last executing test programs: 2m30.352668655s ago: executing program 3 (id=158): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r2, 0x0) r3 = syz_io_uring_setup(0xb05, &(0x7f0000000480)={0x0, 0xa795, 0x0, 0x0, 0x2f5}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r2, 0x0, 0x0}) io_uring_enter(r3, 0x47be, 0x1, 0x0, 0x0, 0x0) 2m27.669542562s ago: executing program 3 (id=170): set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x7) bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) bind$alg(r3, &(0x7f00000006c0)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-160\x00'}, 0x58) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004811) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c080) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan1\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) 2m21.842279765s ago: executing program 3 (id=181): socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)='e\a', 0x2) memfd_create(&(0x7f0000000040)='%\x00', 0x3) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x14d142, 0x0) socket(0x11, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000010"], 0x34}}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6(0xa, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m20.541146168s ago: executing program 3 (id=187): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000a40)={'wpan0\x00'}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r0, 0x0, 0x80) 2m19.003997807s ago: executing program 3 (id=189): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), 0x0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90124fc60", 0x14}], 0x1}, 0x0) 2m17.513531741s ago: executing program 3 (id=191): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs$namespace(r1, 0x0) listen(0xffffffffffffffff, 0x80) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x9}, 0x94) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4014001}, 0x9590f6cc3ea35512) socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, &(0x7f00000007c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 2m16.269309652s ago: executing program 1 (id=196): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000480)=0x1df9, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) 2m15.819202098s ago: executing program 1 (id=197): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x14004, 0x100000, 0x10, 0x1, 0xfe, 0x0, 0x0, 0x6}, {0x0, 0x2000, 0xf, 0xfe, 0x0, 0x0, 0x0, 0xff, 0x8, 0x0, 0x5}, {0xd000, 0x2, 0x0, 0x80, 0xf9, 0x0, 0x0, 0x0, 0x23, 0x0, 0x4}, {0x5000, 0x2, 0xf, 0x41, 0x0, 0x2, 0x2, 0xfc, 0x0, 0x3}, {0x4000, 0xeeef0000, 0xc, 0x1, 0x3, 0x10, 0xc0, 0x0, 0x1, 0x0, 0x4}, {0x0, 0x100000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, {0x8000000, 0x2000, 0xa, 0x0, 0x2, 0xfd, 0x0, 0x7, 0x3a, 0x2}, {0x0, 0x2, 0x0, 0x2, 0x0, 0x6, 0x7, 0x0, 0xfe, 0x0, 0xfe, 0x5}, {0x0, 0x400}, {}, 0xddf8ffdb, 0x0, 0x0, 0x100, 0x7, 0x8000, 0xffff1000, [0x400000000000000, 0x10000000020, 0x2]}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x5, 0x50}) 2m10.350943759s ago: executing program 1 (id=201): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), 0x0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90124fc60", 0x14}], 0x1}, 0x0) 2m8.359712529s ago: executing program 1 (id=204): socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x38, r3, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ffb}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) 2m7.924359512s ago: executing program 1 (id=207): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="8a", 0x5, 0x0, 0xaf0}, 0x50) 2m3.982084983s ago: executing program 1 (id=211): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fanotify_init(0xa00, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000440), r1) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r2, &(0x7f0000000000)={0x0, 0x2, 0x2, 0x0, 0x1}, 0x8) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e23, 0x7f, @empty, 0xffffffff}, 0x1c) listen(r3, 0x2) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) munlockall() bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_DELETE_BATCH(0x18, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) 2m1.781775092s ago: executing program 32 (id=191): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs$namespace(r1, 0x0) listen(0xffffffffffffffff, 0x80) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x9}, 0x94) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4014001}, 0x9590f6cc3ea35512) socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, &(0x7f00000007c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 1m48.528125416s ago: executing program 33 (id=211): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fanotify_init(0xa00, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000440), r1) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r2, &(0x7f0000000000)={0x0, 0x2, 0x2, 0x0, 0x1}, 0x8) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e23, 0x7f, @empty, 0xffffffff}, 0x1c) listen(r3, 0x2) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) munlockall() bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_DELETE_BATCH(0x18, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) 7.767972411s ago: executing program 0 (id=635): socket$pppoe(0x18, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') getdents64(r1, &(0x7f0000000fc0)=""/224, 0xe0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x2) 7.408820174s ago: executing program 0 (id=640): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r7, {}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x80, 0x0, 0x5, 0x1, 0xc}, 0xb, 0x0, 0x5, 0x5, 0x9, 0x2, 0x9, 0xd, 0x2, 0x1, {0xffff1c72, 0x3, 0x1000, 0x101, 0xfffffffe, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8840}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.510333972s ago: executing program 0 (id=647): socket$inet(0x2, 0x3, 0x9) socket$l2tp(0x2, 0x2, 0x73) r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x1000, 0xfffffffd, 0x15f}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r0, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5.132752039s ago: executing program 2 (id=649): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a00)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) munlockall() r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) prlimit64(r1, 0xe, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) syz_init_net_socket$rose(0xb, 0x5, 0x0) r3 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETDEVINFO(r3, 0x80044944, 0x0) 4.865183408s ago: executing program 0 (id=653): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) socket$inet(0x2, 0x3, 0x2) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0) 4.157578454s ago: executing program 5 (id=655): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x48, &(0x7f0000000000)=[@in6={0xa, 0x4e20, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, @in6={0xa, 0x4e24, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1ff}, @in={0x2, 0x4e21, @private=0xa010100}]}, &(0x7f0000000100)=0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$setregs(0xd, r7, 0x9, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4204, r7, 0x2, &(0x7f0000000240)={&(0x7f0000000540)=""/204, 0xcc}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r3, 0x1}, 0x8) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3e, &(0x7f0000000280)=0x6, 0x4) sendmmsg$inet(r1, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback, 0x20}], 0x1c) sendto$inet6(r0, &(0x7f0000000080)="b1", 0x1, 0x4000050, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000980)={0x0, 0x6a, "b981dd7b3eabdd9650b9afea12c43259f7c678561b17cfcad6733d7517456d7be98241a87b8399acab53fb31929f758c3d09009268e18e290bfcd39ba6160b43be7a4334b69499be3569f336cbccdf8d2dee6f06a4fb3bd57c8d189d655d22b16f80afa3eb449b04d706"}, &(0x7f0000000a40)=0x72) 4.058485251s ago: executing program 2 (id=656): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x5c}}, 0x0) 2.939080543s ago: executing program 4 (id=658): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r7, {}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x80, 0x0, 0x5, 0x1, 0xc}, 0xb, 0x0, 0x5, 0x5, 0x9, 0x2, 0x9, 0xd, 0x2, 0x1, {0xffff1c72, 0x3, 0x1000, 0x101, 0xfffffffe, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8840}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.924181665s ago: executing program 2 (id=659): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, 0x0, 0x0) close(0xffffffffffffffff) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r2, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r3, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, &(0x7f0000000240)={0x18, r2}) 2.265925924s ago: executing program 5 (id=660): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000002c0)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(r1) read$FUSE(r2, &(0x7f0000001c00)={0x2020}, 0x2020) add_key$keyring(0x0, &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r3 = fcntl$dupfd(r0, 0x0, r1) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000080)={0x0, r2}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000140), 0xffffffffffffffff) 2.200550536s ago: executing program 6 (id=661): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(0x0, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x1, 0x0, 0x0, {0xa, 0x4e22, 0x5, @remote, 0x8000000}}}, 0x3a) 2.152664979s ago: executing program 2 (id=662): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='uid_map\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) poll(&(0x7f0000000000)=[{r1, 0x8000}], 0x1, 0x7981) syz_open_pts(r1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.098548679s ago: executing program 4 (id=663): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000280)={'syztnl0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, 0x0, &(0x7f0000000200)) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='.\x00', &(0x7f0000000240)='f2fs\x00', 0x0, 0x0) 1.832205115s ago: executing program 5 (id=664): r0 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x80, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9b0906, 0x9, '\x00', @p_u8=&(0x7f0000000080)=0xe}}) 1.660536527s ago: executing program 6 (id=665): socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)='e\a', 0x2) memfd_create(&(0x7f0000000040)='%\x00', 0x3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x14d142, 0x0) socket(0x11, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000010"], 0x34}}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6(0xa, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) mount$tmpfs(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.659968117s ago: executing program 4 (id=666): socket(0x10, 0x80002, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r0}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x3, 0x13, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020200008500000072000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000400)={r2, r4, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x5, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0x4e, &(0x7f0000000800)=ANY=[], 0x0) 1.629818633s ago: executing program 0 (id=667): r0 = socket$nl_generic(0x10, 0x3, 0x10) add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f00000000c0)={0x3, 0x1, {0x54, 0x86, 0x7ff, {0x9, 0x260}, {0x2, 0x101}, @const={0x7fff, {0x3, 0x2, 0x18c, 0xf28d}}}, {0x51, 0x2, 0x87, {0x9, 0x2}, {0x2, 0xfff8}, @period={0x59, 0x5, 0x1, 0x4, 0x3, {0x8, 0x2, 0xfff9, 0x1}, 0x0, 0x0}}}) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000001c0)=0x1) ioctl$VIDIOC_S_FREQUENCY(r5, 0x402c5639, &(0x7f0000000040)={0x0, 0x2, 0xcadb}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000201010400000000000000000a02000a08"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x60) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r7, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) 1.615712876s ago: executing program 5 (id=668): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, 0x0, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prctl$PR_SET_PTRACER(0x59616d61, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_setup(0x8f0, &(0x7f0000002400)=0x0) io_submit(r4, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2002000000, 0x4, 0x0, 0x1, 0x0, r3, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x2008880) r5 = socket$vsock_stream(0x28, 0x1, 0x0) getsockname(r5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000840}, 0x80) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004}, 0x4004050) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 1.431727464s ago: executing program 4 (id=669): pselect6(0x40, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xc3ac, 0x2}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) 1.41381774s ago: executing program 6 (id=670): r0 = socket$inet_icmp(0x2, 0x2, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x30, r2, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_STA_VLAN={0x8, 0x14, r5}, @NL80211_ATTR_MAC={0xa}]}, 0x30}, 0x1, 0x0, 0x0, 0x24008814}, 0x4044094) 808.684377ms ago: executing program 2 (id=671): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/60, 0x3c}], 0x1) 793.510206ms ago: executing program 6 (id=672): r0 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r0, 0x0, 0x31, &(0x7f0000000000)=0xfffffffc, 0x4) 781.99676ms ago: executing program 4 (id=673): socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x28, r4, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ffb}]}, 0x28}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) 685.52326ms ago: executing program 2 (id=674): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() pipe(0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='smaps\x00') r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) close_range(r4, 0xffffffffffffffff, 0x0) 683.13155ms ago: executing program 0 (id=675): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000b80)={0x20, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 632.104822ms ago: executing program 4 (id=676): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x10, 0x1407, 0x1, 0x70bd27, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x40844) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = syz_open_dev$dri(&(0x7f0000000180), 0x78, 0x802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r4, 0x100000000) mremap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00003eb000/0x1000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3, 0xffffffff}, @const={0x0, 0x0, 0x0, 0x2}, @func_proto={0x2, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x44}, 0x20) socket$netlink(0x10, 0x3, 0x12) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$FUSE_ATTR(r5, &(0x7f0000005340)={0x78, 0x0, 0x0, {0x2000000007, 0x400, 0x0, {0x6, 0xfffe000000000000, 0xfffffffffffffffb, 0xff, 0x694, 0x3, 0x7f, 0x9, 0x800, 0x2000, 0x2, 0x0, 0x0, 0xb, 0x8, 0x1000000}}}, 0x78) lremovexattr(0x0, &(0x7f00000001c0)=@known='system.posix_acl_default\x00') sendmsg$NL80211_CMD_CONNECT(r0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) syz_usb_connect$printer(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202", @ANYRESDEC=0x0], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 552.59612ms ago: executing program 6 (id=677): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) socket$inet(0x2, 0x3, 0x2) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0) 510.149949ms ago: executing program 5 (id=678): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000002c0)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(r1) read$FUSE(r2, &(0x7f0000001c00)={0x2020}, 0x2020) r3 = add_key$keyring(0x0, &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000240)='asymmetric\x00', &(0x7f00000000c0)=@chain) r4 = fcntl$dupfd(r0, 0x0, r1) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000140), 0xffffffffffffffff) syz_emit_ethernet(0x68, 0x0, 0x0) 303.740374ms ago: executing program 5 (id=679): syz_usb_connect(0x0, 0x5d, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000551b892075d53b8f88828d03030109024b000100000000090400000002090000052406000005241d00000d240f010002000000"], 0x0) 0s ago: executing program 6 (id=680): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0x1a, r0, 0xc, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) setrlimit(0x40000000000008, &(0x7f00000002c0)={0x0, 0x5}) setresuid(0x0, 0xee00, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r5, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r5, 