last executing test programs: 4.15929897s ago: executing program 4 (id=53): r0 = syz_usb_connect$uac1(0x2, 0x71, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x0, 0x0, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0xf, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, 0x0, &(0x7f0000000440)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42b}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xb}}, 0x0, 0x0, 0x0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 3.712586778s ago: executing program 0 (id=60): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) r2 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 2.832524147s ago: executing program 0 (id=65): ioperm(0xc210, 0x4, 0x5) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.832162547s ago: executing program 0 (id=66): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) rt_sigprocmask(0x1, &(0x7f0000000000)={[0x100]}, &(0x7f00000002c0), 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x80002, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0xc048aec8, &(0x7f0000000080)={0x2, 0x0, @ioapic={0xeeee0000, 0x72000, 0xbd0, 0xa5, 0x0, [{0x6, 0x5, 0xdd, '\x00', 0x2}, {0x40, 0x8, 0x86, '\x00', 0x4}, {0x37, 0x6, 0x6, '\x00', 0x6}, {0x1, 0x77, 0x1, '\x00', 0x6}, {0x3, 0x8, 0x4, '\x00', 0x7}, {0xe5, 0x2, 0x2, '\x00', 0x9}, {0xfa, 0x7, 0x3, '\x00', 0x8}, {0x9, 0x60, 0x3, '\x00', 0x5}, {0x7, 0x7, 0xff, '\x00', 0x7f}, {0x81, 0xb, 0x9, '\x00', 0x3}, {0x0, 0xe, 0xf8, '\x00', 0xb4}, {0x2, 0x4, 0x4, '\x00', 0x21}, {0x2, 0x6, 0x2b, '\x00', 0x4}, {0x4, 0x0, 0x57, '\x00', 0x7}, {0x3, 0x1, 0x8, '\x00', 0x5}, {0x1, 0x6, 0x0, '\x00', 0x2}, {0xfb, 0x61, 0x50, '\x00', 0x6}, {0x1, 0x5, 0x2}, {0x2, 0x9, 0x2, '\x00', 0x7}, {0x4, 0x4, 0xb, '\x00', 0x1}, {0x8, 0x7, 0x3, '\x00', 0x36}, {0x9, 0x1, 0x8, '\x00', 0x58}, {0xde, 0x1c, 0x8, '\x00', 0x9}, {0x9, 0xa, 0x9, '\x00', 0x4}]}}) 2.785044056s ago: executing program 1 (id=68): sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x14, 0xd, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20000004}, 0xc000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) r2 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x8000200a}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 2.397576306s ago: executing program 3 (id=70): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x46}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendto(r1, &(0x7f0000000880)="00ac00e7ef007b00000000000000a1000080a9285aeb5eb616000c4c5f397e811ce480fe", 0x24, 0x48c86, 0x0, 0x0) 2.290546145s ago: executing program 3 (id=71): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xc8442, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x2, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) 2.223625255s ago: executing program 3 (id=72): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x1c, r1, 0xa120c752484010ff, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044011}, 0x810) 2.168370855s ago: executing program 3 (id=73): syz_open_procfs(0x0, 0x0) socket$inet6(0xa, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x5}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x5) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000d80)={{0x5, 0x2, 0xf1f8, 0xe}, 'syz1\x00', 0x22}) ioctl$UI_DEV_CREATE(r1, 0x5501) 1.972367144s ago: executing program 0 (id=74): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="e10931d8640a00000000000086dd600141400010880020010000000000000000000000000000fe8000000000000000000000000000aa00000000000890"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x10b441, 0x63) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x2d) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0xd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2, 0x300}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) 1.963829304s ago: executing program 3 (id=75): syz_usb_connect$cdc_ecm(0x2, 0x55, &(0x7f0000001d40)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x43, 0x1, 0x1, 0x3, 0x50, 0x0, [{{0x9, 0x4, 0x0, 0xfd, 0x3, 0x2, 0x6, 0x0, 0x4, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x4, 0x9, 0x6}, [@mdlm_detail={0x4, 0x24, 0x13, 0x5}, @mdlm_detail={0x4, 0x24, 0x13, 0x1}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x6, 0x6, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x1, 0x0, 0x10}}}}}]}}]}}, &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0}) 1.913173404s ago: executing program 4 (id=77): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x20000007d, 0x900) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0xc0109207, &(0x7f00000001c0)) 1.836275574s ago: executing program 4 (id=78): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 1.835900264s ago: executing program 4 (id=79): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f00000000c0)="17000000020001000003be8c5ee17688a2002b08030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba000840024f0298e9e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0x11a) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f000041c000/0x2000)=nil, 0x2000, 0x8) syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000359497400a115014c6c2000000010902520001000000000904"], 