audit(1744862193.215:425): avc: denied { mount } for pid=7806 comm="syz.2.435" name="/" dev="ramfs" ino=15708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 191.560457][ T30] audit: type=1400 audit(1744862193.285:426): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 191.687627][ T5831] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 191.855847][ T5831] usb 1-1: device descriptor read/64, error -71 [ 191.915568][ T972] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 192.123770][ T972] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 192.170221][ T972] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.875068][ T972] usb 3-1: config 0 descriptor?? [ 192.888880][ T5831] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 192.973638][ T7826] mkiss: ax0: crc mode is auto. [ 193.035929][ T5831] usb 1-1: device descriptor read/64, error -71 [ 193.062246][ T7828] mkiss: ax0: crc mode is auto. [ 193.106192][ T5867] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 193.178706][ T5831] usb usb1-port1: attempt power cycle [ 193.395684][ T5867] usb 4-1: Using ep0 maxpacket: 32 [ 193.408691][ T5867] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 40727, setting to 1024 [ 193.430610][ T5867] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 193.443152][ T5867] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 193.453336][ T5867] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.462068][ T5867] usb 4-1: Product: syz [ 193.468827][ T5867] usb 4-1: Manufacturer: syz [ 193.473448][ T5867] usb 4-1: SerialNumber: syz [ 193.484533][ T5867] usb 4-1: config 0 descriptor?? [ 193.492294][ T7823] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 193.514335][ T5867] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 193.527914][ T5831] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 193.555933][ T5831] usb 1-1: device descriptor read/8, error -71 [ 193.776039][ T5867] usb 4-1: USB disconnect, device number 6 [ 193.784559][ T71] usb 4-1: Failed to submit usb control message: -71 [ 193.831144][ T71] usb 4-1: unable to send the bmi data to the device: -71 [ 193.900825][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.907164][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.943190][ T972] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 193.958273][ T71] usb 4-1: unable to get target info from device [ 194.005663][ T71] usb 4-1: could not get target info (-71) [ 194.026500][ T972] asix 3-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 194.072980][ T71] usb 4-1: could not probe fw (-71) [ 194.832709][ T972] asix 3-1:0.0: probe with driver asix failed with error -71 [ 194.948537][ T30] audit: type=1400 audit(1744862196.685:427): avc: denied { listen } for pid=7837 comm="syz.0.445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 194.955646][ T972] usb 3-1: USB disconnect, device number 11 [ 195.439963][ T7848] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.705002][ T7848] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.803147][ T7848] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.952897][ T7848] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.209203][ T7861] netlink: 8 bytes leftover after parsing attributes in process `syz.0.453'. [ 196.218505][ T7861] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 196.245635][ T7861] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 196.895660][ T5867] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 196.993827][ T7848] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.055444][ T5867] usb 4-1: Using ep0 maxpacket: 16 [ 197.121935][ T5867] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 197.205320][ T5867] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 197.297549][ T5867] usb 4-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 197.346925][ T7848] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.365424][ T5867] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.391568][ T7874] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.396423][ T5867] usb 4-1: config 0 descriptor?? [ 197.443836][ T7848] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.471772][ T7848] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.518048][ T7874] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.143049][ T972] usb 4-1: USB disconnect, device number 7 [ 199.377505][ T7874] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.469614][ T7874] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.617945][ T7874] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.630941][ T7896] xt_CT: No such helper "snmp" [ 199.741666][ T7874] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.781612][ T7900] FAULT_INJECTION: forcing a failure. [ 199.781612][ T7900] name failslab, interval 1, probability 0, space 0, times 0 [ 199.803785][ T7900] CPU: 0 UID: 0 PID: 7900 Comm: syz.4.462 Not tainted 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 PREEMPT(full) [ 199.803807][ T7900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 199.803817][ T7900] Call Trace: [ 199.803822][ T7900] [ 199.803828][ T7900] dump_stack_lvl+0x16c/0x1f0 [ 199.803854][ T7900] should_fail_ex+0x512/0x640 [ 199.803871][ T7900] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 199.803892][ T7900] should_failslab+0xc2/0x120 [ 199.803910][ T7900] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 199.803927][ T7900] ? __alloc_skb+0x2b2/0x380 [ 199.803950][ T7900] __alloc_skb+0x2b2/0x380 [ 199.803967][ T7900] ? __pfx___alloc_skb+0x10/0x10 [ 199.803985][ T7900] ? __mutex_trylock_common+0x90/0x250 [ 199.804004][ T7900] ? __pfx___mutex_trylock_common+0x10/0x10 [ 199.804024][ T7900] netlink_dump+0x698/0xd00 [ 199.804046][ T7900] ? __mutex_lock+0x1ca/0xb90 [ 199.804070][ T7900] ? __pfx_netlink_dump+0x10/0x10 [ 199.804088][ T7900] ? __rhashtable_lookup.constprop.0+0x3a5/0x760 [ 199.804108][ T7900] ? __netlink_dump_start+0x150/0x990 [ 199.804137][ T7900] ? netlink_lookup+0x258/0x520 [ 199.804156][ T7900] ? __pfx_netlink_lookup+0x10/0x10 [ 199.804184][ T7900] __netlink_dump_start+0x6d6/0x990 [ 199.804207][ T7900] ? __pfx_inet_dump_ifmcaddr+0x10/0x10 [ 199.804228][ T7900] rtnetlink_rcv_msg+0xb3e/0xe90 [ 199.804247][ T7900] ? __pfx_inet_dump_ifmcaddr+0x10/0x10 [ 199.804269][ T7900] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 199.804290][ T7900] ? __pfx_inet_dump_ifmcaddr+0x10/0x10 [ 199.804320][ T7900] netlink_rcv_skb+0x16a/0x440 [ 199.804342][ T7900] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 199.804364][ T7900] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 199.804400][ T7900] ? netlink_deliver_tap+0x1ae/0xd30 [ 199.804427][ T7900] netlink_unicast+0x53a/0x7f0 [ 199.804451][ T7900] ? __pfx_netlink_unicast+0x10/0x10 [ 199.804480][ T7900] netlink_sendmsg+0x8d1/0xdd0 [ 199.804512][ T7900] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.804544][ T7900] ____sys_sendmsg+0xa95/0xc70 [ 199.804570][ T7900] ? copy_msghdr_from_user+0x10a/0x160 [ 199.804589][ T7900] ? __pfx_____sys_sendmsg+0x10/0x10 [ 199.804625][ T7900] ___sys_sendmsg+0x134/0x1d0 [ 199.804647][ T7900] ? __pfx____sys_sendmsg+0x10/0x10 [ 199.804698][ T7900] __sys_sendmsg+0x16d/0x220 [ 199.804719][ T7900] ? __pfx___sys_sendmsg+0x10/0x10 [ 199.804746][ T7900] ? rcu_is_watching+0x12/0xc0 [ 199.804773][ T7900] do_syscall_64+0xcd/0x260 [ 199.804798][ T7900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.804814][ T7900] RIP: 0033:0x7f262198e169 [ 199.804828][ T7900] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 199.804843][ T7900] RSP: 002b:00007f262287a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 199.804858][ T7900] RAX: ffffffffffffffda RBX: 00007f2621bb5fa0 RCX: 00007f262198e169 [ 199.804869][ T7900] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 199.804879][ T7900] RBP: 00007f262287a090 R08: 0000000000000000 R09: 0000000000000000 [ 199.804888][ T7900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.804898][ T7900] R13: 0000000000000000 R14: 00007f2621bb5fa0 R15: 00007ffee36f3828 [ 199.804921][ T7900] [ 199.817271][ T7874] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.028002][ T30] audit: type=1400 audit(1744862201.755:428): avc: denied { ioctl } for pid=7903 comm="syz.3.463" path="socket:[16930]" dev="sockfs" ino=16930 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 200.508313][ T7874] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.845497][ T24] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 