0x0, &(0x7f0000ff8000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r5}) kernel console output (not intermixed with test programs): ng interface: batadv_slave_1 [ 126.185034][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.211154][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.223232][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.231068][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.257164][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.270305][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.277271][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.303439][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.323484][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 126.356772][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.387747][ T5832] hsr_slave_0: entered promiscuous mode [ 126.393970][ T5832] hsr_slave_1: entered promiscuous mode [ 126.402401][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 126.422583][ T5842] team0: Port device team_slave_0 added [ 126.430336][ T5842] team0: Port device team_slave_1 added [ 126.444326][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.508304][ T5831] hsr_slave_0: entered promiscuous mode [ 126.514353][ T5831] hsr_slave_1: entered promiscuous mode [ 126.520400][ T5831] debugfs: 'hsr0' already exists in 'hsr' [ 126.526168][ T5831] Cannot create hsr debugfs directory [ 126.532194][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.539241][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.565702][ T5845] Bluetooth: hci0: command tx timeout [ 126.571491][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.593019][ T5841] hsr_slave_0: entered promiscuous mode [ 126.599448][ T5841] hsr_slave_1: entered promiscuous mode [ 126.605400][ T5841] debugfs: 'hsr0' already exists in 'hsr' [ 126.611200][ T5841] Cannot create hsr debugfs directory [ 126.627691][ T5845] Bluetooth: hci2: command tx timeout [ 126.634566][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.641829][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.668232][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.680743][ T5830] team0: Port device team_slave_0 added [ 126.707565][ T5834] Bluetooth: hci1: command tx timeout [ 126.713299][ T5845] Bluetooth: hci3: command tx timeout [ 126.725456][ T5830] team0: Port device team_slave_1 added [ 126.780559][ T5842] hsr_slave_0: entered promiscuous mode [ 126.786747][ T5842] hsr_slave_1: entered promiscuous mode [ 126.792556][ T5845] Bluetooth: hci4: command tx timeout [ 126.798386][ T5842] debugfs: 'hsr0' already exists in 'hsr' [ 126.804109][ T5842] Cannot create hsr debugfs directory [ 126.848907][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.855879][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.882740][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.914601][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.921594][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.948451][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 127.107959][ T5830] hsr_slave_0: entered promiscuous mode [ 127.114335][ T5830] hsr_slave_1: entered promiscuous mode [ 127.120831][ T5830] debugfs: 'hsr0' already exists in 'hsr' [ 127.126547][ T5830] Cannot create hsr debugfs directory [ 127.193800][ T5832] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 127.228321][ T5832] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 127.248587][ T5832] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 127.258592][ T5832] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 127.354643][ T5841] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 127.364026][ T5841] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 127.388740][ T5841] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 127.398217][ T5841] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 127.450964][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 127.463961][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 127.477689][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 127.503071][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 127.525170][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.572739][ T5842] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 127.598696][ T5842] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 127.609308][ T5842] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 127.619218][ T5842] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 127.631653][ T5832] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.677589][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.684862][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.722659][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.736202][ T3465] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.743388][ T3465] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.756442][ T5830] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 127.765670][ T5830] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 127.781529][ T5830] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 127.794820][ T5830] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 127.813356][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.836061][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.843208][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.883171][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.890322][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.932822][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.998854][ T30] audit: type=1400 audit(1760603991.029:86): avc: denied { sys_module } for pid=5832 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 128.001228][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.049698][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.056813][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.082051][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.120219][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.127351][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.163499][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.211990][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.237031][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.246845][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.254020][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.322587][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.329902][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.341167][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.348300][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.360396][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.367557][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.394907][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.481142][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.612008][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.638761][ T5845] Bluetooth: hci0: command tx timeout [ 128.691402][ T5841] veth0_vlan: entered promiscuous mode [ 128.707627][ T5845] Bluetooth: hci2: command tx timeout [ 128.756093][ T5841] veth1_vlan: entered promiscuous mode [ 128.772393][ T5831] veth0_vlan: entered promiscuous mode [ 128.788077][ T5845] Bluetooth: hci3: command tx timeout [ 128.788801][ T5834] Bluetooth: hci1: command tx timeout [ 128.812034][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.829075][ T5831] veth1_vlan: entered promiscuous mode [ 128.843435][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.868060][ T5834] Bluetooth: hci4: command tx timeout [ 128.892613][ T5831] veth0_macvtap: entered promiscuous mode [ 128.909830][ T5831] veth1_macvtap: entered promiscuous mode [ 128.933552][ T5832] veth0_vlan: entered promiscuous mode [ 128.954219][ T5841] veth0_macvtap: entered promiscuous mode [ 128.965076][ T5832] veth1_vlan: entered promiscuous mode [ 128.979431][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.990819][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.011065][ T5841] veth1_macvtap: entered promiscuous mode [ 129.020014][ T37] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.030038][ T37] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.041522][ T5830] veth0_vlan: entered promiscuous mode [ 129.063232][ T37] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.072743][ T37] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.084885][ T5842] veth0_vlan: entered promiscuous mode [ 129.096370][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.120571][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.129965][ T5830] veth1_vlan: entered promiscuous mode [ 129.151064][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.167973][ T5842] veth1_vlan: entered promiscuous mode [ 129.174578][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.184571][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.206228][ T5832] veth0_macvtap: entered promiscuous mode [ 129.213294][ T3465] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.234731][ T5832] veth1_macvtap: entered promiscuous mode [ 129.243572][ T3465] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.253311][ T3465] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.303219][ T3465] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.311737][ T3465] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.317222][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.355879][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.366244][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.369963][ T30] audit: type=1400 audit(1760603992.379:87): avc: denied { mounton } for pid=5831 comm="syz-executor" path="/root/syzkaller.MWv8Yu/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 129.390399][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.421252][ T5842] veth0_macvtap: entered promiscuous mode [ 129.431000][ T30] audit: type=1400 audit(1760603992.379:88): avc: denied { mount } for pid=5831 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 129.439671][ T5830] veth0_macvtap: entered promiscuous mode [ 129.455424][ T30] audit: type=1400 audit(1760603992.399:89): avc: denied { mounton } for pid=5831 comm="syz-executor" path="/root/syzkaller.MWv8Yu/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 129.485406][ T30] audit: type=1400 audit(1760603992.429:90): avc: denied { mount } for pid=5831 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 129.516739][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 129.533513][ T1080] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.539047][ T30] audit: type=1400 audit(1760603992.429:91): avc: denied { mounton } for pid=5831 comm="syz-executor" path="/root/syzkaller.MWv8Yu/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 129.551839][ T5842] veth1_macvtap: entered promiscuous mode [ 129.575672][ T30] audit: type=1400 audit(1760603992.429:92): avc: denied { mounton } for pid=5831 comm="syz-executor" path="/root/syzkaller.MWv8Yu/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7022 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 129.604221][ T30] audit: type=1400 audit(1760603992.449:93): avc: denied { unmount } for pid=5831 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 129.624387][ T30] audit: type=1400 audit(1760603992.459:94): avc: denied { mounton } for pid=5831 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 129.628569][ T1080] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.648117][ T30] audit: type=1400 audit(1760603992.459:95): avc: denied { mount } for pid=5831 comm="syz-executor" name="/" dev="gadgetfs" ino=7029 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 129.666264][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.691709][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.702278][ T30] audit: type=1400 audit(1760603992.459:96): avc: denied { mount } for pid=5831 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 129.708247][ T5830] veth1_macvtap: entered promiscuous mode [ 129.749081][ T1080] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.782297][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.806401][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.825491][ T1080] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.854637][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.877753][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.920195][ T1080] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.960387][ T1080] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.969376][ T1080] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.984122][ T1080] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.998257][ T1080] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.099732][ T1080] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.118268][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 130.150912][ T1080] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.162435][ T1080] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.174604][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.182557][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.329964][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 130.358712][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.437860][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.687755][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 130.709013][ T5834] Bluetooth: hci0: command tx timeout [ 130.788625][ T5834] Bluetooth: hci2: command tx timeout [ 130.806708][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.832348][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.867753][ T5834] Bluetooth: hci1: command tx timeout [ 130.869950][ T5845] Bluetooth: hci3: command tx timeout [ 130.889874][ T5964] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10'. [ 130.943102][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.951181][ T5845] Bluetooth: hci4: command tx timeout [ 130.986087][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.040497][ T1080] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.058017][ T1080] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.100717][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.307740][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 131.746784][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.037820][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 132.048692][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 132.057091][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 132.206365][ T5992] Zero length message leads to an empty skb [ 132.251155][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 132.461713][ T5999] binder: 5996:5999 ioctl c0306201 200000000040 returned -14 [ 132.507931][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 132.516262][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 132.715342][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.722482][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.788110][ T5845] Bluetooth: hci0: command tx timeout [ 132.856878][ T5994] capability: warning: `syz.3.16' uses deprecated v2 capabilities in a way that may be insecure [ 132.869338][ T5845] Bluetooth: hci2: command tx timeout [ 132.950644][ T5845] Bluetooth: hci1: command tx timeout [ 132.951614][ T5834] Bluetooth: hci3: command tx timeout [ 133.012563][ T6004] netlink: 4 bytes leftover after parsing attributes in process `syz.2.21'. [ 133.107103][ T5834] Bluetooth: hci4: command tx timeout [ 133.849616][ T6012] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 134.415256][ T30] kauditd_printk_skb: 64 callbacks suppressed [ 134.415271][ T30] audit: type=1400 audit(1760603997.439:161): avc: denied { create } for pid=6026 comm="syz.3.32" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 134.535336][ T30] audit: type=1400 audit(1760603997.469:162): avc: denied { map } for pid=6026 comm="syz.3.32" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8860 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 135.047970][ T30] audit: type=1400 audit(1760603997.469:163): avc: denied { read write } for pid=6026 comm="syz.3.32" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8860 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 135.075045][ T30] audit: type=1400 audit(1760603997.499:164): avc: denied { ioctl } for pid=6025 comm="syz.1.31" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 135.308109][ T44] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 135.476852][ T30] audit: type=1400 