0x0) 1.661924494s ago: executing program 1 (id=81): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) syz_emit_ethernet(0x7e, &(0x7f00000006c0)={@local, @random="a15cc14e96b3", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, @broadcast, @rand_addr, {[@timestamp_addr={0x44, 0x1c, 0x0, 0x1, 0x0, [{@multicast2}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @cipso={0x86, 0x21, 0x0, [{0x0, 0xd, "34abeec8d03ff1a8b8835e"}, {0x0, 0xe, "4ef661e96b4014469f350a42"}]}]}}}}}}}, 0x0) 1.612972884s ago: executing program 1 (id=82): r0 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x7, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xf882b) 1.556326754s ago: executing program 2 (id=83): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0xfffffff9, 0x10}, 0xc) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.556138583s ago: executing program 1 (id=84): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = socket$igmp6(0xa, 0x3, 0x3a) getsockopt$MRT6(r2, 0x3a, 0x1, 0x0, 0x0) 1.514323193s ago: executing program 2 (id=85): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r4, 0x1, 0x2f, 0x0, &(0x7f00000000c0)) r5 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x6a, 0xa, 0xff00}, [@call={0xc}, @exit, @map_fd, @jmp]}, &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="11000000000000001a000000", @ANYRES32=r3, @ANYRES64=0x0], 0x20) 1.460093674s ago: executing program 2 (id=86): setrlimit(0xf, 0x0) timer_create(0x3, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x1e, 0x4, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0), 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) sendmmsg$unix(r1, &(0x7f0000004400), 0x400000000000203, 0x0) 1.215900293s ago: executing program 1 (id=87): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x10008ff, &(0x7f0000000340)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="280500003d0007010000000000000000017c0000040000000c000180060006006558000004050280ff"], 0x528}}, 0xc000) modify_ldt$write(0x1, &(0x7f0000000080)={0x800}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1f075, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x10000, @void, @value}, 0x94) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, &(0x7f00000003c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b88f8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ptrace$getregset(0x4205, r3, 0x1, &(0x7f0000000080)={&(0x7f00000000c0)=""/120, 0x78}) 940.900562ms ago: executing program 0 (id=88): openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7816, 0x2, 0x0, 0x81, 0x801ff, 0x1, 0x1}, 0x1c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) 571.003461ms ago: executing program 2 (id=89): r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000011c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) 453.197371ms ago: executing program 2 (id=90): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 452.765931ms ago: executing program 2 (id=91): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) madvise(&(0x7f0000413000/0x3000)=nil, 0x3000, 0x66) 224.39265ms ago: executing program 1 (id=92): syz_usb_connect$uac1(0x2, 0xda, &(0x7f0000000340)=ANY=[@ANYBLOB="1201b0c63e0739086b1d01014000010203010902c80003010000800904000000010100000a24010000060201020c2402020602060006ff090401000001020000090401010101020000072401090100000924020206000300060c240201270320cbb2bb9bcb0905010900021f0504072501000006000904020000010200000904020101ff"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 104.5072ms ago: executing program 4 (id=93): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r1}, 0x10) time(0x0) 92.78434ms ago: executing program 4 (id=94): pipe(&(0x7f0000000140)) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 468.76µs ago: executing program 3 (id=95): openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) 0s ago: executing program 0 (id=96): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x5, 0x1, 0x8005, 0x401}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. [ 20.133164][ T24] audit: type=1400 audit(1736870050.730:66): avc: denied { mounton } for pid=272 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.134453][ T272] cgroup: Unknown subsys name 'net' [ 20.138812][ T24] audit: type=1400 audit(1736870050.730:67): avc: denied { mount } for pid=272 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.144199][ T24] audit: type=1400 audit(1736870050.730:68): avc: denied { unmount } for pid=272 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.144380][ T272] cgroup: Unknown subsys name 'devices' [ 20.322471][ T272] cgroup: Unknown subsys name 'hugetlb' [ 20.327943][ T272] cgroup: Unknown subsys name 'rlimit' [ 20.469437][ T24] audit: type=1400 audit(1736870051.060:69): avc: denied { setattr } for pid=272 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.492748][ T24] audit: type=1400 audit(1736870051.060:70): avc: denied { mounton } for pid=272 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.499417][ T276] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.517686][ T24] audit: type=1400 audit(1736870051.060:71): avc: denied { mount } for pid=272 