200.926247][ T30] audit: type=1400 audit(1744862202.635:429): avc: denied { watch } for pid=7914 comm="syz.3.467" path="/108" dev="tmpfs" ino=570 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 201.051499][ T24] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 201.063796][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 201.895835][ T30] audit: type=1400 audit(1744862203.625:430): avc: denied { map } for pid=7914 comm="syz.3.467" path="socket:[16940]" dev="sockfs" ino=16940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 201.925586][ T30] audit: type=1400 audit(1744862203.625:431): avc: denied { accept } for pid=7914 comm="syz.3.467" path="socket:[16940]" dev="sockfs" ino=16940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 201.965895][ T5867] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 201.973487][ T24] usb 5-1: config 0 has no interface number 0 [ 202.010161][ T24] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 202.030463][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.050373][ T24] usb 5-1: Product: syz [ 202.059292][ T24] usb 5-1: Manufacturer: syz [ 202.073075][ T24] usb 5-1: SerialNumber: syz [ 202.085327][ T24] usb 5-1: config 0 descriptor?? [ 202.105016][ T24] hub 5-1:0.31: bad descriptor, ignoring hub [ 202.208841][ T5867] usb 1-1: Using ep0 maxpacket: 16 [ 202.257382][ T5867] usb 1-1: config 3 has an invalid descriptor of length 202, skipping remainder of the config [ 202.313423][ T24] hub 5-1:0.31: probe with driver hub failed with error -5 [ 202.329887][ T5867] usb 1-1: config 3 has 0 interfaces, different from the descriptor's value: 1 [ 202.357949][ T5867] usb 1-1: New USB device found, idVendor=15c2, idProduct=0046, bcdDevice=5e.15 [ 202.369440][ T24] usb 5-1: USB disconnect, device number 17 [ 202.377021][ T5867] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.391666][ T5867] usb 1-1: Product: syz [ 202.397723][ T5867] usb 1-1: Manufacturer: syz [ 202.402760][ T5867] usb 1-1: SerialNumber: syz [ 202.575580][ T5868] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 202.638724][ T24] usb 1-1: USB disconnect, device number 15 [ 202.725617][ T5868] usb 4-1: Using ep0 maxpacket: 16 [ 202.733749][ T5868] usb 4-1: unable to get BOS descriptor or descriptor too short [ 202.744856][ T5868] usb 4-1: config 9 has an invalid interface number: 212 but max is 0 [ 202.754494][ T5868] usb 4-1: config 9 has no interface number 0 [ 202.762842][ T5868] usb 4-1: config 9 interface 212 has no altsetting 0 [ 202.773375][ T5868] usb 4-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 202.788267][ T5868] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.797694][ T5868] usb 4-1: Product: syz [ 202.801907][ T5868] usb 4-1: Manufacturer: syz [ 202.809339][ T5868] usb 4-1: SerialNumber: syz [ 202.892976][ T7931] xt_TCPMSS: Only works on TCP SYN packets [ 203.008849][ T7935] sctp: [Deprecated]: syz.2.474 (pid 7935) Use of struct sctp_assoc_value in delayed_ack socket option. [ 203.008849][ T7935] Use struct sctp_sack_info instead [ 203.070552][ T5868] ttusbir 4-1:9.212: cannot find expected altsetting [ 203.225963][ T5868] usb 4-1: USB disconnect, device number 8 [ 203.285316][ T7940] 9pnet_virtio: no channels available for device 127.0.0.1 [ 203.304982][ T7940] tipc: Started in network mode [ 203.309930][ T7940] tipc: Node identity ac14140f, cluster identity 4711 [ 203.317716][ T7940] tipc: New replicast peer: 255.255.255.255 [ 203.325469][ T7940] tipc: Enabled bearer , priority 10 [ 203.345476][ T30] audit: type=1400 audit(1744862205.075:432): avc: denied { create } for pid=7936 comm="syz.2.