audit(1760603998.499:165): avc: denied { execute } for pid=6038 comm="syz.4.34" path="/4/cgroup.events" dev="tmpfs" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 135.612005][ T44] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 135.621974][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.630345][ T44] usb 2-1: Product: syz [ 135.634563][ T44] usb 2-1: Manufacturer: syz [ 135.639586][ T44] usb 2-1: SerialNumber: syz [ 135.671765][ T44] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 135.697106][ T30] audit: type=1400 audit(1760603998.719:166): avc: denied { firmware_load } for pid=24 comm="kworker/1:0" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 135.754660][ T24] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 135.793077][ T6045] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 135.883934][ T6045] random: crng reseeded on system resumption [ 135.895486][ T30] audit: type=1400 audit(1760603998.909:167): avc: denied { ioctl } for pid=6044 comm="syz.4.36" path="socket:[8893]" dev="sockfs" ino=8893 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 136.090951][ T30] audit: type=1400 audit(1760603998.909:168): avc: denied { write } for pid=6044 comm="syz.4.36" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 136.333660][ T30] audit: type=1400 audit(1760603998.909:169): avc: denied { open } for pid=6044 comm="syz.4.36" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 136.419581][ T30] audit: type=1400 audit(1760603999.069:170): avc: denied { read } for pid=6044 comm="syz.4.36" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 136.688258][ T6052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.720370][ T6052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.788706][ T24] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 136.924256][ T24] ath9k_htc: Failed to initialize the device [ 136.987006][ T24] usb 2-1: ath9k_htc: USB layer deinitialized [ 137.034191][ T44] usb 2-1: USB disconnect, device number 2 [ 137.688677][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 138.318246][ T5834] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 138.338855][ T5834] Bluetooth: hci3: Injecting HCI hardware error event [ 138.348543][ T5845] Bluetooth: hci3: hardware error 0x00 [ 138.427515][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 138.442418][ T6076] syz.0.47 uses obsolete (PF_INET,SOCK_PACKET) [ 138.460042][ T24] usb 4-1: config 64 has an invalid interface number: 219 but max is 0 [ 138.479150][ T24] usb 4-1: config 64 has no interface number 0 [ 138.489868][ T24] usb 4-1: config 64 interface 219 has no altsetting 0 [ 138.490914][ T6076] syzkaller1: entered promiscuous mode [ 138.512359][ T24] usb 4-1: New USB device found, idVendor=2001, idProduct=4a00, bcdDevice=4c.a3 [ 138.514461][ T6076] syzkaller1: entered allmulticast mode [ 138.527527][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.535656][ T24] usb 4-1: Product: syz [ 138.544736][ T24] usb 4-1: Manufacturer: syz [ 138.587511][ T24] usb 4-1: SerialNumber: syz [ 138.837311][ T24] ax88179_178a 4-1:64.219: probe with driver ax88179_178a failed with error -22 [ 138.927727][ T870] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 138.962524][ T24] usb 4-1: USB disconnect, device number 2 [ 139.281019][ T870] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 139.339350][ T870] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 139.365499][ T870] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.697898][ T870] usb 2-1: config 0 descriptor?? [ 139.705654][ T870] pwc: Askey VC010 type 2 USB webcam detected. [ 140.933235][ T870] pwc: recv_control_msg error -32 req 02 val 2b00 [ 140.945645][ T5845] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 140.952093][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 140.952108][ T30] audit: type=1400 audit(1760604003.099:178): avc: denied { create } for pid=6102 comm="syz.2.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 140.979256][ T870] pwc: recv_control_msg error -32 req 02 val 2700 [ 140.990260][ T30] audit: type=1400 audit(1760604003.109:179): avc: denied { ioctl } for pid=6102 comm="syz.2.58" path="socket:[9142]" dev="sockfs" ino=9142 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 141.015882][ T30] audit: type=1400 audit(1760604003.139:180): avc: denied { connect } for pid=6102 comm="syz.2.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 141.035361][ T30] audit: type=1400 audit(1760604003.139:181): avc: denied { name_connect } for pid=6102 comm="syz.2.58" dest=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 141.447543][ T870] pwc: recv_control_msg error -32 req 02 val 2c00 [ 141.456074][ T870] pwc: recv_control_msg error -32 req 04 val 1000 [ 141.757893][ T870] pwc: recv_control_msg error -32 req 04 val 1300 [ 141.844869][ T870] pwc: recv_control_msg error -32 req 04 val 1400 [ 141.858502][ T870] pwc: recv_control_msg error -32 req 02 val 2000 [ 141.869141][ T870] pwc: recv_control_msg error -32 req 02 val 2100 [ 141.918204][ T870] pwc: recv_control_msg error -32 req 04 val 1500 [ 141.930532][ T870] pwc: recv_control_msg error -32 req 02 val 2500 [ 141.947945][ T6116] netlink: 4 bytes leftover after parsing attributes in process `syz.4.62'. [ 141.978222][ T870] pwc: recv_control_msg error -32 req 02 val 2400 [ 141.985345][ T870] pwc: recv_control_msg error -32 req 02 val 2600 [ 142.035477][ T870] pwc: recv_control_msg error -32 req 02 val 2900 [ 142.043695][ T6118] block nbd3: shutting down sockets [ 142.065133][ T870] pwc: recv_control_msg error -71 req 02 val 2800 [ 142.123624][ T870] pwc: recv_control_msg error -71 req 04 val 1100 [ 142.134771][ T870] pwc: recv_control_msg error -71 req 04 val 1200 [ 142.143686][ T870] pwc: Registered as video103. [ 142.194804][ T870] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 142.233445][ T30] audit: type=1400 audit(1760604005.259:182): avc: denied { read } for pid=5168 comm="acpid" name="event4" dev="devtmpfs" ino=2793 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 142.265133][ T870] usb 2-1: USB disconnect, device number 3 [ 142.354724][ T6116] team0 (unregistering): Port device team_slave_0 removed [ 142.380993][ T30] audit: type=1400 audit(1760604005.259:183): avc: denied { open } for pid=5168 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2793 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 142.470991][ T6116] team0 (unregistering): Port device team_slave_1 removed [ 142.490728][ T6128] netlink: 'syz.3.65': attribute type 1 has an invalid length. [ 142.493886][ T30] audit: type=1400 audit(1760604005.259:184): avc: denied { ioctl } for pid=5168 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2793 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 142.530307][ T6128] netlink: 224 bytes leftover after parsing attributes in process `syz.3.65'. [ 142.655743][ T6133] netlink: 24 bytes leftover after parsing attributes in process `syz.0.67'. [ 142.753863][ T30] audit: type=1400 audit(1760604005.759:185): avc: denied { bind } for pid=6131 comm="syz.0.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 142.818889][ T6137] tipc: Started in network mode [ 142.823953][ T6137] tipc: Node identity a251e708d2f7, cluster identity 4711 [ 142.831675][ T6137] tipc: Enabled bearer , priority 0 [ 142.958191][ T6137] syzkaller0: entered promiscuous mode [ 142.963777][ T6137] syzkaller0: entered allmulticast mode [ 142.971923][ T6137] tipc: Resetting bearer [ 143.801021][ T30] audit: type=1400 audit(1760604005.769:187): avc: denied { ioctl } for pid=6134 comm="syz.1.69" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=9423 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 143.826952][ T30] audit: type=1400 audit(1760604005.759:186): avc: denied { connect } for pid=6131 comm="syz.0.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 143.848379][ T847] tipc: Node number set to 1889986312 [ 144.026470][ T6144] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 144.730643][ T6134] tipc: Resetting bearer [ 144.903533][ T5895] IPVS: starting estimator thread 0... [ 144.997572][ T6149] IPVS: using max 49 ests per chain, 117600 per kthread [ 146.047553][ T847] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 146.113691][ T6134] tipc: Disabling bearer [ 146.236038][ T847] usb 1-1: config 8 has an invalid interface number: 80 but max is 0 [ 146.260191][ T847] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 146.273965][ T847] usb 1-1: config 8 has no interface number 0 [ 146.280297][ T847] usb 1-1: config 8 interface 80 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 146.293651][ T847] usb 1-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=c1.6f [ 146.329818][ T847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.352190][ T847] usb 1-1: NFC: intf ffff8880294a9000 id ffffffff8f2f2dc0 [ 146.385256][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 146.385276][ T30] audit: type=1400 audit(1760604009.409:198): avc: denied { read write } for pid=6167 comm="syz.4.78" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.622406][ T30] audit: type=1400 audit(1760604009.409:199): avc: denied { open } for pid=6167 comm="syz.4.78" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.704143][ T6178] netlink: 'syz.2.82': attribute type 4 has an invalid length. [ 146.712100][ T6178] netlink: 152 bytes leftover after parsing attributes in process `syz.2.82'. [ 146.760369][ T6178] : renamed from bond0 (while UP) [ 147.077963][ T30] audit: type=1400 audit(1760604009.459:200): avc: denied { map } for pid=6167 comm="syz.4.78" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 147.269219][ T44] IPVS: starting estimator thread 0... [ 147.377576][ T6185] IPVS: using max 76 ests per chain, 182400 per kthread [ 148.174793][ C0] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 148.563908][ T847] usb 1-1: USB disconnect, device number 2 [ 148.630387][ T30] audit: type=1400 audit(1760604011.659:201): avc: denied { append } for pid=6196 comm="syz.1.91" name="v4l-subdev3" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 149.036973][ T6206] IPVS: sh: FWM 3 0x00000003 - no destination available [ 149.426784][ T870] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 149.587587][ T870] usb 4-1: Using ep0 maxpacket: 16 [ 149.594183][ T870] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 149.602565][ T870] usb 4-1: config 1 has no interface number 0 [ 149.613512][ T870] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 149.625179][ T870] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 149.635645][ T870] usb 4-1: config 1 interface 105 has no altsetting 0 [ 149.650507][ T30] audit: type=1400 audit(1760604012.639:202): avc: denied { read write } for pid=6213 comm="syz.1.96" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 149.677496][ T30] audit: type=1400 audit(1760604012.669:203): avc: denied { open } for pid=6213 comm="syz.1.96" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 149.706774][ T30] audit: type=1400 audit(1760604012.669:204): avc: denied { mounton } for pid=6213 comm="syz.1.96" path="/20/file0" dev="tmpfs" ino=121 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 149.735412][ T870] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 149.758093][ T870] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.766122][ T870] usb 4-1: Product: syz [ 149.780600][ T30] audit: type=1400 audit(1760604012.809:205): avc: denied { unmount } for pid=5831 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 149.800520][ T870] usb 4-1: Manufacturer: syz [ 149.800556][ T870] usb 4-1: SerialNumber: syz [ 149.803983][ T6201] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 149.822414][ T5895] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 149.832338][ T6201] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.001928][ T5895] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 150.011581][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.021823][ T5895] usb 3-1: Product: syz [ 150.026028][ T5895] usb 3-1: Manufacturer: syz [ 150.030880][ T5895] usb 3-1: SerialNumber: syz [ 150.137694][ T5969] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 150.154755][ T30] audit: type=1400 audit(1760604013.179:206): avc: denied { set_context_mgr } for pid=6231 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 150.268245][ T6201] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.276266][ T6201] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.297789][ T5969] usb 2-1: Using ep0 maxpacket: 32 [ 150.305638][ T5969] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 150.314287][ T5969] usb 2-1: config 0 has no interface number 0 [ 150.320526][ T5969] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 150.332125][ T5969] usb 2-1: config 0 interface 196 has no altsetting 0 [ 150.341459][ T5969] usb 2-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 150.350948][ T5969] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.359084][ T5969] usb 2-1: Product: syz [ 150.363444][ T5969] usb 2-1: Manufacturer: syz [ 150.368517][ T5969] usb 2-1: SerialNumber: syz [ 150.386740][ T5969] usb 2-1: config 0 descriptor?? [ 150.397259][ T6219] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 150.853168][ T5969] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 150.862343][ T5969] ipheth 2-1:0.196: probe with driver ipheth failed with error -71 [ 150.879679][ T5969] usb 2-1: USB disconnect, device number 4 [ 150.956983][ T870] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 150.978930][ T870] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 150.991540][ T30] audit: type=1400 audit(1760604014.019:207): avc: denied { ioctl } for pid=6239 comm="syz.4.106" path="/dev/vhost-net" dev="devtmpfs" ino=1274 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 151.029691][ T870] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 86:d6:7e:a3:ba:9e [ 151.052715][ T870] usb 4-1: USB disconnect, device number 3 [ 151.060260][ T870] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 151.214808][ T870] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 151.225215][ T870] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 151.334268][ T870] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 151.887496][ T5969] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 152.048983][ T5969] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 152.051908][ T5895] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPROTO [ 152.061728][ T5969] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 152.074025][ T5895] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 152.088508][ T5969] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.094268][ T5895] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 152.113838][ T5895] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 152.124778][ T5895] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 152.146298][ T5969] usb 1-1: config 0 descriptor?? [ 152.554500][ T5895] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 152.575597][ T30] audit: type=1400 audit(1760604015.239:208): avc: denied { read } for pid=6256 comm="syz.1.112" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 152.598148][ C1] vkms_vblank_simulate: vblank timer overrun [ 152.602435][ T5969] pwc: Askey VC010 type 2 USB webcam detected. [ 152.605658][ T5942] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 152.652847][ T5895] usb 3-1: USB disconnect, device number 2 [ 152.658901][ T30] audit: type=1400 audit(1760604015.319:209): avc: denied { remount } for pid=6256 comm="syz.1.112" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 152.692283][ T6261] tipc: Started in network mode [ 152.697347][ T6261] tipc: Node identity 36e0eb80bdac, cluster identity 4711 [ 152.704953][ T6261] tipc: Enabled bearer , priority 0 [ 152.713822][ T6261] tipc: Disabling bearer [ 152.862653][ T5942] usb 4-1: Using ep0 maxpacket: 32 [ 152.970525][ T30] audit: type=1400 audit(1760604015.999:210): avc: denied { bind } for pid=6264 comm="syz.1.