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.548911][ T24] audit: type=1400 audit(1736870051.130:72): avc: denied { relabelto } for pid=276 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.574274][ T24] audit: type=1400 audit(1736870051.130:73): avc: denied { write } for pid=276 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.603319][ T24] audit: type=1400 audit(1736870051.200:74): avc: denied { read } for pid=272 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.629088][ T24] audit: type=1400 audit(1736870051.200:75): avc: denied { open } for pid=272 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.655335][ T272] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.304938][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.311999][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.319731][ T282] device bridge_slave_0 entered promiscuous mode [ 21.353121][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.359970][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.367414][ T282] device bridge_slave_1 entered promiscuous mode [ 21.426104][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.433065][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.440502][ T287] device bridge_slave_0 entered promiscuous mode [ 21.448083][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.454967][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.462353][ T287] device bridge_slave_1 entered promiscuous mode [ 21.511372][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.518252][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.525530][ T283] device bridge_slave_0 entered promiscuous mode [ 21.533767][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.540675][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.547758][ T283] device bridge_slave_1 entered promiscuous mode [ 21.606091][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.613425][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.620757][ T289] device bridge_slave_0 entered promiscuous mode [ 21.627705][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.634790][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.642089][ T289] device bridge_slave_1 entered promiscuous mode [ 21.677602][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.684483][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.691596][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.698337][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.708586][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.715712][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.722957][ T286] device bridge_slave_0 entered promiscuous mode [ 21.729787][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.737059][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.744435][ T286] device bridge_slave_1 entered promiscuous mode [ 21.790948][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.798153][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.805281][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.813415][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.834188][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.841927][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.848978][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.856896][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.903920][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.911175][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.918574][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.925688][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.953381][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.960248][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.967321][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.974151][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.982229][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.989594][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.997380][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.005287][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.013190][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.020534][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.027553][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.035084][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.042469][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.049626][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.057287][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.066022][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.074268][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.081195][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.106718][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.115418][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.123291][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.131133][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.139359][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.146144][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.153420][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.161589][