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 204.202264][ T5868] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 204.437142][ T5831] tipc: Node number set to 2886997007 [ 205.440508][ T5868] usb 1-1: Using ep0 maxpacket: 16 [ 205.450889][ T5868] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.485530][ T5868] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 205.494484][ T5868] usb 1-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 205.503611][ T5868] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.541170][ T5868] usb 1-1: config 0 descriptor?? [ 205.661500][ T7964] netlink: 68 bytes leftover after parsing attributes in process `syz.3.483'. [ 206.088761][ T10] usb 1-1: USB disconnect, device number 16 [ 206.173394][ T30] audit: type=1400 audit(1744862207.875:433): avc: denied { create } for pid=7969 comm="syz.3.487" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 206.375426][ T5868] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 206.640531][ T30] audit: type=1400 audit(1744862207.895:434): avc: denied { write } for pid=7969 comm="syz.3.487" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 207.055478][ T5868] usb 5-1: Using ep0 maxpacket: 32 [ 207.078412][ T5868] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 207.124746][ T5868] usb 5-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 207.186242][ T5868] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.225043][ T5868] usb 5-1: config 0 descriptor?? [ 207.292575][ T7982] loop7: detected capacity change from 0 to 7 [ 207.578897][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.588161][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.595440][ T7987] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 207.623825][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.632992][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.652274][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.661430][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.671927][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.681084][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.692415][ T7987] syzkaller1: entered promiscuous mode [ 207.698102][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.699117][ T7987] syzkaller1: entered allmulticast mode [ 207.707242][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.722375][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.731533][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.740281][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.749457][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.757470][ T7982] ldm_validate_partition_table(): Disk read failed. [ 207.764571][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.773726][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.781963][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.791108][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.853764][ T30] audit: type=1400 audit(1744862209.525:435): avc: denied { ioctl } for pid=7986 comm="syz.0.492" path="socket:[17090]" dev="sockfs" ino=17090 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 207.855136][ T5868] dragonrise 0003:0079:0006.0006: hidraw0: USB HID v0.00 Device [HID 0079:0006] on usb-dummy_hcd.4-1/input0 [ 207.878261][ C1] vkms_vblank_simulate: vblank timer overrun [ 207.890805][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 207.903249][ T5868] dragonrise 0003:0079:0006.0006: no inputs found [ 207.905281][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 207.923485][ T7982] Dev loop7: unable to read RDB block 0 [ 207.946291][ T7982] loop7: unable to read partition table [ 207.952558][ T7982] loop7: partition table beyond EOD, truncated [ 207.965787][ T7982] loop_reread_partitions: partition scan of loop7 (þ被xü—ŸÑà– ) failed (rc=-5) [ 208.084456][ T5868] dragonrise 0003:0079:0006.0006: force feedback init failed [ 208.098127][ T5868] usb 5-1: USB disconnect, device number 18 [ 209.512652][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 209.522808][ T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 209.532778][ T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 209.541700][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 209.549809][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 210.108756][ T8004] chnl_net:caif_netlink_parms(): no params data found [ 210.225584][ T24] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 210.233351][ T5868] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 210.234675][ T8027] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.347490][ T5867] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 210.398717][ T8027] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.435678][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 210.456174][ T5868] usb 