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 153.108096][ T5969] pwc: recv_control_msg error -32 req 02 val 2b00 [ 153.125688][ T5969] pwc: recv_control_msg error -32 req 02 val 2700 [ 153.136837][ T5969] pwc: recv_control_msg error -32 req 02 val 2c00 [ 153.146678][ T30] audit: type=1400 audit(1760604015.999:211): avc: denied { node_bind } for pid=6264 comm="syz.1.115" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 153.846555][ T5969] pwc: recv_control_msg error -32 req 04 val 1000 [ 153.934090][ T6277] vxfs: WRONG superblock magic 00000000 at 1 [ 153.941858][ T6277] vxfs: WRONG superblock magic 00000000 at 8 [ 153.947933][ T6277] vxfs: can't find superblock. [ 154.262749][ T5969] pwc: recv_control_msg error -32 req 04 val 1300 [ 154.286193][ T5969] pwc: recv_control_msg error -32 req 04 val 1400 [ 154.310574][ T5969] pwc: recv_control_msg error -32 req 02 val 2000 [ 154.320849][ T5969] pwc: recv_control_msg error -32 req 02 val 2100 [ 154.331061][ T5969] pwc: recv_control_msg error -32 req 04 val 1500 [ 154.344928][ T5969] pwc: recv_control_msg error -32 req 02 val 2500 [ 154.364767][ T5942] usb 4-1: unable to get BOS descriptor or descriptor too short [ 154.376211][ T5942] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 154.386427][ T5942] usb 4-1: can't read configurations, error -71 [ 154.387082][ T5969] pwc: recv_control_msg error -32 req 02 val 2400 [ 154.401674][ T5969] pwc: recv_control_msg error -32 req 02 val 2600 [ 154.574251][ T6286] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 154.601075][ T30] audit: type=1400 audit(1760604017.619:212): avc: denied { create } for pid=6283 comm="syz.2.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 154.645495][ T5969] pwc: recv_control_msg error -71 req 02 val 2800 [ 154.723181][ T5969] pwc: recv_control_msg error -71 req 04 val 1100 [ 154.789895][ T5969] pwc: recv_control_msg error -71 req 04 val 1200 [ 154.885932][ T5969] pwc: Registered as video103. [ 155.022774][ T5969] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input6 [ 155.187547][ T5845] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 155.196089][ T5845] Bluetooth: hci2: Injecting HCI hardware error event [ 155.203872][ T5834] Bluetooth: hci2: hardware error 0x00 [ 155.364756][ T5969] usb 1-1: USB disconnect, device number 3 [ 155.933114][ T5845] Bluetooth: hci2: Malformed HCI Event: 0x22 [ 156.236840][ T30] audit: type=1400 audit(1760604019.259:213): avc: denied { mounton } for pid=6305 comm="syz.1.129" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 156.726753][ T5969] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 156.740785][ T30] audit: type=1400 audit(1760604019.759:214): avc: denied { write } for pid=6305 comm="syz.1.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 156.917488][ T5969] usb 1-1: Using ep0 maxpacket: 16 [ 156.966217][ T5969] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 157.110402][ T5969] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 157.125781][ T5969] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 157.297536][ T30] audit: type=1400 audit(1760604020.239:215): avc: denied { create } for pid=6314 comm="syz.4.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 157.559810][ T5969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.562541][ T5834] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 157.586226][ T30] audit: type=1400 audit(1760604020.239:216): avc: denied { ioctl } for pid=6314 comm="syz.4.132" path="socket:[10840]" dev="sockfs" ino=10840 ioctlcmd=0x89e4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 157.594813][ T5969] usb 1-1: Product: syz [ 157.677509][ T5969] usb 1-1: Manufacturer: syz [ 157.687250][ T5969] usb 1-1: SerialNumber: syz [ 158.044113][ T5969] usb 1-1: config 0 descriptor?? [ 158.066419][ T5969] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 158.081502][ T5969] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 158.485947][ T30] audit: type=1400 audit(1760604021.319:217): avc: denied { connect } for pid=6324 comm="syz.4.134" laddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 158.507579][ T30] audit: type=1400 audit(1760604021.319:218): avc: denied { write } for pid=6324 comm="syz.4.134" laddr=224.0.0.1 faddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 159.394653][ T5969] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 159.402800][ T5969] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 160.233938][ T30] audit: type=1400 audit(1760604023.249:219): avc: denied { unlink } for pid=6356 comm="syz.1.144" name="#1" dev="tmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 160.543888][ T30] audit: type=1400 audit(1760604023.249:220): avc: denied { mount } for pid=6356 comm="syz.1.144" name="/" dev="overlay" ino=189 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 160.587789][ T30] audit: type=1400 audit(1760604023.359:221): avc: denied { read write } for pid=6356 comm="syz.1.144" name="sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 160.631050][ T30] audit: type=1400 audit(1760604023.359:222): avc: denied { open } for pid=6356 comm="syz.1.144" path="/dev/sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 160.660397][ T5969] em28xx 1-1:0.0: Unknown AC97 audio processor detected! [ 160.669817][ T5969] em28xx 1-1:0.0: couldn't setup AC97 register 2 [ 160.726423][ T5969] em28xx 1-1:0.0: couldn't setup AC97 register 4 [ 160.945585][ T5969] em28xx 1-1:0.0: couldn't setup AC97 register 6 [ 160.953075][ T5969] em28xx 1-1:0.0: couldn't setup AC97 register 54 [ 160.967597][ T5969] em28xx 1-1:0.0: couldn't setup AC97 register 56 [ 160.989319][ T5969] usb 1-1: USB disconnect, device number 4 [ 161.082030][ T30] audit: type=1400 audit(1760604024.099:223): avc: denied { ioctl } for pid=6361 comm="syz.2.146" path="socket:[10143]" dev="sockfs" ino=10143 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 161.498372][ T6371] netlink: 'syz.0.148': attribute type 4 has an invalid length. [ 161.537489][ T5895] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 161.683162][ T30] audit: type=1400 audit(1760604024.709:224): avc: denied { ioctl } for pid=6374 comm="syz.4.150" path="socket:[10157]" dev="sockfs" ino=10157 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 161.711734][ T30] audit: type=1400 audit(1760604024.709:225): avc: denied { write } for pid=6374 comm="syz.4.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 161.849433][ T5895] usb 2-1: config 0 interface 0 has no altsetting 0 [ 161.856292][ T5895] usb 2-1: New USB device found, idVendor=0403, idProduct=bdc8, bcdDevice=a9.d7 [ 161.865629][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.877725][ T5895] usb 2-1: config 0 descriptor?? [ 161.892318][ T5895] ftdi_sio 2-1:0.0: Ignoring interface reserved for JTAG [ 162.328346][ T5845] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 162.337600][ T5845] Bluetooth: hci0: Injecting HCI hardware error event [ 162.346438][ T5849] Bluetooth: hci0: hardware error 0x00 [ 163.028802][ T5845] Bluetooth: hci1: command 0x0406 tx timeout [ 163.045704][ T5895] usb 2-1: USB disconnect, device number 5 [ 164.167460][ T30] audit: type=1400 audit(1760604027.189:226): avc: denied { mounton } for pid=6404 comm="syz.4.160" path="/34/file0" dev="tmpfs" ino=191 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 164.874540][ T5849] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 165.410007][ T6416] comedi comedi1: board detection failed [ 165.502765][ T44] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 165.519231][ T30] audit: type=1400 audit(1760604028.539:227): avc: denied { execute } for pid=6419 comm="syz.1.166" path="/36/cgroup.stat" dev="tmpfs" ino=213 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 165.627510][ T30] audit: type=1400 audit(1760604028.539:228): avc: denied { setopt } for pid=6419 comm="syz.1.166" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 165.717601][ T44] usb 1-1: Using ep0 maxpacket: 32 [ 165.752952][ T44] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 165.771732][ T44] usb 1-1: config 0 has no interface number 0 [ 165.811494][ T44] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 165.822886][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.909382][ T44] usb 1-1: Product: syz [ 165.915349][ T44] usb 1-1: Manufacturer: syz [ 165.923943][ T44] usb 1-1: SerialNumber: syz [ 165.954020][ T44] usb 1-1: config 0 descriptor?? [ 165.993394][ T44] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 166.205229][ T44] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 166.278757][ T44] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 166.422480][ T6411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.454099][ T6411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.677220][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 16 [ 166.879890][ T5969] usb 1-1: USB disconnect, device number 5 [ 166.894062][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -108 [ 166.920590][ T5969] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 167.032535][ T5969] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 167.045382][ T30] audit: type=1400 audit(1760604030.059:229): avc: denied { write } for pid=6441 comm="syz.4.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 167.266238][ T5969] quatech2 1-1:0.51: device disconnected [ 171.705623][ T6459] binder: 6457:6459 ioctl c0306201 200000000040 returned -14 [ 172.627477][ T847] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 172.805616][ T847] usb 2-1: Using ep0 maxpacket: 16 [ 172.823456][ T847] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 172.872894][ T847] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 172.899504][ T847] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 172.917756][ T847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.934892][ T847] usb 2-1: Product: syz [ 173.556144][ T30] audit: type=1400 audit(1760604036.379:230): avc: denied { append } for pid=6471 comm="syz.0.185" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 173.812881][ T5791] IPVS: starting estimator thread 0... [ 174.133684][ T847] usb 2-1: Manufacturer: syz [ 174.146629][ T847] usb 2-1: SerialNumber: syz [ 174.162005][ T847] usb 2-1: config 0 descriptor?? [ 174.172055][ T847] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 174.257481][ T6480] IPVS: using max 40 ests per chain, 96000 per kthread [ 174.417056][ T847] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 174.682215][ T5791] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 174.848524][ T847] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 174.887068][ T847] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 175.496210][ T5791] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 175.919652][ T5791] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 175.969804][ T5791] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 176.010234][ T847] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 176.017218][ T847] em28xx 2-1:0.0: No AC97 audio processor [ 176.063692][ T5791] usb 1-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 176.368034][ T5849] Bluetooth: hci4: link tx timeout [ 176.373887][ T5849] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.383651][ T5834] Bluetooth: hci4: link tx timeout [ 176.389129][ T5834] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.426766][ T847] usb 2-1: USB disconnect, device number 6 [ 176.433276][ T5791] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 176.453639][ T847] em28xx 2-1:0.0: Disconnecting em28xx [ 176.461228][ T5791] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 176.519613][ T847] em28xx 2-1:0.0: Freeing device [ 176.852413][ T5834] Bluetooth: hci4: link tx timeout [ 176.857657][ T5834] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.912054][ T5791] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 176.941854][ T5791] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 176.956941][ T5791] usb 1-1: Product: syz [ 176.961519][ T5791] usb 1-1: Manufacturer: syz [ 177.044200][ T30] audit: type=1400 audit(1760604040.069:231): avc: denied { create } for pid=6491 comm="syz.3.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 177.096035][ T6482] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 177.148360][ T5791] cdc_wdm 1-1:1.0: skipping garbage [ 177.174657][ T5791] cdc_wdm 1-1:1.0: skipping garbage [ 177.220911][ T5791] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 177.267823][ T5791] cdc_wdm 1-1:1.0: Unknown control protocol [ 177.430743][ T30] audit: type=1400 audit(1760604040.459:232): avc: denied { read write } for pid=6481 comm="syz.0.188" name="cdc-wdm0" dev="devtmpfs" ino=2829 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 177.459070][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.465812][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.478170][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.484798][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.498091][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.504713][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.511105][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.517703][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.524022][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.530623][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.536892][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.543485][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.549780][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.556385][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.562672][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.569275][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.576405][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.583009][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.589758][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 177.596394][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 177.719484][ T30] audit: type=1400 audit(1760604040.489:233): avc: denied { open } for pid=6481 comm="syz.0.188" path="/dev/cdc-wdm0" dev="devtmpfs" ino=2829 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 178.395063][ T5834] Bluetooth: hci4: command 0x0406 tx timeout [ 180.273771][ T30] audit: type=1400 audit(1760604043.289:234): avc: denied { unmount } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 180.812873][ T30] audit: type=1400 audit(1760604043.639:235): avc: denied { bind } for pid=6515 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 182.467572][ C0] wdm_int_callback: 24722 callbacks suppressed [ 182.467598][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.480350][ C0] wdm_int_callback: 24722 callbacks suppressed [ 182.480370][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.495793][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.502405][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.509178][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.515771][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.522019][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.528785][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.535071][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.541659][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.548061][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.554645][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.560892][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.567477][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.573754][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.580341][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.588207][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.594801][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 182.601762][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 182.608352][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 184.405276][ T5791] usb 1-1: USB disconnect, device number 6 [ 184.411222][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 185.265200][ T30] audit: type=1400 audit(1760604048.289:236): avc: denied { create } for pid=6528 comm="syz.1.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 189.107424][ C1] sched: DL replenish lagged too much [ 189.885010][ T30] audit: type=1400 audit(1760604052.879:237): avc: denied { kexec_image_load } for pid=6543 comm="syz.0.