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.168419][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.175749][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.183750][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.190701][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.197917][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.206066][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.213017][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.236394][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.243990][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.251511][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.259496][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.266465][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.274059][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.282545][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.289375][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.296699][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.305071][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.312013][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.324037][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.332203][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.342322][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.350762][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.358829][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.367103][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.386252][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.399329][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.410902][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.419141][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.427300][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.435644][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.445828][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.454455][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.462907][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.472062][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.479985][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.486852][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.510872][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.518905][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.526787][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.535332][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.543323][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.551836][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.559800][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.568095][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.576576][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.584627][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.595048][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.603583][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.622392][ T282] device veth0_vlan entered promiscuous mode [ 22.630928][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.639598][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.649653][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.658842][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.669240][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.678758][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.688257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.697020][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.706780][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.714708][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.726608][ T287] device veth0_vlan entered promiscuous mode [ 22.736679][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.744727][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.754011][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.762165][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.772117][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.781803][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.792531][ T282] device veth1_macvtap entered promiscuous mode [ 22.804392][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.812621][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.819928][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.828423][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.836677][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.846669][ T286] device veth0_vlan entered promiscuous mode [ 22.853343][ T283] device veth0_vlan entered promiscuous mode [ 22.865447][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.874805][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.883063][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.891809][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.899927][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.908118][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.918043][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.925690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.940792][ T287] device