4-1: Using ep0 maxpacket: 16 [ 210.474053][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.501135][ T5868] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.548329][ T24] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 210.558078][ T5867] usb 3-1: Using ep0 maxpacket: 16 [ 210.563245][ T5868] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 210.573442][ T8027] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.577750][ T5867] usb 3-1: unable to get BOS descriptor or descriptor too short [ 210.593597][ T24] usb 5-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 210.603033][ T5868] usb 4-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 210.612278][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.613365][ T8004] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.621326][ T5867] usb 3-1: config 9 has an invalid interface number: 212 but max is 0 [ 210.638923][ T5868] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.647096][ T8004] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.654202][ T8004] bridge_slave_0: entered allmulticast mode [ 210.661775][ T8004] bridge_slave_0: entered promiscuous mode [ 210.666937][ T24] usb 5-1: config 0 descriptor?? [ 210.673626][ T8027] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.684550][ T5868] usb 4-1: config 0 descriptor?? [ 210.689630][ T5867] usb 3-1: config 9 has no interface number 0 [ 210.696580][ T5867] usb 3-1: config 9 interface 212 has no altsetting 0 [ 210.697142][ T8004] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.724999][ T8004] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.726143][ T5867] usb 3-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 210.734969][ T8004] bridge_slave_1: entered allmulticast mode [ 210.751457][ T5867] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.754869][ T8004] bridge_slave_1: entered promiscuous mode [ 210.766657][ T5867] usb 3-1: Product: syz [ 210.778442][ T5867] usb 3-1: Manufacturer: syz [ 210.783260][ T5867] usb 3-1: SerialNumber: syz [ 210.790791][ T8027] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.814441][ T8027] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.838924][ T8027] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.851319][ T8004] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.868885][ T8027] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.879129][ T8004] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.988932][ T8004] team0: Port device team_slave_0 added [ 211.004458][ T8004] team0: Port device team_slave_1 added [ 211.013156][ T5867] ttusbir 3-1:9.212: cannot find expected altsetting [ 211.032539][ T5867] usb 3-1: USB disconnect, device number 12 [ 211.320261][ T5831] usb 5-1: USB disconnect, device number 19 [ 211.330110][ T8004] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 211.339874][ T8004] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 211.379773][ T8004] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 211.384527][ T9] usb 4-1: USB disconnect, device number 9 [ 211.392076][ T8004] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 211.403130][ T8004] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 211.431011][ T8004] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 211.465062][ T8004] hsr_slave_0: entered promiscuous mode [ 211.472393][ T8004] hsr_slave_1: entered promiscuous mode [ 211.478497][ T8004] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 211.486269][ T8004] Cannot create hsr debugfs directory [ 211.606004][ T5821] Bluetooth: hci2: command tx timeout [ 211.712075][ T8004] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 211.721879][ T8004] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 211.732650][ T8004] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 211.746068][ T8004] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 211.855871][ T8004] 8021q: adding VLAN 0 to HW filter on device bond0 [ 211.878016][ T8004] 8021q: adding VLAN 0 to HW filter on device team0 [ 211.903988][ T2993] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.911089][ T2993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 211.930603][ T2993] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.937759][ T2993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 213.070256][ T8004] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 213.775523][ T5821] Bluetooth: hci2: command tx timeout [ 214.355220][ T5831] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 214.535014][ T8004] veth0_vlan: entered promiscuous mode [ 214.538367][ T8090] netlink: 'syz.2.518': attribute type 21 has an invalid length. [ 214.558789][ T8004] veth1_vlan: entered promiscuous mode [ 214.588448][ T8004] veth0_macvtap: entered promiscuous mode [ 214.600281][ T8004] veth1_macvtap: entered promiscuous mode [ 214.617114][ T30] audit: type=1400 audit(1744862216.345:436): avc: denied { mount } for pid=8088 comm="syz.2.518" name="/" dev="autofs" ino=17806 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 214.661592][ T5831] usb 1-1: Using ep0 maxpacket: 16 [ 214.705454][ T5831] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 214.721423][ T8093] RDS: rds_bind could not find a transport for ::ffff:172.30.0.4, load rds_tcp or rds_rdma? [ 214.729760][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 214.773006][ T5831] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 214.796195][ T30] audit: type=1400 audit(1744862216.425:437): avc: denied { create } for pid=8091 comm="syz.3.519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 214.796691][ T5831] usb 1-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 214.821284][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.834673][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 214.834964][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.845320][ T30] audit: type=1400 audit(1744862216.435:438): avc: denied { bind } for pid=8091 comm="syz.3.519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 214.872213][ T5871] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 215.081055][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.085276][ T5831] usb 1-1: config 0 descriptor?? [ 215.101218][ T30] audit: type=1400 audit(1744862216.555:439): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 215.115571][ T8092] ptrace attach of ""[8094] was attempted by "./syz-executor exec"[8092] [ 215.142232][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 215.155498][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.155537][ T5871] usb 5-1: Using ep0 maxpacket: 16 [ 215.165286][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 215.165302][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.165320][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 215.165331][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.217221][ T5871] usb 5-1: unable to get BOS descriptor or descriptor too short [ 215.226529][ T5871] usb 5-1: config 9 has an invalid interface number: 212 but max is 0 [ 215.234722][ T5871] usb 5-1: config 9 has no interface number 0 [ 215.242057][ T8004] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 215.275426][ T5871] usb 5-1: config 9 interface 212 has no altsetting 0 [ 215.392204][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 215.404590][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.421090][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 215.431582][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.449900][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 215.462563][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.474810][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 215.487530][ T5871] usb 5-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=7f.22 [ 215.496753][ T5871] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.506443][ T5871] usb 5-1: Product: syz [ 215.511379][ T5871] usb 5-1: Manufacturer: syz [ 215.525494][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.535321][ T5871] usb 5-1: SerialNumber: syz [ 215.568302][ T8004] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 215.608840][ T8004] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 215.628823][ T8004] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 215.644219][ T8100] netlink: 4 bytes leftover after parsing attributes in process `syz.2.521'. [ 215.805486][ T5821] Bluetooth: hci2: command tx timeout [ 216.448239][ T5868] usb 1-1: USB