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 192.737496][ T30] audit: type=1400 audit(1760604055.759:238): avc: denied { search } for pid=6552 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.155133][ T30] audit: type=1400 audit(1760604055.759:239): avc: denied { search } for pid=6552 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1831 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.727539][ T30] audit: type=1400 audit(1760604055.759:240): avc: denied { search } for pid=6552 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1835 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.933376][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.947524][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.987641][ T6565] binder: 6563:6565 ioctl c0306201 200000000040 returned -14 [ 194.952552][ T30] audit: type=1400 audit(1760604055.759:241): avc: denied { search } for pid=6552 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.311541][ T30] audit: type=1400 audit(1760604055.839:242): avc: denied { read open } for pid=6555 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.729999][ T30] audit: type=1400 audit(1760604055.839:243): avc: denied { getattr } for pid=6555 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 199.260581][ T30] audit: type=1400 audit(1760604055.849:244): avc: denied { read } for pid=6553 comm="syz.0.213" path="socket:[11873]" dev="sockfs" ino=11873 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 199.935205][ T30] audit: type=1400 audit(1760604055.929:245): avc: denied { getattr } for pid=6555 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1873 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 201.160934][ T30] audit: type=1400 audit(1760604056.989:246): avc: denied { read } for pid=6559 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=1873 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 201.726681][ T30] audit: type=1400 audit(1760604056.989:247): avc: denied { open } for pid=6559 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1873 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 203.539031][ T30] audit: type=1400 audit(1760604064.669:248): avc: denied { add_name } for pid=6552 comm="dhcpcd-run-hook" name="resolv.conf.lapb4.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.787565][ T30] audit: type=1400 audit(1760604064.669:249): avc: denied { create } for pid=6552 comm="dhcpcd-run-hook" name="resolv.conf.lapb4.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 204.235416][ T30] audit: type=1400 audit(1760604064.669:250): avc: denied { write } for pid=6552 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.lapb4.link" dev="tmpfs" ino=2684 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 204.311639][ T30] audit: type=1400 audit(1760604064.669:251): avc: denied { append } for pid=6552 comm="dhcpcd-run-hook" name="resolv.conf.lapb4.link" dev="tmpfs" ino=2684 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 204.852166][ T30] audit: type=1400 audit(1760604067.239:252): avc: denied { remove_name } for pid=6597 comm="rm" name="resolv.conf.lapb4.link" dev="tmpfs" ino=2684 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 205.593863][ T30] audit: type=1400 audit(1760604067.239:253): avc: denied { unlink } for pid=6597 comm="rm" name="resolv.conf.lapb4.link" dev="tmpfs" ino=2684 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 207.313319][ T30] audit: type=1400 audit(1760604070.339:254): avc: denied { map } for pid=6603 comm="syz.0.224" path="/dev/video8" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 210.233687][ T5845] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 210.242397][ T5845] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 210.253606][ T5845] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 210.261754][ T5845] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 210.269313][ T5845] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 210.357481][ T30] audit: type=1400 audit(1760604073.379:255): avc: denied { mounton } for pid=6625 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 210.389850][ T5834] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 210.457546][ T5834] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 210.507477][ T5834] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 210.646044][ T5834] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 210.653985][ T5834] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 210.812834][ T30] audit: type=1400 audit(1760604073.819:256): avc: denied { getopt } for pid=6612 comm="syz.0.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 210.899594][ T6632] fuse: Bad value for 'fd' [ 212.311107][ T5849] Bluetooth: hci6: command tx timeout [ 212.799152][ T5849] Bluetooth: hci5: command tx timeout [ 214.400568][ T5849] Bluetooth: hci6: command tx timeout [ 214.699384][ T30] audit: type=1400 audit(1760604077.729:257): avc: denied { setopt } for pid=6636 comm="syz.4.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 214.884685][ T5849] Bluetooth: hci5: command tx timeout [ 215.946367][ T30] audit: type=1400 audit(1760604078.969:258): avc: denied { sys_module } for pid=6648 comm="syz.4.234" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 216.487503][ T5849] Bluetooth: hci6: command tx timeout [ 216.958886][ T5849] Bluetooth: hci5: command tx timeout [ 218.547554][ T5849] Bluetooth: hci6: command tx timeout [ 219.027501][ T5849] Bluetooth: hci5: command tx timeout [ 223.424166][ T37] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.697950][ T37] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.790260][ T37] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.963393][ T37] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.967805][ T37] bridge_slave_1: left allmulticast mode [ 225.014105][ T37] bridge_slave_1: left promiscuous mode [ 225.049285][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.113948][ T37] bridge_slave_0: left allmulticast mode [ 225.137481][ T37] bridge_slave_0: left promiscuous mode [ 225.176283][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.597945][ T30] audit: type=1400 audit(1760604088.619:259): avc: denied { ioctl } for pid=6773 comm="syz.0.252" path="socket:[14331]" dev="sockfs" ino=14331 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 225.965696][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 225.980622][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 225.996325][ T37] bond0 (unregistering): Released all slaves [ 226.024800][ T6591] chnl_net:caif_netlink_parms(): no params data found [ 226.044579][ T6625] chnl_net:caif_netlink_parms(): no params data found [ 226.796301][ T6813] netlink: 4 bytes leftover after parsing attributes in process `syz.0.262'. [ 227.404615][ T6591] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.422813][ T6591] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.511377][ T6591] bridge_slave_0: entered allmulticast mode [ 227.521329][ T6591] bridge_slave_0: entered promiscuous mode [ 227.631150][ T6591] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.656346][ T6591] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.667700][ T6591] bridge_slave_1: entered allmulticast mode [ 227.668967][ T30] audit: type=1400 audit(1760604090.699:260): avc: denied { bind } for pid=6832 comm="syz.0.266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 227.675758][ T6591] bridge_slave_1: entered promiscuous mode [ 227.723710][ T37] hsr_slave_0: left promiscuous mode [ 227.737305][ T37] hsr_slave_1: left promiscuous mode [ 227.743797][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 227.751624][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 227.776859][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 227.816648][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 228.070451][ T37] veth1_macvtap: left promiscuous mode [ 228.076787][ T37] veth0_macvtap: left promiscuous mode [ 228.085100][ T37] veth1_vlan: left promiscuous mode [ 228.091834][ T37] veth0_vlan: left promiscuous mode [ 228.803991][ T37] team0 (unregistering): Port device team_slave_1 removed [ 228.981569][ T37] team0 (unregistering): Port device team_slave_0 removed [ 229.406449][ T6625] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.413745][ T6625] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.421160][ T6625] bridge_slave_0: entered allmulticast mode [ 229.430927][ T6625] bridge_slave_0: entered promiscuous mode [ 229.471872][ T6861] tipc: Started in network mode [ 229.476852][ T6861] tipc: Node identity 0addb465624, cluster identity 4711 [ 229.484112][ T6861] tipc: Enabled bearer , priority 0 [ 229.493459][ T6864] tipc: Resetting bearer [ 229.501946][ T6625] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.515828][ T6625] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.524401][ T6625] bridge_slave_1: entered allmulticast mode [ 229.534159][ T6625] bridge_slave_1: entered promiscuous mode [ 229.584315][ T6855] tipc: Disabling bearer [ 229.608517][ T6625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.620625][ T6625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 229.665722][ T6591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.680530][ T6591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 229.708742][ T5849] Bluetooth: hci4: unexpected event for opcode 0x7075 [ 229.729249][ T30] audit: type=1400 audit(1760604092.759:261): avc: denied { create } for pid=6873 comm="syz.4.274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 229.765416][ T6874] Bluetooth: MGMT ver 1.23 [ 229.818057][ T6625] team0: Port device team_slave_0 added [ 229.835081][ T6625] team0: Port device team_slave_1 added [ 229.970845][ T6891] binder: 6888:6891 ioctl c0306201 200000000040 returned -14 [ 230.108940][ T6591] team0: Port device team_slave_0 added [ 230.115307][ T6625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.126895][ T6625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 230.161837][ T6897] netlink: 36 bytes leftover after parsing attributes in process `syz.4.279'. [ 230.179140][ T6625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.191415][ T6897] netlink: 16 bytes leftover after parsing attributes in process `syz.4.279'. [ 230.202711][ T6625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 230.210029][ T6897] netlink: 36 bytes leftover after parsing attributes in process `syz.4.279'. [ 230.218980][ T6625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 230.246544][ T6897] netlink: 36 bytes leftover after parsing attributes in process `syz.4.279'. [ 230.311850][ T6906] comedi comedi1: board detection failed [ 231.005477][ T6625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.020466][ T6591] team0: Port device team_slave_1 added [ 231.154029][ T6591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 231.163470][ T6591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 231.190249][ T6591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 231.279499][ T6591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 231.286571][ T6591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 231.344556][ T6591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.622318][ T6625] hsr_slave_0: entered promiscuous mode [ 231.633269][ T6625] hsr_slave_1: entered promiscuous mode [ 231.732834][ T6934] binder: 6933:6934 ioctl c0306201 200000000040 returned -14 [ 231.798292][ T30] audit: type=1400 audit(1760604094.809:262): avc: denied { name_bind } for pid=6930 comm="syz.4.288" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 231.818997][ C1] vkms_vblank_simulate: vblank timer overrun [ 232.489322][ T6625] debugfs: 'hsr0' already exists in 'hsr' [ 232.499234][ T6625] Cannot create hsr debugfs directory [ 232.539764][ T30] audit: type=1400 audit(1760604095.559:263): avc: denied { read write } for pid=6940 comm="syz.0.291" name="mouse0" dev="devtmpfs" ino=984 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 232.570406][ T30] audit: type=1400 audit(1760604095.559:264): avc: denied { open } for pid=6940 comm="syz.0.291" path="/dev/input/mouse0" dev="devtmpfs" ino=984 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 232.612514][ T37] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.698992][ T6591] hsr_slave_0: entered promiscuous mode [ 232.706369][ T6591] hsr_slave_1: entered promiscuous mode [ 232.713251][ T6591] debugfs: 'hsr0' already exists in 'hsr' [ 232.719319][ T6591] Cannot create hsr debugfs directory [ 232.779231][ T37] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.998836][ T37] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.272472][ T37] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.388586][ T6970] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 234.263123][ T37] bridge_slave_1: left allmulticast mode [ 234.310085][ T37] bridge_slave_1: left promiscuous mode [ 234.315856][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.478727][ T37] bridge_slave_0: left allmulticast mode [ 234.504347][ T37] bridge_slave_0: left promiscuous mode [ 234.556267][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.709913][ T6996] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 234.717676][ T6996] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 1th superblock [ 234.725880][ T6996] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 234.733538][ T6996] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 2th superblock [ 235.267551][ T5945] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 235.447596][ T5945] usb 1-1: Using ep0 maxpacket: 32 [ 235.475876][ T5945] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 235.504891][ T5945] usb 1-1: config 0 has no interface number 0 [ 235.535750][ T5945] usb 1-1: config 0 interface 196 has no altsetting 0 [ 235.587332][ T5945] usb 1-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 235.627077][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.717979][ T5945] usb 1-1: Product: syz [ 235.722356][ T5945] usb 1-1: Manufacturer: syz [ 235.726952][ T5945] usb 1-1: SerialNumber: syz [ 235.832067][ T5945] usb 1-1: config 0 descriptor?? [ 235.855069][ T30] audit: type=1400 audit(1760604098.229:265): avc: denied { bind } for pid=7002 comm="syz.2.313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 235.874324][ T30] audit: type=1400 audit(1760604098.229:266): avc: denied { name_bind } for pid=7002 comm="syz.2.313" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 235.895979][ T30] audit: type=1400 audit(1760604098.229:267): avc: denied { node_bind } for pid=7002 comm="syz.2.313" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 235.972651][ T30] audit: type=1400 audit(1760604098.239:268): avc: denied { write } for pid=7002 comm="syz.2.313" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 236.005003][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 236.016636][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 236.046383][ T37] bond0 (unregistering): Released all slaves [ 236.091043][ T5945] ipheth 1-1:0.196: Unable to find endpoints [ 236.186852][ T37] tipc: Left network mode [ 236.199744][ T6591] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 236.420601][ T6591] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 236.500711][ T6591] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 236.550762][ T6591] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 236.817282][ T7032] ptrace attach of "./syz-executor exec"[5830] was attempted by " [ 237.286032][ T37] hsr_slave_0: left promiscuous mode [ 237.377230][ C1] vkms_vblank_simulate: vblank timer overrun [ 237.489145][ T37] hsr_slave_1: left promiscuous mode [ 237.495063][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 237.531542][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 237.683318][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.691478][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 237.762181][ T37] veth1_macvtap: left promiscuous mode [ 237.781336][ T37] veth0_macvtap: left promiscuous mode [ 237.826365][ T37] veth1_vlan: left promiscuous mode [ 237.895309][ T37] veth0_vlan: left promiscuous mode [ 238.183194][ T5908] usb 1-1: USB disconnect, device number 7 [ 238.501258][ T7056] kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 238.518151][ T7056] kvm: requested 177676 ns i8254 timer period limited to 200000 ns [ 238.570920][ T7056] kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 238.595429][ T30] audit: type=1400 audit(1760604101.619:269): avc: denied { create } for pid=7063 comm="syz.2.323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 238.689933][ T7065] netlink: 4 bytes leftover after parsing attributes in process `syz.2.323'. [ 239.100272][ T37] team0 (unregistering): Port device team_slave_1 removed [ 239.333590][ T37] team0 (unregistering): Port device team_slave_0 removed [ 240.191152][ T6625] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 240.220633][ T6625] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 240.233054][ T6625] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 240.275590][ T6625] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 240.607331][ T30] audit: type=1326 audit(1760604103.629:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7077 comm="syz.0.327" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93a938eec9 code=0x0 [ 241.580267][ T6625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.069387][ T6625] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.094058][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.101235][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.126035][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.133223][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.170389][ T6591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.220634][ T6591] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.268907][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.276086][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.299506][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.306680][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.497676][ T7109] binder: 7106:7109 ioctl c0306201 200000000040 returned -14 [ 242.629866][ T44] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 242.653589][ T7115] netlink: 4 bytes leftover after parsing attributes in process `syz.2.333'. [ 242.902566][ T44] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 242.914742][ T44] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 243.023003][ T44] usb 5-1: config 220 has no interface number 2 [ 243.072849][ T44] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 243.182618][ T44] usb 5-1: config 220 interface 0 has no altsetting 0 [ 243.267659][ T44] usb 5-1: config 220 interface 76 has no altsetting 0 [ 243.331863][ T44] usb 5-1: config 220 interface 1 has no altsetting 0 [ 243.478162][ T44] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 243.521678][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.553779][ T44] usb 5-1: Product: syz [ 243.577997][ T44] usb 5-1: Manufacturer: syz [ 243.582629][ T44] usb 5-1: SerialNumber: syz [ 243.634748][ T6625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 243.877311][ T44] usb 5-1: selecting invalid altsetting 0 [ 243.899698][ T44] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 243.908964][ T6591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 243.916090][ T44] uvcvideo 5-1:220.0: No valid video chain found. [ 243.951445][ T44] usb 5-1: selecting invalid altsetting 0 [ 243.971954][ T44] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 244.026042][ T44] usb 5-1: USB disconnect, device number 2 [ 244.158604][ T6625] veth0_vlan: entered promiscuous mode [ 244.180331][ T6625] veth1_vlan: entered promiscuous mode [ 244.284294][ T6625] veth0_macvtap: entered promiscuous mode [ 244.519911][ T30] audit: type=1400 audit(1760604107.549:271): avc: denied { getopt } for pid=7152 comm="syz.0.339" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 244.812515][ T6625] veth1_macvtap: entered promiscuous mode [ 244.867180][ T6625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 244.901809][ T6625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 244.941636][ T62] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.055127][ T62] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.076059][ T62] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.097247][ T62] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.654629][ T6591] veth0_vlan: entered promiscuous mode [ 245.813075][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 245.829416][ T6591] veth1_vlan: entered promiscuous mode [ 245.869802][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.122257][ T7194] netlink: 4 bytes leftover after parsing attributes in process `syz.2.344'. [ 246.401258][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.150487][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.200688][ T7196] random: crng reseeded on system resumption [ 247.246942][ T30] audit: type=1400 audit(1760604110.219:272): avc: denied { read } for pid=7184 comm="syz.4.343" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 247.351935][ T30] audit: type=1400 audit(1760604110.229:273): avc: denied { ioctl } for pid=7184 comm="syz.4.343" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 247.401530][ T7199] netlink: 2384 bytes leftover after parsing attributes in process `syz.2.346'. [ 247.412882][ T6591] veth0_macvtap: entered promiscuous mode [ 247.435096][ T6591] veth1_macvtap: entered promiscuous mode [ 247.456044][ T30] audit: type=1400 audit(1760604110.369:274): avc: denied { mount } for pid=6625 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 247.487987][ T30] audit: type=1400 audit(1760604110.409:275): avc: denied { mount } for pid=6625 comm="syz-executor" name="/" dev="gadgetfs" ino=7029 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 247.512549][ T6591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.531335][ T6591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 247.546509][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.557849][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.579107][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.589450][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.662673][ T7202] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 247.678488][ T7202] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 1th superblock [ 247.688760][ T7202] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 247.696392][ T7202] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 2th superblock [ 247.805268][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.845821][ T30] audit: type=1326 audit(1760604110.869:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7204 comm="syz.0.347" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93a938eec9 code=0x0 [ 247.846147][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 248.444622][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 248.490424][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 248.695817][ T7223] netlink: 8 bytes leftover after parsing attributes in process `syz.5.212'. [ 248.714138][ T30] audit: type=1400 audit(1760604111.739:277): avc: denied { write } for pid=7222 comm="syz.5.212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 249.028653][ T30] audit: type=1400 audit(1760604111.739:278): avc: denied { nlmsg_write } for pid=7222 comm="syz.5.212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 249.119665][ T30] audit: type=1400 audit(1760604111.929:279): avc: denied { read } for pid=7222 comm="syz.5.212" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 249.142674][ T30] audit: type=1400 audit(1760604111.939:280): avc: denied { open } for pid=7222 comm="syz.5.212" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 249.159658][ T7225] : entered promiscuous mode [ 251.376753][ T7246] kvm: pic: non byte read [ 251.394749][ T7246] kvm: pic: non byte read [ 251.426357][ T7246] kvm: pic: non byte read [ 251.431576][ T7246] kvm: pic: level sensitive irq not supported [ 251.431658][ T7246] kvm: pic: non byte read [ 251.442726][ T7246] kvm: pic: non byte read [ 251.447347][ T7246] kvm: pic: non byte read [ 251.604369][ T30] audit: type=1400 audit(1760604114.629:281): avc: denied { create } for pid=7260 comm="syz.4.359" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 251.860665][ T7273] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 252.437862][ T5908] IPVS: starting estimator thread 0... [ 252.527490][ T7282] IPVS: using max 49 ests per chain, 117600 per kthread [ 253.045317][ T7298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.368'. [ 253.152402][ T7301] : entered promiscuous mode [ 253.879064][ T7320] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 253.886880][ T7320] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 253.926378][ T7320] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 253.939923][ T7320] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 254.107045][ T7326] fuse: Bad value for 'fd' [ 254.310804][ T30] audit: type=1400 audit(1760604117.329:282): avc: denied { bind } for pid=7331 comm="syz.0.378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 254.456050][ T30] audit: type=1400 audit(1760604117.389:283): avc: denied { connect } for pid=7333 comm="syz.5.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 254.542259][ T30] audit: type=1400 audit(1760604117.429:284): avc: denied { write } for pid=7333 comm="syz.5.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 255.223007][ T7352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.384'. [ 255.363131][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.411959][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.598220][ T5849] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 255.607944][ T5849] Bluetooth: hci5: Injecting HCI hardware error event [ 255.617071][ T5834] Bluetooth: hci5: hardware error 0x00 [ 255.838016][ T30] audit: type=1400 audit(1760604118.849:285): avc: denied { write } for pid=7355 comm="syz.0.385" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 255.919425][ T44] IPVS: starting estimator thread 0... [ 255.966330][ T30] audit: type=1400 audit(1760604118.849:286): avc: denied { ioctl } for pid=7355 comm="syz.0.385" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 256.049229][ T7363] IPVS: using max 39 ests per chain, 93600 per kthread [ 256.097796][ T44] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 256.291717][ T44] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 256.478128][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.559117][ T44] usb 1-1: Product: syz [ 256.565793][ T44] usb 1-1: Manufacturer: syz [ 256.582496][ T44] usb 1-1: SerialNumber: syz [ 256.590701][ T44] usb 1-1: config 0 descriptor?? [ 256.707531][ T5908] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 256.809675][ T44] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 256.870777][ T5908] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 256.892123][ T5908] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 256.907674][ T5908] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.941137][ T7387] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 256.942158][ T5908] usb 6-1: config 0 descriptor?? [ 256.954552][ T7387] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 1th superblock [ 256.963567][ T7387] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 256.965668][ T5908] pwc: Askey VC010 type 2 USB webcam detected. [ 256.978654][ T7387] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 2th superblock [ 257.440540][ T5908] pwc: recv_control_msg error -32 req 02 val 2b00 [ 257.449441][ T5908] pwc: recv_control_msg error -32 req 02 val 2700 [ 257.458005][ T5908] pwc: recv_control_msg error -32 req 02 val 2c00 [ 257.465889][ T5908] pwc: recv_control_msg error -32 req 04 val 1000 [ 257.481248][ T5908] pwc: recv_control_msg error -32 req 04 val 1300 [ 257.494257][ T5908] pwc: recv_control_msg error -32 req 04 val 1400 [ 257.502317][ T5908] pwc: recv_control_msg error -32 req 02 val 2000 [ 257.519110][ T5908] pwc: recv_control_msg error -32 req 02 val 2100 [ 257.527139][ T5908] pwc: recv_control_msg error -32 req 04 val 1500 [ 257.542251][ T5908] pwc: recv_control_msg error -32 req 02 val 2500 [ 257.550960][ T5908] pwc: recv_control_msg error -32 req 02 val 2400 [ 257.563133][ T5908] pwc: recv_control_msg error -32 req 02 val 2600 [ 257.667566][ T5834] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 257.771939][ T5908] pwc: recv_control_msg error -71 req 02 val 2800 [ 257.780545][ T5908] pwc: recv_control_msg error -71 req 04 val 1100 [ 257.819735][ T5908] pwc: recv_control_msg error -71 req 04 val 1200 [ 257.969233][ T5908] pwc: Registered as video103. [ 258.037499][ T30] audit: type=1400 audit(1760604121.049:287): avc: denied { create } for pid=7396 comm="syz.2.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 258.068928][ T5908] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input7 [ 258.103748][ T30] audit: type=1400 audit(1760604121.059:288): avc: denied { connect } for pid=7396 comm="syz.2.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 258.125320][ T30] audit: type=1400 audit(1760604121.089:289): avc: denied { write } for pid=7396 comm="syz.2.401" path="socket:[17558]" dev="sockfs" ino=17558 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 258.148752][ C0] vkms_vblank_simulate: vblank timer overrun [ 258.257967][ T5908] usb 6-1: USB disconnect, device number 2 [ 258.560754][ T44] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 258.791633][ T44] usb 1-1: USB disconnect, device number 8 [ 259.729057][ T7417] tipc: Enabled bearer , priority 0 [ 259.756912][ T7417] tipc: Resetting bearer [ 260.003774][ T7416] tipc: Disabling bearer [ 260.831079][ T7442] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 260.837276][ T7442] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 260.916376][ T7442] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 260.923035][ T7442] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 261.080650][ T7442] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 261.498931][ T30] audit: type=1400 audit(1760604124.519:290): avc: denied { name_bind } for pid=7463 comm="syz.0.422" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 262.286640][ T7478] block nbd2: NBD_DISCONNECT [ 262.548121][ T5834] Bluetooth: hci4: command 0x0406 tx timeout [ 262.702810][ T30] audit: type=1400 audit(1760604125.699:291): avc: denied { write } for pid=7488 comm="syz.0.427" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 262.947731][ T5834] Bluetooth: hci6: command 0x0c1a tx timeout [ 263.072862][ T30] audit: type=1400 audit(1760604126.099:292): avc: denied { mount } for pid=7488 comm="syz.0.427" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 263.095611][ T7489] overlay: Unknown parameter '/' [ 263.101292][ T30] audit: type=1400 audit(1760604126.119:293): avc: denied { mounton } for pid=7488 comm="syz.0.427" path="/99/file0" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 263.137483][ T30] audit: type=1400 audit(1760604126.159:294): avc: denied { unmount } for pid=5842 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 264.037591][ T5908] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 264.277603][ T5908] usb 5-1: Using ep0 maxpacket: 32 [ 264.289853][ T5908] usb 5-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 264.313102][ T5908] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.348536][ T5908] usb 5-1: config 0 descriptor?? [ 264.356892][ T5908] usb 5-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 264.734437][ T5849] Bluetooth: hci4: command 0x0406 tx timeout [ 264.796697][ T30] audit: type=1400 audit(1760604127.819:295): avc: denied { create } for pid=7516 comm="syz.6.439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 265.027509][ T5849] Bluetooth: hci6: command 0x0c1a tx timeout [ 265.266431][ T7527] netlink: 4 bytes leftover after parsing attributes in process `syz.4.434'. [ 265.298125][ T5908] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 265.617846][ T5908] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 265.629686][ T5908] usb 5-1: media controller created [ 265.730718][ T30] audit: type=1400 audit(1760604127.819:296): avc: denied { create } for pid=7516 comm="syz.6.439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 265.778813][ T5908] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 265.814500][ T30] audit: type=1400 audit(1760604127.819:297): avc: denied { ioctl } for pid=7516 comm="syz.6.439" path="socket:[18768]" dev="sockfs" ino=18768 ioctlcmd=0x4944 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 265.936819][ T5908] usb 5-1: selecting invalid altsetting 1 [ 265.947557][ T5791] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 265.978498][ T5908] set interface failed [ 265.978814][ T5908] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 266.011650][ T5908] error writing reg: 0xff, val: 0x00 [ 266.014389][ T30] audit: type=1400 audit(1760604128.209:298): avc: denied { append } for pid=7501 comm="syz.4.434" name="comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 266.127516][ T5791] usb 7-1: Using ep0 maxpacket: 32 [ 266.241909][ T5908] dvb_usb_mxl111sf 5-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 266.281476][ T5908] usb 5-1: USB disconnect, device number 3 [ 266.400025][ T5791] usb 7-1: unable to get BOS descriptor or descriptor too short [ 266.818663][ T5791] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 266.882314][ T5791] usb 7-1: can't read configurations, error -71 [ 267.247487][ T5849] Bluetooth: hci6: command 0x0c1a tx timeout [ 268.337554][ T44] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 268.338695][ T5909] kernel read not supported for file /dsp1 (pid: 5909 comm: kworker/0:4) [ 268.809575][ T7586] netlink: 4 bytes leftover after parsing attributes in process `syz.0.453'. [ 268.910826][ T44] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 268.924227][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.937294][ T44] usb 6-1: Product: syz [ 268.948676][ T44] usb 6-1: Manufacturer: syz [ 268.953346][ T44] usb 6-1: SerialNumber: syz [ 269.176750][ T30] audit: type=1804 audit(1760604132.199:299): pid=7592 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.0.454" name="/newroot/106/file1" dev="fuse" ino=1 res=1 errno=0 [ 269.431446][ T44] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 269.467465][ T44] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 269.477132][ T44] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 269.534550][ T44] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 269.668392][ T5791] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 269.827491][ T5791] usb 7-1: Using ep0 maxpacket: 32 [ 270.209345][ T5791] usb 7-1: unable to get BOS descriptor or descriptor too short [ 270.223019][ T5791] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 270.259480][ T5791] usb 7-1: can't read configurations, error -71 [ 271.124991][ T9] usb 6-1: USB disconnect, device number 3 [ 271.206090][ T5969] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 271.245553][ T30] audit: type=1400 audit(1760604134.249:300): avc: denied { read } for pid=7663 comm="syz.6.473" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 271.557175][ T30] audit: type=1400 audit(1760604134.249:301): avc: denied { open } for pid=7663 comm="syz.6.473" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 271.667952][ T30] audit: type=1400 audit(1760604134.249:302): avc: denied { ioctl } for pid=7663 comm="syz.6.473" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 271.692730][ C1] vkms_vblank_simulate: vblank timer overrun [ 271.751443][ T30] audit: type=1400 audit(1760604134.259:303): avc: denied { getopt } for pid=7663 comm="syz.6.473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 271.771877][ C1] vkms_vblank_simulate: vblank timer overrun [ 271.772705][ T5969] usb 5-1: Using ep0 maxpacket: 16 [ 271.806209][ T5969] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 271.817460][ T5969] usb 5-1: config 1 has no interface number 0 [ 271.823593][ T5969] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 271.857792][ T5969] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 271.885890][ T5969] usb 5-1: config 1 interface 105 has no altsetting 0 [ 271.904007][ T5969] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 271.923004][ T5969] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.931446][ T5969] usb 5-1: Product: syz [ 271.935740][ T5969] usb 5-1: Manufacturer: syz [ 271.943244][ T5969] usb 5-1: SerialNumber: syz [ 271.969244][ T7657] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 271.977113][ T7657] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 272.067456][ T870] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 272.138483][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 272.247520][ T870] usb 1-1: Using ep0 maxpacket: 32 [ 272.259511][ T870] usb 1-1: config 1 has an invalid interface number: 170 but max is 0 [ 272.277464][ T870] usb 1-1: config 1 has no interface number 0 [ 272.296439][ T870] usb 1-1: New USB device found, idVendor=09d7, idProduct=0100, bcdDevice=ac.9b [ 272.297829][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 272.314956][ T5909] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 272.316865][ T870] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.334916][ T870] usb 1-1: Product: syz [ 272.340574][ T9] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 272.348421][ T870] usb 1-1: Manufacturer: syz [ 272.353440][ T870] usb 1-1: SerialNumber: syz [ 272.357642][ T9] usb 6-1: config 0 has no interface number 0 [ 272.364512][ T9] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 272.368011][ T870] hub 1-1:1.170: bad descriptor, ignoring hub [ 272.380893][ T9] usb 6-1: config 0 interface 196 has no altsetting 0 [ 272.383830][ T870] hub 1-1:1.170: probe with driver hub failed with error -5 [ 272.399478][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 272.409864][ T870] usb_serial_simple 1-1:1.170: novatel_gps converter detected [ 272.416876][ T7657] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 272.427985][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.428045][ T7657] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 272.503649][ T9] usb 6-1: Product: syz [ 272.505963][ T30] audit: type=1400 audit(1760604135.479:304): avc: denied { create } for pid=7700 comm="syz.2.481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 272.508234][ T9] usb 6-1: Manufacturer: syz [ 272.529755][ T870] usb 1-1: novatel_gps converter now attached to ttyUSB0 [ 272.532900][ T5909] usb 7-1: Using ep0 maxpacket: 32 [ 272.545320][ T9] usb 6-1: SerialNumber: syz [ 272.552042][ T30] audit: type=1400 audit(1760604135.479:305): avc: denied { write } for pid=7700 comm="syz.2.481" path="socket:[18183]" dev="sockfs" ino=18183 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 272.586743][ T9] usb 6-1: config 0 descriptor?? [ 272.591630][ T870] usb 1-1: novatel_gps converter now attached to ttyUSB1 [ 272.605360][ T7684] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 272.641396][ T870] usb 1-1: novatel_gps converter now attached to ttyUSB2 [ 272.750346][ T5909] usb 7-1: unable to get BOS descriptor or descriptor too short [ 272.759655][ T5909] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 272.767285][ T5909] usb 7-1: can't read configurations, error -71 [ 272.810019][ T870] usb 1-1: USB disconnect, device number 9 [ 272.843933][ T9] ipheth 6-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 272.872857][ T9] ipheth 6-1:0.196: probe with driver ipheth failed with error -71 [ 272.881590][ T870] novatel_gps ttyUSB0: novatel_gps converter now disconnected from ttyUSB0 [ 272.960989][ T870] novatel_gps ttyUSB1: novatel_gps converter now disconnected from ttyUSB1 [ 272.964508][ T9] usb 6-1: USB disconnect, device number 4 [ 273.138604][ T5969] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 273.167279][ T5969] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 273.194364][ T870] novatel_gps ttyUSB2: novatel_gps converter now disconnected from ttyUSB2 [ 273.593429][ T870] usb_serial_simple 1-1:1.170: device disconnected [ 273.728253][ T5969] aqc111 5-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, e2:bb:e7:cc:77:8d [ 273.858103][ T5969] usb 5-1: USB disconnect, device number 4 [ 273.878707][ T5969] aqc111 5-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 275.121407][ T30] audit: type=1400 audit(1760604138.149:306): avc: denied { read } for pid=7753 comm="syz.2.493" path="socket:[18351]" dev="sockfs" ino=18351 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 275.323527][ T5969] aqc111 5-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 275.361489][ T5969] aqc111 5-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 275.813610][ T5969] aqc111 5-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 276.537588][ T5969] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 276.987457][ T5969] usb 3-1: Using ep0 maxpacket: 32 [ 277.000140][ T5969] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 277.031204][ T5969] usb 3-1: config 0 has no interface number 0 [ 277.097288][ T5969] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 277.149688][ T5969] usb 3-1: config 0 interface 196 has no altsetting 0 [ 277.180198][ T5969] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 277.207528][ T5969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.231281][ T5969] usb 3-1: Product: syz [ 277.255261][ T5969] usb 3-1: Manufacturer: syz [ 277.264590][ T5969] usb 3-1: SerialNumber: syz [ 277.291493][ T5969] usb 3-1: config 0 descriptor?? [ 277.320568][ T7769] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 277.573456][ T5969] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 277.607705][ T5969] ipheth 3-1:0.196: probe with driver ipheth failed with error -71 [ 277.670239][ T7804] netlink: 12 bytes leftover after parsing attributes in process `syz.6.502'. [ 277.679637][ T5969] usb 3-1: USB disconnect, device number 3 [ 277.692210][ T7802] tipc: Enabling of bearer rejected, failed to enable media [ 277.966830][ T7804] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 277.974592][ T7804] IPv6: NLM_F_CREATE should be set when creating new route [ 278.212294][ T7819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.504'. [ 278.421742][ T7828] F2FS-fs (nbd5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 278.429729][ T7828] F2FS-fs (nbd5): Can't find valid F2FS filesystem in 1th superblock [ 278.442938][ T7828] F2FS-fs (nbd5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 278.452123][ T7828] F2FS-fs (nbd5): Can't find valid F2FS filesystem in 2th superblock [ 281.866498][ T7869] netlink: 8 bytes leftover after parsing attributes in process `syz.2.517'. [ 281.991897][ T7874] Bluetooth: hci0: unsupported parameter 255 [ 281.998150][ T7874] Bluetooth: hci0: unsupported parameter 255 [ 282.088691][ T7739] syz.4.487 (7739): drop_caches: 1 [ 282.108932][ T30] audit: type=1400 audit(1760604145.139:307): avc: denied { setopt } for pid=7876 comm="syz.2.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 282.168796][ T7877] netlink: 4 bytes leftover after parsing attributes in process `syz.2.520'. [ 282.588682][ T7893] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 282.600707][ T7893] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 283.169358][ T7893] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 283.181403][ T7893] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 283.623249][ T7902] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 283.768145][ T44] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 283.948919][ T7905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.530'. [ 284.047441][ T44] usb 3-1: Using ep0 maxpacket: 32 [ 284.089589][ T44] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 284.107795][ T7909] Bluetooth: hci0: unsupported parameter 255 [ 284.108160][ T44] usb 3-1: config 0 has no interface number 0 [ 284.138872][ T44] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 284.145518][ T7909] Bluetooth: hci0: unsupported parameter 255 [ 284.183549][ T44] usb 3-1: config 0 interface 196 has no altsetting 0 [ 284.234636][ T44] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 284.274992][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.325445][ T44] usb 3-1: Product: syz [ 284.352199][ T44] usb 3-1: Manufacturer: syz [ 284.375695][ T44] usb 3-1: SerialNumber: syz [ 284.415616][ T44] usb 3-1: config 0 descriptor?? [ 284.439962][ T7899] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 284.705999][ T44] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 284.728253][ T44] ipheth 3-1:0.196: probe with driver ipheth failed with error -71 [ 284.868119][ T30] audit: type=1400 audit(1760604147.879:308): avc: denied { create } for pid=7917 comm="syz.4.536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 284.898895][ T30] audit: type=1400 audit(1760604147.889:309): avc: denied { setopt } for pid=7917 comm="syz.4.536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 285.080687][ T44] usb 3-1: USB disconnect, device number 4 [ 285.158297][ T7922] netlink: 4 bytes leftover after parsing attributes in process `syz.6.534'. [ 285.627801][ T5969] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 285.777429][ T5969] usb 1-1: Using ep0 maxpacket: 16 [ 285.809341][ T5969] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 285.831153][ T5969] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 285.999788][ T5969] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 286.012311][ T5969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.025665][ T5969] usb 1-1: Product: syz [ 286.030154][ T5969] usb 1-1: Manufacturer: syz [ 286.034835][ T5969] usb 1-1: SerialNumber: syz [ 286.066748][ T5969] usb 1-1: config 0 descriptor?? [ 286.085586][ T5969] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 286.109524][ T7937] netlink: 2384 bytes leftover after parsing attributes in process `syz.5.542'. [ 286.114163][ T5969] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 286.283595][ T7947] tipc: Enabling of bearer rejected, failed to enable media [ 286.729683][ T7960] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 287.187101][ T5969] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 287.197000][ T5969] em28xx 1-1:0.0: Config register raw data: 0x00 [ 288.078524][ T7986] netlink: 2384 bytes leftover after parsing attributes in process `syz.4.555'. [ 288.554132][ T7995] netlink: 4 bytes leftover after parsing attributes in process `syz.2.556'. [ 289.016093][ T9] usb 1-1: USB disconnect, device number 10 [ 289.023065][ T9] em28xx 1-1:0.0: Disconnecting em28xx [ 289.068772][ T9] em28xx 1-1:0.0: Freeing device [ 290.880543][ T30] audit: type=1400 audit(1760604153.809:310): avc: denied { create } for pid=8014 comm="syz.0.563" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 293.378379][ T8056] netlink: 2384 bytes leftover after parsing attributes in process `syz.2.577'. [ 294.392262][ T8059] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 295.217453][ T5969] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 295.237461][ T5942] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 295.377539][ T5969] usb 5-1: Using ep0 maxpacket: 32 [ 295.386313][ T5969] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 295.401297][ T5969] usb 5-1: New USB device found, idVendor=d575, idProduct=8f3b, bcdDevice=82.88 [ 295.467462][ T5942] usb 1-1: Using ep0 maxpacket: 32 [ 295.484691][ T5969] usb 5-1: New USB device strings: Mfr=141, Product=3, SerialNumber=3 [ 295.492031][ T5942] usb 1-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 295.512739][ T5942] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.532011][ T5969] usb 5-1: Product: syz [ 295.535545][ T5942] usb 1-1: config 0 descriptor?? [ 295.541232][ T5969] usb 5-1: Manufacturer: syz [ 295.541252][ T5969] usb 5-1: SerialNumber: syz [ 295.547156][ T5969] usb 5-1: config 0 descriptor?? [ 295.585166][ T5942] usb 1-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 295.640282][ T5942] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 295.651879][ T5942] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 295.659121][ T5942] usb 1-1: media controller created [ 295.685293][ T5942] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 295.706335][ T5942] usb 1-1: selecting invalid altsetting 1 [ 295.712465][ T5942] set interface failed [ 295.712488][ T5942] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 295.722966][ T5942] error writing reg: 0xff, val: 0x00 [ 295.746734][ T5942] dvb_usb_mxl111sf 1-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 295.805877][ T5969] usb 5-1: USB disconnect, device number 5 [ 295.941440][ T8094] netlink: 4 bytes leftover after parsing attributes in process `syz.0.585'. [ 297.429674][ T870] usb 1-1: USB disconnect, device number 11 [ 297.647439][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 297.809848][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 297.835474][ T9] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 297.863451][ T9] usb 6-1: config 0 has no interface number 0 [ 297.875326][ T9] usb 6-1: config 0 interface 184 has no altsetting 0 [ 297.899589][ T9] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 297.919098][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.960946][ T9] usb 6-1: Product: syz [ 297.981898][ T9] usb 6-1: Manufacturer: syz [ 298.007230][ T9] usb 6-1: SerialNumber: syz [ 298.026376][ T9] usb 6-1: config 0 descriptor?? [ 298.042581][ T9] smsc75xx v1.0.0 [ 298.409260][ T8127] netlink: 4 bytes leftover after parsing attributes in process `syz.0.599'. [ 299.667546][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 299.709353][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 300.021260][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 300.061456][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 