veth1_macvtap entered promiscuous mode [ 22.950649][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.958736][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.967176][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.975849][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.995859][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.003128][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.010704][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.018920][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.028038][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.037635][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.047695][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.056413][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.064639][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.074256][ T286] device veth1_macvtap entered promiscuous mode [ 23.083434][ T283] device veth1_macvtap entered promiscuous mode [ 23.092321][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 23.093476][ T289] device veth0_vlan entered promiscuous mode [ 23.112787][ T282] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 23.134348][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.144845][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.152592][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.160771][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.168970][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.177425][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.185916][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.194467][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.203060][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.287054][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.375552][ T314] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.401856][ T289] device veth1_macvtap entered promiscuous mode [ 23.430948][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.461472][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.487392][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.495920][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.582730][ T328] IPv6: NLM_F_REPLACE set, but no existing node found! [ 24.653741][ T297] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.671869][ T348] usb usb7: usbfs: process 348 (syz.4.13) did not claim interface 0 before use [ 25.020252][ T297] usb 3-1: Using ep0 maxpacket: 32 [ 25.199079][ T297] usb 3-1: unable to get BOS descriptor or descriptor too short [ 25.253325][ T24] kauditd_printk_skb: 57 callbacks suppressed [ 25.253350][ T24] audit: type=1400 audit(1736870055.850:133): avc: denied { mounton } for pid=371 comm="syz.4.23" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 25.320646][ T297] usb 3-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.336286][ T297] usb 3-1: config 1 interface 0 has no altsetting 0 [ 25.345146][ T24] audit: type=1400 audit(1736870055.890:134): avc: denied { create } for pid=371 comm="syz.4.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.345633][ T381] netlink: 4 bytes leftover after parsing attributes in process `syz.1.27'. [ 25.366114][ T24] audit: type=1400 audit(1736870055.900:135): avc: denied { connect } for pid=371 comm="syz.4.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.513292][ T297] usb 3-1: New USB device found, idVendor=0c45, idProduct=5112, bcdDevice= 0.40 [ 25.650974][ T24] audit: type=1400 audit(1736870056.230:136): avc: denied { create } for pid=382 comm="syz.3.26" dev="anon_inodefs" ino=14916 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.670501][ T297] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.680698][ T297] usb 3-1: Product: syz [ 25.684919][ T297] usb 3-1: Manufacturer: syz [ 25.690087][ T297] usb 3-1: SerialNumber: syz [ 25.724255][ T24] audit: type=1400 audit(1736870056.230:137): avc: denied { ioctl } for pid=382 comm="syz.3.26" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=14916 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.774184][ T24] audit: type=1400 audit(1736870056.240:138): avc: denied { create } for pid=382 comm="syz.3.26" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 25.800273][ T24] audit: type=1400 audit(1736870056.240:139): avc: denied { mounton } for pid=382 comm="syz.3.26" path="/7/file0" dev="tmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 25.830442][ T399] netlink: 8 bytes leftover after parsing attributes in process `syz.1.32'. [ 25.840932][ T24] audit: type=1400 audit(1736870056.260:140): avc: denied { name_bind } for pid=389 comm="syz.0.28" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 25.862988][ T24] audit: type=1400 audit(1736870056.260:141): avc: denied { node_bind } for pid=389 comm="syz.0.28" saddr=224.