disconnect, device number 17 [ 216.464482][ T5871] ttusbir 5-1:9.212: cannot find expected altsetting [ 216.479646][ T8004] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.523937][ T5871] usb 5-1: USB disconnect, device number 20 [ 216.545525][ T8004] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.569491][ T8004] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.589469][ T8004] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.807100][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 216.814909][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 216.945489][ T191] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 216.954199][ T191] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.557368][ T8123] netlink: 'syz.4.526': attribute type 1 has an invalid length. [ 219.435455][ T54] Bluetooth: hci2: command tx timeout [ 220.094989][ T8130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.526'. [ 220.198134][ T8130] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 220.207761][ T8130] bond2: (slave batadv1): Enslaving as a backup interface with an up link [ 220.275547][ T5867] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 220.326889][ T8140] [ 220.329234][ T8140] ====================================================== [ 220.336239][ T8140] WARNING: possible circular locking dependency detected [ 220.343244][ T8140] 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 Not tainted [ 220.350328][ T8140] ------------------------------------------------------ [ 220.357330][ T8140] syz.0.531/8140 is trying to acquire lock: [ 220.363208][ T8140] ffffffff9012caa8 (rtnl_mutex){+.+.}-{4:4}, at: ip_mroute_setsockopt+0x115/0x1040 [ 220.372516][ T8140] [ 220.372516][ T8140] but task is already holding lock: [ 220.379857][ T8140] ffff888050f10aa8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x100/0xa00 [ 220.389922][ T8140] [ 220.389922][ T8140] which lock already depends on the new lock. [ 220.389922][ T8140] [ 220.400306][ T8140] [ 220.400306][ T8140] the existing dependency chain (in reverse order) is: [ 220.409298][ T8140] [ 220.409298][ T8140] -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}: [ 220.417872][ T8140] __mutex_lock+0x199/0xb90 [ 220.422878][ T8140] smc_switch_to_fallback+0x2d/0x9f0 [ 220.428660][ T8140] smc_sendmsg+0x13d/0x520 [ 220.433570][ T8140] __sys_sendto+0x495/0x510 [ 220.438571][ T8140] __x64_sys_sendto+0xe0/0x1c0 [ 220.443831][ T8140] do_syscall_64+0xcd/0x260 [ 220.448835][ T8140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.455224][ T8140] [ 220.455224][ T8140] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [ 220.462842][ T8140] lock_sock_nested+0x41/0xf0 [ 220.468020][ T8140] sockopt_lock_sock+0x54/0x70 [ 220.473282][ T8140] do_ip_setsockopt+0xfe/0x3240 [ 220.478635][ T8140] ip_setsockopt+0x59/0xf0 [ 220.483546][ T8140] udp_setsockopt+0x7d/0xd0 [ 220.488550][ T8140] do_sock_setsockopt+0x221/0x470 [ 220.494075][ T8140] __sys_setsockopt+0x1a0/0x230 [ 220.499427][ T8140] __x64_sys_setsockopt+0xbd/0x160 [ 220.505037][ T8140] do_syscall_64+0xcd/0x260 [ 220.510042][ T8140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.516432][ T8140] [ 220.516432][ T8140] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 220.523614][ T8140] __lock_acquire+0x1173/0x1ba0 [ 220.528965][ T8140] lock_acquire+0x179/0x350 [ 220.533964][ T8140] __mutex_lock+0x199/0xb90 [ 220.538968][ T8140] ip_mroute_setsockopt+0x115/0x1040 [ 220.544754][ T8140] do_ip_setsockopt+0x2ae/0x3240 [ 220.550198][ T8140] ip_setsockopt+0x59/0xf0 [ 220.555110][ T8140] ipv6_setsockopt+0x155/0x170 [ 220.560374][ T8140] tcp_setsockopt+0xa4/0x100 [ 220.565461][ T8140] smc_setsockopt+0x1b3/0xa00 [ 220.570634][ T8140] do_sock_setsockopt+0x221/0x470 [ 220.576162][ T8140] __sys_setsockopt+0x1a0/0x230 [ 220.581509][ T8140] __x64_sys_setsockopt+0xbd/0x160 [ 220.587121][ T8140] do_syscall_64+0xcd/0x260 [ 220.592126][ T8140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.598520][ T8140] [ 220.598520][ T8140] other info that might help us debug this: [ 220.598520][ T8140] [ 220.608721][ T8140] Chain exists of: [ 220.608721][ T8140] rtnl_mutex --> sk_lock-AF_INET --> &smc->clcsock_release_lock [ 220.608721][ T8140] [ 220.622253][ T8140] Possible unsafe locking scenario: [ 220.622253][ T8140] [ 220.629680][ T8140] CPU0 CPU1 [ 220.635020][ T8140] ---- ---- [ 220.640361][ T8140] lock(&smc->clcsock_release_lock); [ 220.645711][ T8140] lock(sk_lock-AF_INET); [ 220.652622][ T8140] lock(&smc->clcsock_release_lock); [ 220.660488][ T8140] lock(rtnl_mutex); [ 220.664450][ T8140] [ 220.664450][ T8140] *** DEADLOCK *** [ 220.664450][ T8140] [ 220.672566][ T8140] 1 lock held by syz.0.531/8140: [ 220.677475][ T8140] #0: ffff888050f10aa8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x100/0xa00 [ 220.687974][ T8140] [ 220.687974][ T8140] stack backtrace: [ 220.693840][ T8140] CPU: 0 UID: 0 PID: 8140 Comm: syz.0.531 Not tainted 6.15.0-rc2-syzkaller-00048-gc62f4b82d571 #0 PREEMPT(full) [ 220.693857][ T8140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 220.693865][ T8140] Call Trace: [ 220.693869][ T8140] [ 220.693874][ T8140] dump_stack_lvl+0x116/0x1f0 [ 220.693892][ T8140] print_circular_bug+0x275/0x350 [ 220.693913][ T8140] check_noncircular+0x14c/0x170 [ 220.693933][ T8140] __lock_acquire+0x1173/0x1ba0 [ 220.693948][ T8140] lock_acquire+0x179/0x350 [ 220.693959][ T8140] ? ip_mroute_setsockopt+0x115/0x1040 [ 220.693976][ T8140] ? __pfx___might_resched+0x10/0x10 [ 220.693994][ T8140] ? find_held_lock+0x2b/0x80 [ 220.694010][ T8140] __mutex_lock+0x199/0xb90 [ 220.694027][ T8140] ? ip_mroute_setsockopt+0x115/0x1040 [ 220.694043][ T8140] ? lock_acquire+0x179/0x350 [ 220.694054][ T8140] ? ip_mroute_setsockopt+0x115/0x1040 [ 220.694070][ T8140] ? __pfx___mutex_lock+0x10/0x10 [ 220.694087][ T8140] ? finish_task_switch.isra.0+0x221/0xc10 [ 220.694105][ T8140] ? rcu_is_watching+0x12/0xc0 [ 220.694120][ T8140] ? trace_sched_exit_tp+0xde/0x130 [ 220.694139][ T8140] ? ip_mroute_setsockopt+0x115/0x1040 [ 220.694154][ T8140] ? rtnl_lock+0x9/0x20 [ 220.694165][ T8140] ip_mroute_setsockopt+0x115/0x1040 [ 220.694185][ T8140] ? look_up_lock_class+0x59/0x150 [ 220.694202][ T8140] ? __pfx_ip_mroute_setsockopt+0x10/0x10 [ 220.694218][ T8140] ? __lock_acquire+0x5ca/0x1ba0 [ 220.694230][ T8140] ? __lock_acquire+0xaa4/0x1ba0 [ 220.694244][ T8140] do_ip_setsockopt+0x2ae/0x3240 [ 220.694263][ T8140] ? __pfx___mutex_trylock_common+0x10/0x10 [ 220.694276][ T8140] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 220.694295][ T8140] ? rcu_is_watching+0x12/0xc0 [ 220.694310][ T8140] ? trace_contention_end+0xdd/0x130 [ 220.694322][ T8140] ? __mutex_lock+0x1ca/0xb90 [ 220.694337][ T8140] ? avc_has_perm+0x11a/0x1c0 [ 220.694349][ T8140] ? __pfx_avc_has_perm+0x10/0x10 [ 220.694360][ T8140] ? smc_setsockopt+0x100/0xa00 [ 220.694372][ T8140] ip_setsockopt+0x59/0xf0 [ 220.694384][ T8140] ipv6_setsockopt+0x155/0x170 [ 220.694402][ T8140] tcp_setsockopt+0xa4/0x100 [ 220.694419][ T8140] smc_setsockopt+0x1b3/0xa00 [ 220.694431][ T8140] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 220.694449][ T8140] ? __pfx_smc_setsockopt+0x10/0x10 [ 220.694462][ T8140] ? selinux_socket_setsockopt+0x6a/0x80 [ 220.694478][ T8140] ? __pfx_smc_setsockopt+0x10/0x10 [ 220.694491][ T8140] do_sock_setsockopt+0x221/0x470 [ 220.694508][ T8140] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 220.694530][ T8140] __sys_setsockopt+0x1a0/0x230 [ 220.694546][ T8140] __x64_sys_setsockopt+0xbd/0x160 [ 220.694559][ T8140] ? do_syscall_64+0x91/0x260 [ 220.694576][ T8140] ? lockdep_hardirqs_on+0x7c/0x110 [ 220.694591][ T8140] do_syscall_64+0xcd/0x260 [ 220.694608][ T8140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.694621][ T8140] RIP: 0033:0x7fe83b38e169 [ 220.694632][ T8140] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 220.694644][ T8140] RSP: 002b:00007fe83c115038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 220.694656][ T8140] RAX: ffffffffffffffda RBX: 00007fe83b5b6080 RCX: 00007fe83b38e169 [ 220.694665][ T8140] RDX: 00000000000000cd RSI: 0000000000000000 RDI: 0000000000000005 [ 220.694672][ T8140] RBP: 00007fe83b410a68 R08: 000000000000003c R09: 0000000000000000 [ 220.694680][ T8140] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000000 [ 220.694688][ T8140] R13: 0000000000000000 R14: 00007fe83b5b6080 R15: 00007fff15b02178 [ 220.694700][ T8140] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)