300.557194][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 300.567979][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 300.578017][ T9] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 300.592865][ T9] usb 6-1: USB disconnect, device number 5 [ 300.616617][ T870] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 300.800483][ T870] usb 5-1: Using ep0 maxpacket: 32 [ 300.810324][ T870] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 300.826911][ T870] usb 5-1: New USB device found, idVendor=d575, idProduct=8f3b, bcdDevice=82.88 [ 300.897505][ T870] usb 5-1: New USB device strings: Mfr=141, Product=3, SerialNumber=3 [ 300.905702][ T870] usb 5-1: Product: syz [ 300.909934][ T870] usb 5-1: Manufacturer: syz [ 300.914659][ T870] usb 5-1: SerialNumber: syz [ 300.940604][ T870] usb 5-1: config 0 descriptor?? [ 300.971892][ T870] cdc_wdm 5-1:0.0: skipping garbage [ 300.977139][ T870] cdc_wdm 5-1:0.0: probe with driver cdc_wdm failed with error -22 [ 301.078974][ T30] audit: type=1400 audit(1760604164.099:311): avc: denied { write } for pid=8150 comm="syz.2.608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 301.184005][ T870] usb 5-1: USB disconnect, device number 6 [ 301.214310][ T30] audit: type=1400 audit(1760604164.239:312): avc: denied { mount } for pid=8154 comm="syz.6.610" name="/" dev="ramfs" ino=20420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 301.387903][ T30] audit: type=1400 audit(1760604164.409:313): avc: denied { create } for pid=8154 comm="syz.6.610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 303.239589][ T8191] netlink: 4 bytes leftover after parsing attributes in process `syz.2.620'. [ 303.471051][ T8199] tipc: Enabling of bearer rejected, failed to enable media [ 304.269752][ T8221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.630'. [ 305.180291][ T8226] F2FS-fs (nbd0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 305.188194][ T8226] F2FS-fs (nbd0): Can't find valid F2FS filesystem in 1th superblock [ 305.197647][ T8226] F2FS-fs (nbd0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 305.205411][ T8226] F2FS-fs (nbd0): Can't find valid F2FS filesystem in 2th superblock [ 306.087793][ T8247] tipc: Enabling of bearer rejected, failed to enable media [ 306.277441][ T5909] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 306.477446][ T5909] usb 3-1: Using ep0 maxpacket: 32 [ 307.648835][ T5909] usb 3-1: unable to get BOS descriptor or descriptor too short [ 307.659435][ T5909] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 307.667036][ T5909] usb 3-1: can't read configurations, error -71 [ 308.063599][ T8274] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 308.071437][ T8274] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 1th superblock [ 308.080731][ T8274] F2FS-fs (nbd6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 308.088627][ T8274] F2FS-fs (nbd6): Can't find valid F2FS filesystem in 2th superblock [ 310.657159][ T8308] tipc: Enabled bearer , priority 0 [ 311.191016][ T8308] tipc: Resetting bearer [ 311.253546][ T8306] tipc: Disabling bearer [ 311.386022][ T30] audit: type=1400 audit(1760604174.399:314): avc: denied { connect } for pid=8316 comm="syz.6.661" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 311.509553][ T8324] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 311.517282][ T8324] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 311.526150][ T8324] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 311.534341][ T8324] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 312.504171][ T8339] netlink: 28 bytes leftover after parsing attributes in process `syz.0.667'. [ 312.533757][ T8339] tipc: Started in network mode [ 312.539438][ T8339] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 312.549486][ T8339] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 312.558217][ T8339] tipc: Enabled bearer , priority 10 [ 312.600424][ T30] audit: type=1400 audit(1760604175.629:315): avc: denied { ioctl } for pid=8341 comm="syz.6.670" path="socket:[21803]" dev="sockfs" ino=21803 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 312.717332][ T8347] nbd: must specify at least one socket [ 312.817748][ T30] audit: type=1400 audit(1760604175.829:316): avc: denied { setopt } for pid=8348 comm="syz.6.672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 313.017982][ T30] audit: type=1400 audit(1760604176.039:317): avc: denied { write } for pid=8356 comm="syz.4.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 313.038702][ T5942] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 313.171724][ T8362] pim6reg1: entered promiscuous mode [ 313.177135][ T8362] pim6reg1: entered allmulticast mode [ 313.218854][ T5942] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 313.231031][ T5942] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 313.243218][ T5942] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.294105][ T5942] usb 1-1: config 0 descriptor?? [ 313.342034][ T5942] pwc: Askey VC010 type 2 USB webcam detected. [ 313.467463][ T5909] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 313.620602][ T5945] tipc: Node number set to 1 [ 313.734138][ T8373] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 314.048901][ T5942] pwc: recv_control_msg error -32 req 02 val 2b00 [ 314.067605][ T5909] usb 6-1: Using ep0 maxpacket: 32 [ 314.074597][ T5909] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.074711][ T5942] pwc: recv_control_msg error -32 req 02 val 2700 [ 314.199573][ T8374] ================================================================== [ 314.205217][ T30] audit: type=1400 audit(1760604177.199:318): avc: denied { write } for pid=8356 comm="syz.4.676" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 314.207664][ T8374] BUG: KASAN: slab-out-of-bounds in __cpa_addr+0x1d3/0x220 [ 314.207696][ T8374] Read of size 8 at addr ffff888028318888 by task syz.4.676/8374 [ 314.207712][ T8374] [ 314.207722][ T8374] CPU: 1 UID: 0 PID: 8374 Comm: syz.4.676 Not tainted syzkaller #0 PREEMPT(full) [ 314.207743][ T8374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 314.207755][ T8374] Call Trace: [ 314.207763][ T8374] [ 314.207769][ T8374] dump_stack_lvl+0x116/0x1f0 [ 314.207791][ T8374] print_report+0xcd/0x630 [ 314.207815][ T8374] ? __virt_addr_valid+0x81/0x610 [ 314.207832][ T8374] ? __phys_addr+0xe8/0x180 [ 314.207850][ T8374] ? __cpa_addr+0x1d3/0x220 [ 314.207869][ T8374] kasan_report+0xe0/0x110 [ 314.207893][ T8374] ? __cpa_addr+0x1d3/0x220 [ 314.207914][ T8374] __cpa_addr+0x1d3/0x220 [ 314.207934][ T8374] cpa_flush+0x28b/0x8a0 [ 314.207956][ T8374] ? __pfx_cpa_flush+0x10/0x10 [ 314.207976][ T8374] ? pgprot2cachemode+0x9a/0x130 [ 314.207992][ T8374] ? __pfx_pgprot2cachemode+0x10/0x10 [ 314.208010][ T8374] change_page_attr_set_clr+0x34e/0x4a0 [ 314.208033][ T8374] ? __pfx_change_page_attr_set_clr+0x10/0x10 [ 314.208060][ T8374] ? lockdep_hardirqs_on+0x7c/0x110 [ 314.208081][ T8374] _set_pages_array+0x1ab/0x2c0 [ 314.208104][ T8374] drm_gem_shmem_get_pages_locked+0x384/0x490 [ 314.208126][ T8374] ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10 [ 314.208146][ T8374] ? __pfx___might_resched+0x10/0x10 [ 314.208164][ T8374] drm_gem_shmem_mmap+0xc9/0x550 [ 314.208189][ T8374] ? __pfx_drm_gem_shmem_object_mmap+0x10/0x10 [ 314.208209][ T8374] drm_gem_mmap_obj+0x1b5/0x560 [ 314.208233][ T8374] drm_gem_mmap+0x40b/0x620 [ 314.208255][ T8374] ? __pfx_drm_gem_mmap+0x10/0x10 [ 314.208276][ T8374] ? vm_area_alloc+0x1f/0x160 [ 314.208292][ T8374] ? lockdep_init_map_type+0x5c/0x280 [ 314.208314][ T8374] __mmap_region+0x1309/0x27a0 [ 314.208335][ T8374] ? __pfx___mmap_region+0x10/0x10 [ 314.208353][ T8374] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 314.208378][ T8374] ? audit_log_end+0x1f/0x30 [ 314.208398][ T8374] ? audit_log_end+0x1f/0x30 [ 314.208417][ T8374] ? common_lsm_audit+0x260/0x300 [ 314.208467][ T8374] ? __lock_acquire+0xb8a/0x1c90 [ 314.208492][ T8374] mmap_region+0x32b/0x3f0 [ 314.208516][ T8374] do_mmap+0xa3e/0x1210 [ 314.208540][ T8374] ? __pfx_do_mmap+0x10/0x10 [ 314.208561][ T8374] ? __pfx_down_write_killable+0x10/0x10 [ 314.208584][ T8374] vm_mmap_pgoff+0x29e/0x470 [ 314.208608][ T8374] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 314.208633][ T8374] ? __fget_files+0x20e/0x3c0 [ 314.208656][ T8374] ksys_mmap_pgoff+0x32c/0x5c0 [ 314.208679][ T8374] __x64_sys_mmap+0x125/0x190 [ 314.208699][ T8374] do_syscall_64+0xcd/0xfa0 [ 314.208718][ T8374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.208733][ T8374] RIP: 0033:0x7fb9af58eec9 [ 314.208746][ T8374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.208762][ T8374] RSP: 002b:00007fb9b0425038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 314.208778][ T8374] RAX: ffffffffffffffda RBX: 00007fb9af7e6270 RCX: 00007fb9af58eec9 [ 314.208788][ T8374] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000 [ 314.208798][ T8374] RBP: 00007fb9af611f91 R08: 0000000000000007 R09: 0000000100000000 [ 314.208827][ T8374] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 314.208837][ T8374] R13: 00007fb9af7e6308 R14: 00007fb9af7e6270 R15: 00007ffd76bc84c8 [ 314.208854][ T8374] [ 314.208859][ T8374] [ 314.569036][ T8374] Allocated by task 8374: [ 314.573341][ T8374] kasan_save_stack+0x33/0x60 [ 314.578010][ T8374] kasan_save_track+0x14/0x30 [ 314.582675][ T8374] __kasan_kmalloc+0xaa/0xb0 [ 314.587256][ T8374] __kvmalloc_node_noprof+0x3a3/0x9c0 [ 314.592633][ T8374] drm_gem_get_pages+0x144/0xa10 [ 314.597611][ T8374] drm_gem_shmem_get_pages_locked+0x1e6/0x490 [ 314.603665][ T8374] drm_gem_shmem_mmap+0xc9/0x550 [ 314.608589][ T8374] drm_gem_mmap_obj+0x1b5/0x560 [ 314.613775][ T8374] drm_gem_mmap+0x40b/0x620 [ 314.618271][ T8374] __mmap_region+0x1309/0x27a0 [ 314.623029][ T8374] mmap_region+0x32b/0x3f0 [ 314.627429][ T8374] do_mmap+0xa3e/0x1210 [ 314.631573][ T8374] vm_mmap_pgoff+0x29e/0x470 [ 314.636149][ T8374] ksys_mmap_pgoff+0x32c/0x5c0 [ 314.641006][ T8374] __x64_sys_mmap+0x125/0x190 [ 314.645671][ T8374] do_syscall_64+0xcd/0xfa0 [ 314.650171][ T8374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.656046][ T8374] [ 314.658350][ T8374] The buggy address belongs to the object at ffff888028318800 [ 314.658350][ T8374] which belongs to the cache kmalloc-192 of size 192 [ 314.672467][ T8374] The buggy address is located 0 bytes to the right of [ 314.672467][ T8374] allocated 136-byte region [ffff888028318800, ffff888028318888) [ 314.686940][ T8374] [ 314.689246][ T8374] The buggy address belongs to the physical page: [ 314.695631][ T8374] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28318 [ 314.704374][ T8374] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 314.711461][ T8374] page_type: f5(slab) [ 314.715422][ T8374] raw: 00fff00000000000 ffff88813ff263c0 dead000000000100 dead000000000122 [ 314.724014][ T8374] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 314.732574][ T8374] page dumped because: kasan: bad access detected [ 314.738963][ T8374] page_owner tracks the page as allocated [ 314.744651][ T8374] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 8161092150, free_ts 0 [ 314.762254][ T8374] post_alloc_hook+0x1c0/0x230 [ 314.767002][ T8374] get_page_from_freelist+0x10a3/0x3a30 [ 314.772538][ T8374] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 314.778416][ T8374] alloc_pages_mpol+0x1fb/0x550 [ 314.783253][ T8374] new_slab+0x24a/0x360 [ 314.787389][ T8374] ___slab_alloc+0xdc4/0x1ae0 [ 314.792064][ T8374] __slab_alloc.constprop.0+0x63/0x110 [ 314.797504][ T8374] __kmalloc_node_track_caller_noprof+0x4db/0x8a0 [ 314.803906][ T8374] kmemdup_noprof+0x29/0x60 [ 314.808418][ T8374] neigh_parms_alloc+0x85/0x5d0 [ 314.813261][ T8374] inetdev_init+0x13c/0x5a0 [ 314.817753][ T8374] inetdev_event+0xc5f/0x18a0 [ 314.822509][ T8374] notifier_call_chain+0xbc/0x410 [ 314.827519][ T8374] call_netdevice_notifiers_info+0xbe/0x140 [ 314.833830][ T8374] register_netdevice+0x182e/0x2270 [ 314.839013][ T8374] ifb_init_module+0x117/0x200 [ 314.843768][ T8374] page_owner free stack trace missing [ 314.849123][ T8374] [ 314.851437][ T8374] Memory state around the buggy address: [ 314.857046][ T8374] ffff888028318780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 314.865087][ T8374] ffff888028318800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 314.873127][ T8374] >ffff888028318880: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 314.881171][ T8374] ^ [ 314.885474][ T8374] ffff888028318900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 314.893514][ T8374] ffff888028318980: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 314.901551][ T8374] ================================================================== [ 314.963830][ T30] audit: type=1400 audit(1760604177.209:319): avc: denied { map } for pid=8356 comm="syz.4.676" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 314.964144][ T5942] pwc: recv_control_msg error -32 req 02 val 2c00 [ 315.018490][ T8374] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 315.025791][ T8374] CPU: 1 UID: 0 PID: 8374 Comm: syz.4.676 Not tainted syzkaller #0 PREEMPT(full) [ 315.034969][ T8374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 315.044997][ T8374] Call Trace: [ 315.048248][ T8374] [ 315.051161][ T8374] dump_stack_lvl+0x3d/0x1f0 [ 315.055730][ T8374] vpanic+0x640/0x6f0 [ 315.059699][ T8374] panic+0xca/0xd0 [ 315.063391][ T8374] ? __pfx_panic+0x10/0x10 [ 315.067777][ T8374] ? __cpa_addr+0x1d3/0x220 [ 315.072254][ T8374] ? preempt_schedule_common+0x44/0xc0 [ 315.077692][ T8374] ? preempt_schedule_thunk+0x16/0x30 [ 315.083038][ T8374] check_panic_on_warn+0xab/0xb0 [ 315.087957][ T8374] end_report+0x107/0x170 [ 315.092265][ T8374] kasan_report+0xee/0x110 [ 315.096670][ T8374] ? __cpa_addr+0x1d3/0x220 [ 315.101172][ T8374] __cpa_addr+0x1d3/0x220 [ 315.105475][ T8374] cpa_flush+0x28b/0x8a0 [ 315.109702][ T8374] ? __pfx_cpa_flush+0x10/0x10 [ 315.114457][ T8374] ? pgprot2cachemode+0x9a/0x130 [ 315.119471][ T8374] ? __pfx_pgprot2cachemode+0x10/0x10 [ 315.124829][ T8374] change_page_attr_set_clr+0x34e/0x4a0 [ 315.130358][ T8374] ? __pfx_change_page_attr_set_clr+0x10/0x10 [ 315.136403][ T8374] ? lockdep_hardirqs_on+0x7c/0x110 [ 315.141577][ T8374] _set_pages_array+0x1ab/0x2c0 [ 315.146406][ T8374] drm_gem_shmem_get_pages_locked+0x384/0x490 [ 315.152449][ T8374] ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10 [ 315.159009][ T8374] ? __pfx___might_resched+0x10/0x10 [ 315.164276][ T8374] drm_gem_shmem_mmap+0xc9/0x550 [ 315.169187][ T8374] ? __pfx_drm_gem_shmem_object_mmap+0x10/0x10 [ 315.175314][ T8374] drm_gem_mmap_obj+0x1b5/0x560 [ 315.180150][ T8374] drm_gem_mmap+0x40b/0x620 [ 315.184629][ T8374] ? __pfx_drm_gem_mmap+0x10/0x10 [ 315.189634][ T8374] ? vm_area_alloc+0x1f/0x160 [ 315.194302][ T8374] ? lockdep_init_map_type+0x5c/0x280 [ 315.199651][ T8374] __mmap_region+0x1309/0x27a0 [ 315.204392][ T8374] ? __pfx___mmap_region+0x10/0x10 [ 315.209547][ T8374] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 315.215515][ T8374] ? audit_log_end+0x1f/0x30 [ 315.220090][ T8374] ? audit_log_end+0x1f/0x30 [ 315.224654][ T8374] ? common_lsm_audit+0x260/0x300 [ 315.229679][ T8374] ? __lock_acquire+0xb8a/0x1c90 [ 315.234608][ T8374] mmap_region+0x32b/0x3f0 [ 315.239015][ T8374] do_mmap+0xa3e/0x1210 [ 315.243156][ T8374] ? __pfx_do_mmap+0x10/0x10 [ 315.247726][ T8374] ? __pfx_down_write_killable+0x10/0x10 [ 315.253339][ T8374] vm_mmap_pgoff+0x29e/0x470 [ 315.257915][ T8374] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 315.263093][ T8374] ? __fget_files+0x20e/0x3c0 [ 315.267748][ T8374] ksys_mmap_pgoff+0x32c/0x5c0 [ 315.272491][ T8374] __x64_sys_mmap+0x125/0x190 [ 315.277153][ T8374] do_syscall_64+0xcd/0xfa0 [ 315.281648][ T8374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.287525][ T8374] RIP: 0033:0x7fb9af58eec9 [ 315.291917][ T8374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 315.311516][ T8374] RSP: 002b:00007fb9b0425038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 315.319902][ T8374] RAX: ffffffffffffffda RBX: 00007fb9af7e6270 RCX: 00007fb9af58eec9 [ 315.327858][ T8374] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000 [ 315.335823][ T8374] RBP: 00007fb9af611f91 R08: 0000000000000007 R09: 0000000100000000 [ 315.343785][ T8374] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 315.351732][ T8374] R13: 00007fb9af7e6308 R14: 00007fb9af7e6270 R15: 00007ffd76bc84c8 [ 315.359685][ T8374] [ 315.362877][ T8374] Kernel Offset: disabled [ 315.367175][ T8374] Rebooting in 86400 seconds..