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.882520][ T401] 9pnet: p9_errstr2errno: server reported unknown error [ 25.887960][ T24] audit: type=1400 audit(1736870056.370:142): avc: denied { read write } for pid=393 comm="syz.0.30" name="fuse" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 26.131542][ T408] 9pnet: Could not find request transport: rdma [ 26.150436][ T297] usbhid 3-1:1.0: can't add hid device: -71 [ 26.157434][ T297] usbhid: probe of 3-1:1.0 failed with error -71 [ 26.168537][ T297] usb 3-1: USB disconnect, device number 2 [ 26.540271][ T15] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.607334][ T447] mmap: syz.2.50 (447) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 26.670271][ T297] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.940342][ T15] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.960241][ T15] usb 4-1: config 0 has no interfaces? [ 26.965781][ T15] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 26.990247][ T15] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.001295][ T15] usb 4-1: config 0 descriptor?? [ 27.030379][ T297] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 27.051886][ T297] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.067745][ T297] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 27.081381][ T297] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 27.090341][ T297] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.100160][ T297] usb 2-1: config 0 descriptor?? [ 27.263497][ T5] usb 4-1: USB disconnect, device number 2 [ 27.360369][ T20] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 27.540374][ T15] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.582590][ T297] kovaplus 0003:1E7D:2D50.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0 [ 27.720308][ T20] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 27.729046][ T20] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 27.738926][ T20] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 27.785119][ T5] usb 2-1: USB disconnect, device number 2 [ 27.790934][ T15] usb 3-1: Using ep0 maxpacket: 32 [ 27.910497][ T15] usb 3-1: config 0 has an invalid interface number: 235 but max is 0 [ 27.919338][ T15] usb 3-1: config 0 has an invalid interface number: 30 but max is 0 [ 27.927826][ T15] usb 3-1: config 0 has an invalid descriptor of length 200, skipping remainder of the config [ 27.938392][ T15] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 27.947552][ T15] usb 3-1: config 0 has no interface number 0 [ 27.953846][ T15] usb 3-1: config 0 has no interface number 1 [ 27.959840][ T15] usb 3-1: config 0 interface 235 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 27.974695][ T497] binder: 494:497 ioctl c018620c 20000000 returned -1 [ 27.983274][ T497] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 27.990137][ T15] usb 3-1: too many endpoints for config 0 interface 30 altsetting 169: 127, using maximum allowed: 30 [ 28.001401][ T15] usb 3-1: config 0 interface 30 altsetting 169 has 0 endpoint descriptors, different from the interface descriptor's value: 127 [ 28.030386][ T20] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 28.039752][ T20] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.048137][ T20] usb 5-1: Product: syz [ 28.052627][ T20] usb 5-1: Manufacturer: syz [ 28.057094][ T20] usb 5-1: SerialNumber: syz [ 28.059783][ T15] usb 3-1: config 0 interface 30 has no altsetting 0 [ 28.250388][ T15] usb 3-1: New USB device found, idVendor=085a, idProduct=0009, bcdDevice=a3.47 [ 28.260602][ T15] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.268534][ T15] usb 3-1: Product: syz [ 28.272866][ T15] usb 3-1: Manufacturer: syz [ 28.277493][ T15] usb 3-1: SerialNumber: syz [ 28.282990][ T15] usb 3-1: config 0 descriptor?? [ 28.570785][ T20] usb 5-1: 0:2 : does not exist [ 28.779464][ T20] usb 5-1: USB disconnect, device number 2 [ 28.794925][ T15] usb 3-1: USB disconnect, device number 3 [ 28.832051][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 28.848252][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 28.857115][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 28.866091][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 28.876775][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 28.885695][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 28.894197][ T518] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 29.054678][ T527] input: syz1 as /devices/virtual/input/input4 [ 29.510325][ T15] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 29.770401][ T25] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 29.940289][ T15] usb 4-1: unable to get BOS descriptor or descriptor too short [ 29.980313][ T15] usb 4-1: not running at top speed; connect to a high speed hub [ 30.100631][ T15] usb 4-1: config 1 interface 0 altsetting 253 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 30.120547][ T15] usb 4-1: config 1 interface 0 altsetting 253 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 30.130374][ T25] usb 5-1: config index 0 descriptor too short (expected 82, got 18) [ 30.142504][ T15] usb 4-1: config 1 interface 0 has no altsetting 0 [ 30.150048][ T25] usb 5-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=c2.c6 [ 30.160439][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.178330][ T25] usb 5-1: config 0 descriptor?? [ 30.330045][ T24] kauditd_printk_skb: 35 callbacks suppressed [ 30.330058][ T24] audit: type=1400 audit(1736870060.920:178): avc: denied { setopt } for pid=566 comm="syz.0.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.360602][ T15] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 30.370979][ T15] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.379706][ T15] usb 4-1: Product: syz [ 30.384136][ T15] usb 4-1: Manufacturer: syz [ 30.389498][ T15] usb 4-1: SerialNumber: syz [ 30.410455][ T531] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 30.566599][ T5] usb 5-1: USB disconnect, device number 3 [ 30.721344][ T15] usb 4-1: bad CDC descriptors [ 30.742551][ T15] usb 4-1: USB disconnect, device number 3 [ 31.164807][ T24] audit: type=1400 audit(1736870061.760:179): avc: denied { write } for pid=585 comm="syz.3.95" name="uinput" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 31.189542][ T586] input: syz0 as /devices/virtual/input/input5 [ 31.206700][ T588] ================================================================== [ 31.210323][ T25] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 31.214931][ T588] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 [ 31.230484][ T588] Read of size 8 at addr ffff888116d15cc0 by task syz.0.96/588 [ 31.237856][ T588] [ 31.240017][ T588] CPU: 0 PID: 588 Comm: syz.0.96 Not tainted 5.10.232-syzkaller-00746-g49e8ba0a684f #0 [ 31.249475][ T588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 31.259462][ T588] Call Trace: [ 31.262594][ T588] dump_stack_lvl+0x1e2/0x24b [ 31.267100][ T588] ? bfq_pos_tree_add_move+0x43b/0x43b [ 31.272388][ T588] ? panic+0x812/0x812 [ 31.276297][ T588] print_address_description+0x81/0x3b0 [ 31.281688][ T588] kasan_report+0x179/0x1c0 [ 31.286011][ T588] ? tc_setup_flow_action+0xbb8/0x3630 [ 31.291358][ T588] ? tc_setup_flow_action+0xbb8/0x3630 [ 31.296615][ T588] __asan_report_load8_noabort+0x14/0x20 [ 31.302165][ T588] tc_setup_flow_action+0xbb8/0x3630 [ 31.307281][ T588] ? __kmalloc+0x1aa/0x330 [ 31.311582][ T588] ? flow_rule_alloc+0x30/0x2b0 [ 31.316220][ T588] mall_replace_hw_filter+0x394/0xc10 [ 31.321424][ T588] ? mall_set_parms+0x440/0x440 [ 31.326114][ T588] ? tcf_exts_destroy+0xb0/0xb0 [ 31.330797][ T588] ? pcpu_memcg_post_alloc_hook+0x1c8/0x360 [ 31.336532][ T588] ? pcpu_alloc+0xfa0/0x1420 [ 31.340952][ T588] ? mall_set_parms+0x4b/0x440 [ 31.345637][ T588] ? mall_set_parms+0x1a2/0x440 [ 31.350416][ T588] mall_change+0x573/0x7a0 [ 31.354881][ T588] ? __kasan_check_write+0x14/0x20 [ 31.359827][ T588] ? mall_get+0xb0/0xb0 [ 31.363829][ T588] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 31.369568][ T588] tc_new_tfilter+0x168e/0x1dc0 [ 31.374234][ T588] ? mall_get+0xb0/0xb0 [ 31.378235][ T588] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.383782][ T588] ? security_capable+0x87/0xb0 [ 31.388470][ T588] ? ns_capable+0x89/0xe0 [ 31.392631][ T588] ? netlink_net_capable+0x125/0x160 [ 31.397759][ T588] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.403246][ T588] rtnetlink_rcv_msg+0x77a/0xc50 [ 31.408003][ T588] ? is_bpf_text_address+0x172/0x190 [ 31.413292][ T588] ? rtnetlink_bind+0x80/0x80 [ 31.417809][ T588] ? arch_stack_walk+0xf3/0x140 [ 31.422495][ T588] ? stack_trace_save+0x113/0x1c0 [ 31.427357][ T588] ? __kasan_check_write+0x14/0x20 [ 31.432341][ T588] ? stack_trace_snprint+0xf0/0xf0 [ 31.437246][ T588] ? avc_has_perm+0x14d/0x400 [ 31.441757][ T588] ? memcpy+0x56/0x70 [ 31.445707][ T588] ? avc_has_perm+0x275/0x400 [ 31.450212][ T588] ? __kasan_slab_alloc+0xb1/0xe0 [ 31.455076][ T588] ? slab_post_alloc_hook+0x61/0x2f0 [ 31.460186][ T588] ? kmem_cache_alloc+0x168/0x2e0 [ 31.465055][ T588] ? avc_has_perm_noaudit+0x240/0x240 [ 31.470256][ T588] ? iov_iter_advance+0x258/0xb20 [ 31.475116][ T588] netlink_rcv_skb+0x1cf/0x410 [ 31.479718][ T588] ? rtnetlink_bind+0x80/0x80 [ 31.484229][ T588] ? netlink_ack+0xb30/0xb30 [ 31.488655][ T588] ? __netlink_lookup+0x37b/0x3a0 [ 31.493679][ T588] rtnetlink_rcv+0x1c/0x20 [ 31.497945][ T588] netlink_unicast+0x8df/0xac0 [ 31.502554][ T588] ? netlink_detachskb+0x90/0x90 [ 31.507321][ T588] ? security_netlink_send+0x7b/0xa0 [ 31.512440][ T588] netlink_sendmsg+0xa46/0xd00 [ 31.517165][ T588] ? netlink_getsockopt+0x5c0/0x5c0 [ 31.522296][ T588] ? security_socket_sendmsg+0x82/0xb0 [ 31.527764][ T588] ? netlink_getsockopt+0x5c0/0x5c0 [ 31.532796][ T588] ____sys_sendmsg+0x59e/0x8f0 [ 31.537407][ T588] ? __sys_sendmsg_sock+0x40/0x40 [ 31.542264][ T588] ? import_iovec+0xe5/0x120 [ 31.546678][ T588] ___sys_sendmsg+0x252/0x2e0 [ 31.551195][ T588] ? __sys_sendmsg+0x280/0x280 [ 31.555886][ T588] ? __fdget+0x1bc/0x240 [ 31.559971][ T588] __se_sys_sendmsg+0x1b1/0x280 [ 31.564645][ T588] ? __x64_sys_sendmsg+0x90/0x90 [ 31.569421][ T588] ? fpu__clear_all+0x20/0x20 [ 31.573940][ T588] ? __kasan_check_read+0x11/0x20 [ 31.578792][ T588] __x64_sys_sendmsg+0x7b/0x90 [ 31.583391][ T588] do_syscall_64+0x34/0x70 [ 31.587644][ T588] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.593373][ T588] RIP: 0033:0x7f81d06f4d29 [ 31.597628][ T588] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 31.617251][ T588] RSP: 002b:00007f81ced66038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 31.625670][ T588] RAX: ffffffffffffffda RBX: 00007f81d08e4fa0 RCX: 00007f81d06f4d29 [ 31.633592][ T588] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000004 [ 31.641599][ T588] RBP: 00007f81d0770b08 R08: 0000000000000000 R09: 0000000000000000 [ 31.649748][ T588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.657573][ T588] R13: 0000000000000000 R14: 00007f81d08e4fa0 R15: 00007fffbba6b448 [ 31.667689][ T588] [ 31.670278][ T588] Allocated by task 588: [ 31.675409][ T588] ____kasan_kmalloc+0xdb/0x110 [ 31.681307][ T588] __kasan_kmalloc+0x9/0x10 [ 31.687593][ T588] __kmalloc+0x1aa/0x330 [ 31.692050][ T588] tcf_idr_create+0x5f/0x770 [ 31.697113][ T588] tcf_idr_create_from_flags+0x5f/0x70 [ 31.703028][ T588] tcf_gact_init+0x373/0x6e0 [ 31.707525][ T588] tcf_action_init_1+0x584/0x830 [ 31.712369][ T588] tcf_action_init+0x2b5/0x800 [ 31.717712][ T588] tcf_exts_validate+0x232/0x540 [ 31.723118][ T588] mall_set_parms+0x4b/0x440 [ 31.728172][ T588] mall_change+0x49e/0x7a0 [ 31.732679][ T588] tc_new_tfilter+0x168e/0x1dc0 [ 31.737465][ T588] rtnetlink_rcv_msg+0x77a/0xc50 [ 31.742227][ T588] netlink_rcv_skb+0x1cf/0x410 [ 31.747002][ T588] rtnetlink_rcv+0x1c/0x20 [ 31.752395][ T588] netlink_unicast+0x8df/0xac0 [ 31.757362][ T588] netlink_sendmsg+0xa46/0xd00 [ 31.761949][ T588] ____sys_sendmsg+0x59e/0x8f0 [ 31.766798][ T588] ___sys_sendmsg+0x252/0x2e0 [ 31.771409][ T588] __se_sys_sendmsg+0x1b1/0x280 [ 31.776091][ T588] __x64_sys_sendmsg+0x7b/0x90 [ 31.780694][ T588] do_syscall_64+0x34/0x70 [ 31.785045][ T588] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.790839][ T588] [ 31.793026][ T588] The buggy address belongs to the object at ffff888116d15c00 [ 31.793026][ T588] which belongs to the cache kmalloc-192 of size 192 [ 31.807008][ T588] The buggy address is located 0 bytes to the right of [ 31.807008][ T588] 192-byte region [ffff888116d15c00, ffff888116d15cc0) [ 31.820443][ T588] The buggy address belongs to the page: [ 31.826021][ T588] page:ffffea00045b4540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116d15 [ 31.836105][ T588] flags: 0x4000000000000200(slab) [ 31.840931][ T588] raw: 4000000000000200 ffffea0004574300 0000000200000002 ffff888100043380 [ 31.849345][ T588] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 31.858043][ T588] page dumped because: kasan: bad access detected [ 31.864892][ T588] page_owner tracks the page as allocated [ 31.870462][ T588] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 95, ts 5309701228, free_ts 0 [ 31.885377][ T588] prep_new_page+0x166/0x180 [ 31.889799][ T588] get_page_from_freelist+0x2d8c/0x2f30 [ 31.895172][ T588] __alloc_pages_nodemask+0x435/0xaf0 [ 31.900578][ T588] new_slab+0x80/0x400 [ 31.904579][ T588] ___slab_alloc+0x302/0x4b0 [ 31.908985][ T588] __slab_alloc+0x63/0xa0 [ 31.913149][ T588] kmem_cache_alloc_trace+0x1bd/0x2e0 [ 31.918382][ T588] kernfs_fop_open+0x324/0xab0 [ 31.922958][ T588] do_dentry_open+0x7c1/0x10d0 [ 31.927548][ T588] vfs_open+0x73/0x80 [ 31.931465][ T588] path_openat+0x2660/0x3000 [ 31.935983][ T588] do_filp_open+0x21c/0x460 [ 31.940310][ T588] do_sys_openat2+0x13f/0x710 [ 31.944816][ T588] __x64_sys_openat+0x243/0x290 [ 31.949505][ T588] do_syscall_64+0x34/0x70 [ 31.953761][ T588] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.959815][ T588] page_owner free stack trace missing [ 31.965450][ T588] [ 31.968370][ T588] Memory state around the buggy address: [ 31.974837][ T588] ffff888116d15b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 31.983569][ T588] ffff888116d15c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.992302][ T588] >ffff888116d15c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 32.001081][ T588] ^ [ 32.007519][ T588] ffff888116d15d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.018058][ T588] ffff888116d15d80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 32.026378][ T588] ================================================================== [ 32.034367][ T588] Disabling lock debugging due to kernel taint [ 32.072754][ T591] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 32.420374][ T25] usb 2-1: unable to get BOS descriptor or descriptor too short [ 32.460375][ T25] usb 2-1: not running at top speed; connect to a high speed hub [ 32.550445][ T25] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.559123][ T25] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.567782][ T25] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.576373][ T25] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.586313][ T25] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 32.595295][ T25] usb 2-1: config 1 has no interface number 1 [ 32.601402][ T25] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 32.614212][ T25] usb 2-1: config 1 interface 2 has no altsetting 0 [ 32.830342][ T25] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 32.839332][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.847187][ T25] usb 2-1: Product: syz [ 32.851242][ T25] usb 2-1: Manufacturer: syz [ 32.855743][ T25] usb 2-1: SerialNumber: syz [ 33.182495][ T25] usb 2-1: USB disconnect, device number 3 [ 33.430979][ T307] udevd[307]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory