last executing test programs: 6.896772654s ago: executing program 3 (id=48): sendmmsg(0xffffffffffffffff, &(0x7f0000003f80)=[{{0x0, 0x0, &(0x7f0000000c00)=[{0x0}, {0x0}, {&(0x7f0000002640)}], 0x3}}], 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0)=0x1a00, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfffffd9d) sendfile(r0, r1, 0x0, 0x7ffff000) 6.53612199s ago: executing program 3 (id=52): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f00000013c0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001840)={0x24, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002b00)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x0, @mcast1}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000680)='!', &(0x7f0000000780), 0x6, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_usb_control_io(r0, &(0x7f0000001300)={0x2c, 0x0, &(0x7f0000001200)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, &(0x7f0000001280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x0, 0x0, 0x0, "b7052183", "35cfaf65"}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0003"], 0x0, 0x0}, 0x0) 4.922241602s ago: executing program 1 (id=70): syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea00090587033b"], 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 3.768223662s ago: executing program 2 (id=80): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454da, &(0x7f00000001c0)={'bond_slave_0\x00'}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454da, &(0x7f0000000140)={'bond0\x00'}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'pimreg0\x00', 0x1}) 2.901843041s ago: executing program 3 (id=83): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x3}, 0x10) recvmmsg(r0, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000480)=""/4085, 0xff5}], 0x1}}], 0x1, 0x7ffeedc0, 0x0) 2.846178774s ago: executing program 3 (id=84): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000001c0), &(0x7f0000000440), &(0x7f0000000000)="cc", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55) 2.813077395s ago: executing program 1 (id=85): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x74}, {0x6}]}, 0x10) 2.754533907s ago: executing program 3 (id=86): fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='stack\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) pread64(r0, &(0x7f00000002c0)=""/269, 0x10d, 0x0) 2.646196752s ago: executing program 2 (id=87): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002480)=[{&(0x7f0000000580)="9718b79d4ba9879df6bad7f2abd39fa9bbfc612d11043204d1c852bd", 0x1c}], 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f00000000c0)=0xfffffffb, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @dev}, 0x10) splice(r0, 0x0, r2, 0x0, 0xe8, 0x0) 2.513037869s ago: executing program 2 (id=88): unshare(0x2000400) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/profiling', 0x22042, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) write$tun(r2, &(0x7f0000000280)=ANY=[@ANYRESDEC=r2], 0x15) 2.307460457s ago: executing program 4 (id=89): r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f00000028c0)=0x2, 0x4) r1 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='veth1_virt_wifi\x00', 0x10) sendto$unix(r1, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 2.238099281s ago: executing program 2 (id=90): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsuid(r2) utimensat(r0, 0x0, 0x0, 0x0) 2.237537461s ago: executing program 2 (id=91): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x200}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) 2.173803613s ago: executing program 4 (id=92): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) 2.173384863s ago: executing program 4 (id=93): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='oom_score_adj\x00') preadv(r3, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x300, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000001c0)=0x300401, 0x4) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="bd0c00cd3f792b96332a29cb9d0bbd54f713274942b16cb6e16661f9d993d0cb601892199499c363b83abc94bea8ea0fb93ef76a22748d2d08c7967efbd55f7fef8f27fa20b52842d7b70faf9102704246f8ede74ba41ae2ea8832e5bdcdfcb38232742efa6b94f2e43c32cb48ab45a17f283d4fe82cb3250c0c36461e6fbbf9265464b98e2f604c35eaddfb9576af02eadedfb7b812543cf2d0", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r4}, 0x10) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0xb000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x800084}, 0xfffffffffffffea9}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0xd) ioctl$TUNSETOFFLOAD(r6, 0x40047451, 0x2000000c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1001}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0x8, &(0x7f0000000b80)=ANY=[@ANYRES32=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='kmem_cache_free\x00', r9}, 0x10) socket$inet(0x2, 0x1, 0x0) 2.127211265s ago: executing program 2 (id=94): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f00000013c0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001840)={0x24, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002b00)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x0, @mcast1}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000680)='!', &(0x7f0000000780), 0x6, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_usb_control_io(r0, &(0x7f0000001300)={0x2c, 0x0, &(0x7f0000001200)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, &(0x7f0000001280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x0, 0x0, 0x0, "b7052183", "35cfaf65"}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0003"], 0x0, 0x0}, 0x0) 1.79689055s ago: executing program 1 (id=95): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x54, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 1.738141083s ago: executing program 3 (id=96): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xdc, 0x3f, 0x6e, 0x40, 0x813, 0x1, 0x3a08, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9d, 0x26, 0x9b}}]}}]}}, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES64], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r2, 0x4802, 0x0) r3 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c00000008000905810300020000000904010000020d00000904010102020d0000090582020002000000090503"], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000d00)={0x84, &(0x7f0000000900), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000b40)=ANY=[@ANYBLOB="6b75dfe6c1e5d52753afb5eaee1815a12b0bf5ef3c5908af022796bd4d22a77f8685829c3fdd16611d60ef6c9939b6003a390a71df352c42816abeb0670d1a3d58f9a5c3c3b9a95aad6b14112880a6ac0bdeb1144d2475f8d275c0cee65f9d18f9e3a3f0b576c95166e465339f640b6a0172f32db9e7b380889a2e0e9997ba15f8810db25a6de717715f81856b36a0b6d4a8b195094f733698422c9c23e58bf42832f3938bb600b7f12d16f8e379054f9704c91a2909fcb1b6e6ba19213d359c77f77ad33b8c77dc3fe6a483e1ec503a23230be0e504a80f1b7463762e66c758f96c113fc5416ed2cae0b084df2751c4f3c43dcacc8f11bdab775670668b85a265b25866ab17a779d3955cfe5f17a54457b52a767082ebfb946b1ba7dab44821debdf8938f0758a89a55e4bd2e6c8ef5322a84b138e71ee4f8ea3739a7f1a5eaf78c29f6f23505cfdf35c26d17f58e18a8be68e8b869321b0f51fa3f490485853f59da15905f34f781f510f7e2366fa4a2c9b71051e09f6ce1fb52b33c5e24bd257142041ae85f8f6fdf09d105ff6e7cbbd400ad82284bd794bcd3d0f180db445bdfcdb8c184936dc8a05073e6b48a7a4b309b8ec2b19fa895c220654730a49ec94bc7547751466de1320201b9293868a155c6b8e588a2554f123877192825bb7f88b8b3e1b27bfdcf769c6aba3da3cde0f013497c131f6d565d076d5e24d0d446ed34b810914876b1166890e15c0e511da0ae0d3b8cc763d79949754c59847321f7f79a163ad5a6efdd8be8d1e60d8864741725612f2276771c9aa5b71e19750b595cb91133d29e2f953827dd381340c1180894987e084abbc8836c3e942cf98e88a529ce8e9085cbc53be9575ea5b0903448166e980f361e17b35e198ab6f5292565f7ed6841bdccd067ecedf25e5ef630e32139472be0fa2d9070de1f3cc6766198c3672b82f943a8cdfb51972de7230df31bdc367d66e2886e37d284cc835eef2051048c03058dfaf5c0ca529ba610bd79813b2bd2ce0710419b99733f30eaae072026cca014b5d198a4aeb9defa63301ec10254e9133ffb13bf504632cc00d3849e007dcb109b6c56ebe6647467d910075dc10c43ff5c6c3089cd17f985489874e999b36906497c1c2a629c93a7972dd7dc9fbf49f01a5353ba4e993e07f576b3dc66d001ed5727a07acd08e30d394923294922f07e1585069eb262da78f2197eb4ab3ff8dce018c6e383e3d883aeb8fe16acb98924f1e76c159ea080836d89c7d81dc741aa8c03d4e1caa880e820add69ede0c4c3aa8040a0edd92dc55ea2027d5563f160a15bd9ba8666d37e585de49502c9947924b3ee81600d61c6c40fd22847b102dfe5bf280516d41286f4d15ff7131a4f8e400dfae311eef0fc01853c194699aba41ad11e2469b08effa04ea5c8a4972a434d089a289258afe3ad930e8e04595c2b1b38f6ef974dac07efc9c6147509f2560d2bcd29e1c8b023eb3a0657faf077925325f6ee9b305809adb0f5059723b09b91982f43553885712304fe0b98f1abd1867b6bd0ef8f1661ff708c030f0863d584b5f94ff9e9ddd2afa6d0233bb9298a2947e15e7fac1b3f818a027ba4173a2cf75298e123c0857fa7aa6531550815f78017dcf3dfcab28e5f885ae2907403eb8c627a98b00e41d8c417c67e8d1b0aa7ccfe02be747f0d39e6ef3b4bf545f89d2d29929d93c9266c56d2a0817debd1f125786273f75a686ada18913901d8a474b150f519adc23375295b20cedd97362c5b567cb9c247d4d06f1fb75fbdb947bb56f3e81c065d7ce655b9caec3b6cc6be7dd9e84f32152712147cd4bc516c2fca43a22c6417d405d1f6d1ced66d353a5b25bc87c9df0b73113fb2c22a1aa81d5813573fb085cf3366a49e22f77261250be8ab126a3ef3182bb434f11e30e782efc147a760e542abe67f27ca6c0adbc96d9c5a24a7b631205b63b02cbc340fe92f50fc407e3fff447fc908c8ac06eaa79ec4c9254f0afd0b0ee285283f2d59a717acc55371dd73ab21e5bac6115f9092d95e067a17794e3f157d564a5b00bc22fc002d67edd4a2169c5b8eca760ff4c3c69ea997dadbd1516157e6c40b4d168e110fac39cc6dff629f436686231585e34d44eeaf01c425c0c58ff6c51eaf926ad0ac9bf76a92e00d3382618d1cc3af29f91720ae6e82e9dbd5444a5eddb5dfe5eb625c5b585c93ebfb21e6952c7d643c15797ba743483a6b0ab346c8e1f0bcb37a59209f99a8c00784a66bcc08c3c65c2839217ba96104bed3a55a56d79e9ca4720472d3b4b2dee6b5cec2c2f5779d02ae28c8374eae815a8ba0354c3f75fd31c6995974067076650b857a1817acbba23c4557dadbbe87f8f220be1e6fcfc7764936e40c8a77906e3e13d080c130d92b2d8308a642f0f3d5aaa261bdc529b376179f474663f15720eecc5d7986143a464c33e18be799ffe1a8265dfa7e8d3a21cb19378abb9b5141090bbd182913630e1e38dc901987208db2279e59169719616fbfbf776f00060e84dd46754239ba3a27deaf4a7be9a019e412bdad8252cc4c4722a9be4227b94632a7f4dbccc987c10b63d4d052b2b50ec603c32fa6f511e8fd667e8545057bbf8465d415967926d91ed0d5ea61d18da066945dcb79c21b71a32c214d81f6edfb149d70369234655b225bfcc205c9e9f0fb22938f1461a7574640553c4f22b463416d7f0bb964a058678311234311e39794ce57a422bfca13b5938508609ae1ee9d8053b580d0e4c35ee4495e3b7d9fbc226304eec1a8c3c8fc753a798b85acda54c27cddc8a0e3210261b3ff0c9521a2849ee909bd85fd59a738846fbbd6de7fbaa0fefa015924d8f6843e8695a8a650338e33fc4582ba8abad39c4e6d8d3252637cedbfa8b729f2bf6629c6e0ad4f2b8beb27a1760e5ca64a55469d2f1df03c7562ed23bd872682eaf0ba749a13891a9e197c0028d347a8c0b79d914e521554523c89e6352cd86f2dec0570497ad6313f8b2af2c528e40775bac8408d41eeb132d8217a8f28ec0488d3ca8fc06bc2b33f6eec5dec721a40cd8ea7551ea9b5d512e1b7bffc88adbcd0c1e79874898dbf16982650fc66282aa19822bacc1329683e008a6067f91bf25ce71f2e696559c593e7e72b542d7566d7d1b7fe111a54457af5260a565ebb61e1c4ac79180cd0287a8a1eac43c5d2a9ba5be5ca6f730a3d280ea700b67938399eff13501e43cfc09078cf5ec9c8cf6e0fda90b90e2616d464041f052d1ebde81dc389df4f5162dd04d53ab2d96c2d418206bc8dc837ce3df7d964bdb5a044a8ea2bd12e272effa852d36d5bb0e7a8e19c128b761feb5482265b21a5138be165d19d47a7286edfd77bf085a07d4e8e382eed6374805f796b1e85f07d2c7f631be62505442a2d6bd2c3e075b3cd4b65333732920cb779b2056b243ab917643325b4926f0a17c3a87bd8d6016eb51e619b234f473c9df0390224faadccda233f46fb8772849c49b3900c9bcc0422736acf1e7e24a11557607e53142e796fb978a7b2d493cdc7fb0b5f781e744a7bfda601a246f0fbabcc602185e985c810e41e4a3cdb8f38ec531aaefb8fa2d9b0808ceddd23f773faf0326d50f42e502fbe9c2e525938dc369de2493778f2d0ade0d7aa5d483d0554ec3bb7af71a2f353bc8d3fa34605b922e9ea52ccd0e32243b309ebd16e8b8d05059eaa4941dd6eb4d5c0af75daa9112eb64b88105a576737de069c496deba5345ab1434469a03e57a7414dae48a45411cf8af5464627667b8925ad612cb224522a59e145a114333ae3ce4033f1b72c103094501ee724539c6f0d03dd4233ad5c2d280aa852cc468b8d8d9f7728bf90a76421789d4fed72f5be3aa4f1c3d7ffd68afae6682e065b3d1e87f392e90df51ce80a9fdd4f721aeb8a0a46266a29b2678dc02e313fde70d319ba76c399df7575298b76c9bc4a822e490ecfd25f964b4c15bb48af85e00ac2dc72d9c4ec4260e954c5d655382f827da51563f01a5749e69ae36d3e6d83592f6952c97f09c145123514a631be2de6b93666378b9910753c2d27125173d1a99b7bec98eae4cea9d0d4d63f2318a097277443d07a0693a747359abf9c2f5f8485e5b6145fc34d3b069737b6187f1c899a84e8c3545ad66c9beffd72debaf3ed16c0221fd9325ae95351c2bcb4a2fcc52ae3d56a62bf67c71774c2baab408c47df7dd4eea124f96c1c3c0493fb3e03499519c5ac7cdaad3ff010cf3ffe8dbd19f268ca10d9f707f22d425dced6edd1d3969251bf3634f5b57eceed65c407f8997f2ebfbee8956441861ff99904429e838f34a4ddb61ac66d65be3ba061778914a56d8ffa5754d422950fa5b7d47b8a128e3d9b9157f98d67b849c318ea83a18f4bf64cc84893d81f34e1fa5b8bb2b7ff56d56af5107ff56d017266aa9fc7863edad78093131ac1fcc856cc1292045d922a1869b9bcd268c9aa034227235168d045c3a2a629b2d2da35398ed2389ef00d756d90136c8cc89217325ed727bb72703617b49c195a1409567632ca53b1dd479010bc037e64cf6ffee20c1c0e8201a1aaeb834b450bd0868d530cd31502a7b415e61a1e5c9cca3dc6cd8f48fdab7c6af0d65763f5212ebf0f8b16158625f4389328163b4d8c2b6a2c7723936ffb111cc764e285b0ed5115f6031f0c4cf86b84f88c229d011c32c07eae1aa1fbc0991a110cc42c0675ab6dd18726c8e05eea7ec2e01281ce2f44aaad9fe61de5ead6b73116313e7a55ee9a5fb2e9a0686c9e9d19463c733272564fad05103b8b5a238b09014c3e8eefe56a968cf92066da49b487d99752e2a9561e1273af7ba8821f206eacf23ea60f33421e6fd9975f42d3e6855b37a2c070fcc9651896bd3fbbf82f76c8370f1d3dc1ead73be8909555a23ba6ac5f402529cf50368d88944e356b68b38cb996f84d0e9034c5112f24af193925febc0d41d8a317cc1802a8f274873d99cc0a79d199c7d0d4fe8397c81a2506ffd9a9abcecb8dcaaf0cfdf4c07a031af8c537ef6d98757ebbef33d8466cb03c009cdf453518a4688ac8bdca4cd9304b02dd7ad3b20a884f0c734215e00f0a2e23d6b93106a3b5ab8ea0c71546ad68dce79cf0ec78c62161ed0b6eccfbc7be6d5982c56763600b6d694d28bdb850f60dbbc8f52508a6b3ec5f96ae148e19eda2bfbddf0249555d5b18c23d6a97efeeff1207d3feb7c6dbfb1db83b73f73294ad5e0a3e4a283366eb9be188c42b00d21fdcd2237036a89031bb5f74126ff7bb5ef4d1cd477f029ad35d3dd678582b947d13274f725af72687a6f2a02aa8abc785711d4676695106a8a386fc44708d8f6f0cc8a4e5c024a2e8414afa4b37f2720c9b39ef7706aa3bdf0323d5bb534a8a6b2ea475b305d2d4e430d1c751a69db1a32bb4c8b6443d086460c80b326a581e6b2793d81451059f31cb979bc2dcf49d46212cebc7608c384f1c8bcc4fc15c69fb048b3aae523552b526a4b64d3b3ad60bf4fdc83e6894204de9109eceb81cd475d23c188644b4760160884965a613e5fe99ee6606414b67229a7a48a9d51723febf83d9e577e4b32ee24f9b1db9726eb1df2489921dfc71899b03c6116ecde9d5b38f38b89016cdb6ae7581e120b99deb56194565e29ce83d46cb8aff7c8372c45041105c27647d2160566e4d52a1d01c56aa8a221bb105390b467e48acb7cc3632634bfc75aca315088d1e4b87546404ca346b6556ccee1800e7f829f73021f8c4c238fca4d885031afbb47b00f58621178df4aaecd5330b61c97615870"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000580)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.737864693s ago: executing program 1 (id=97): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = inotify_init1(0x0) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000000400)={0x0, 0x0}) r3 = syz_open_procfs(r2, &(0x7f0000000280)='stack\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) pread64(r3, &(0x7f00000002c0)=""/269, 0x10d, 0x0) 1.276740103s ago: executing program 4 (id=98): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002480)=[{&(0x7f0000000580)="9718b79d4ba9879df6bad7f2abd39fa9bbfc612d11043204d1c852bd", 0x1c}], 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f00000000c0)=0xfffffffb, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @dev}, 0x10) splice(r0, 0x0, r2, 0x0, 0xe8, 0x0) 1.269336554s ago: executing program 4 (id=99): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xb, @dev={0xfe, 0x80, '\x00', 0x11}}, 0x1c, 0x0}}], 0x1, 0x80) recvmmsg(r3, &(0x7f0000000800), 0x62, 0x12141, 0x0) 1.217489075s ago: executing program 0 (id=101): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) mremap(&(0x7f0000cbc000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) 1.182371277s ago: executing program 0 (id=102): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsuid(r2) utimensat(r0, 0x0, 0x0, 0x0) 1.180833807s ago: executing program 0 (id=103): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) write(0xffffffffffffffff, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d", 0x12) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001a00011801000000000000001c"], 0x28}}, 0x0) 1.11830644s ago: executing program 0 (id=104): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)='/', 0x1}], 0x1}, 0x0) recvmmsg(r1, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) 1.060600593s ago: executing program 0 (id=105): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x30}, {0x16}]}, 0x10) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 909.429889ms ago: executing program 1 (id=106): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x74}, {0x6}]}, 0x10) 358.049124ms ago: executing program 4 (id=107): fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='stack\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) pread64(r0, &(0x7f00000002c0)=""/269, 0x10d, 0x0) 146.034013ms ago: executing program 0 (id=108): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f00000005c0)={0x0, 0x0, {0x0, 0x0, 0x0, {0x2}, {}, @ramp}, {0x0, 0x0, 0x0, {}, {}, @ramp}}) 0s ago: executing program 1 (id=109): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='oom_score_adj\x00') preadv(r3, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x300, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000001c0)=0x300401, 0x4) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="bd0c00cd3f792b96332a29cb9d0bbd54f713274942b16cb6e16661f9d993d0cb601892199499c363b83abc94bea8ea0fb93ef76a22748d2d08c7967efbd55f7fef8f27fa20b52842d7b70faf9102704246f8ede74ba41ae2ea8832e5bdcdfcb38232742efa6b94f2e43c32cb48ab45a17f283d4fe82cb3250c0c36461e6fbbf9265464b98e2f604c35eaddfb9576af02eadedfb7b812543cf2d0", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r4}, 0x10) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0xb000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x800084}, 0xfffffffffffffea9}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0xd) ioctl$TUNSETOFFLOAD(r6, 0x40047451, 0x2000000c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1001}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0x8, &(0x7f0000000b80)=ANY=[@ANYRES32=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='kmem_cache_free\x00', r9}, 0x10) socket$inet(0x2, 0x1, 0x0) kernel console output (not intermixed with test programs): [ 5.008525][ T161] udevd[161]: starting version 3.2.11 [ 5.045542][ T162] udevd[162]: starting eudev-3.2.11 [ 5.046521][ T161] udevd (161) used greatest stack depth: 23096 bytes left [ 6.084073][ T195] ip (195) used greatest stack depth: 22968 bytes left [ 14.608074][ T23] kauditd_printk_skb: 50 callbacks suppressed [ 14.608082][ T23] audit: type=1400 audit(1719691406.229:61): avc: denied { transition } for pid=287 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.612193][ T23] audit: type=1400 audit(1719691406.229:62): avc: denied { noatsecure } for pid=287 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.615062][ T23] audit: type=1400 audit(1719691406.229:63): avc: denied { write } for pid=287 comm="sh" path="pipe:[683]" dev="pipefs" ino=683 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.618048][ T23] audit: type=1400 audit(1719691406.229:64): avc: denied { rlimitinh } for pid=287 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.621182][ T23] audit: type=1400 audit(1719691406.229:65): avc: denied { siginh } for pid=287 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.121' (ED25519) to the list of known hosts. [ 20.865363][ T23] audit: type=1400 audit(1719691412.479:66): avc: denied { mounton } for pid=342 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.866886][ T342] cgroup1: Unknown subsys name 'net' [ 20.887784][ T23] audit: type=1400 audit(1719691412.479:67): avc: denied { mount } for pid=342 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.893125][ T342] cgroup1: Unknown subsys name 'net_prio' [ 20.921097][ T342] cgroup1: Unknown subsys name 'devices' [ 20.927314][ T23] audit: type=1400 audit(1719691412.539:68): avc: denied { unmount } for pid=342 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.092319][ T342] cgroup1: Unknown subsys name 'hugetlb' [ 21.097926][ T342] cgroup1: Unknown subsys name 'rlimit' [ 21.290791][ T23] audit: type=1400 audit(1719691412.909:69): avc: denied { setattr } for pid=342 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=240 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.313754][ T23] audit: type=1400 audit(1719691412.909:70): avc: denied { mounton } for pid=342 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.338391][ T23] audit: type=1400 audit(1719691412.909:71): avc: denied { mount } for pid=342 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.344020][ T343] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.370731][ T23] audit: type=1400 audit(1719691412.989:72): avc: denied { relabelto } for pid=343 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.395941][ T23] audit: type=1400 audit(1719691412.989:73): avc: denied { write } for pid=343 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 21.421717][ T23] audit: type=1400 audit(1719691413.039:74): avc: denied { read } for pid=144 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 21.446472][ T23] audit: type=1400 audit(1719691413.059:75): avc: denied { read } for pid=342 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.472821][ T342] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.782093][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.788941][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.796699][ T353] device bridge_slave_0 entered promiscuous mode [ 21.807196][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.814495][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.821737][ T353] device bridge_slave_1 entered promiscuous mode [ 21.860568][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.867402][ T350] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.874885][ T350] device bridge_slave_0 entered promiscuous mode [ 21.885487][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.892481][ T350] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.899871][ T350] device bridge_slave_1 entered promiscuous mode [ 21.965369][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.972338][ T355] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.979578][ T355] device bridge_slave_0 entered promiscuous mode [ 22.014973][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.021955][ T355] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.029233][ T355] device bridge_slave_1 entered promiscuous mode [ 22.059570][ T352] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.066598][ T352] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.073910][ T352] device bridge_slave_0 entered promiscuous mode [ 22.084035][ T352] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.090922][ T352] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.098060][ T352] device bridge_slave_1 entered promiscuous mode [ 22.126850][ T354] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.133847][ T354] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.141234][ T354] device bridge_slave_0 entered promiscuous mode [ 22.162790][ T354] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.169620][ T354] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.176928][ T354] device bridge_slave_1 entered promiscuous mode [ 22.204680][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.211523][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.218639][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.225416][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.289710][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.296541][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.303699][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.310526][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.387718][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.396251][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.403861][ T124] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.411135][ T124] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.418997][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.426371][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.453230][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.461720][ T121] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.468554][ T121] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.502545][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.510564][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.520217][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.528168][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.535052][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.553134][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.574723][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.582121][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.589448][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.597603][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.606029][ T121] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.612865][ T121] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.634253][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.641990][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.650100][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.656911][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.665184][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.673784][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.680631][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.687791][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.695864][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.702801][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.710127][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.717623][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.743165][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.751827][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.758659][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.765871][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.774243][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.781074][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.788205][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.796163][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.802987][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.810391][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.818106][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.826471][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.846399][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.854779][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.863477][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.871379][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.891647][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.900071][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.907929][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.915932][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.924132][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.933200][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.941476][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.949091][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.980985][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.989062][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.997154][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.005045][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.012984][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.020994][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.028710][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.037286][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.045592][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.053564][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.070034][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.078243][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.087682][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.095932][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.104120][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.112387][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.120670][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.128295][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.142027][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.150430][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.169767][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.177996][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.186850][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.195008][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.202865][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.210698][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.232070][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.240720][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.253932][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.263208][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.290781][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.298899][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.307295][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.330754][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.338830][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.360277][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.378648][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.386830][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.395308][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.403689][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.411981][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.420278][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.475138][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.485343][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.489563][ T380] incfs_lookup_dentry err:-14 [ 23.505996][ T380] incfs: Can't find or create .incomplete dir in ./file0 [ 23.518546][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.527909][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.536394][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.545169][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.553785][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.562869][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.572670][ T380] incfs: mount failed -14 [ 23.841426][ T413] ====================================================== [ 23.841426][ T413] WARNING: the mand mount option is being deprecated and [ 23.841426][ T413] will be removed in v5.15! [ 23.841426][ T413] ====================================================== [ 23.870507][ T413] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 23.877899][ T413] EXT4-fs (loop2): Unsupported blocksize for fs encryption [ 23.969760][ T356] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.439785][ T356] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.450782][ T356] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.460405][ T356] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 24.469208][ T356] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.479419][ T356] usb 2-1: config 0 descriptor?? [ 24.575039][ T430] incfs: Can't find or create .index dir in ./file0 [ 24.581957][ T430] incfs: mount failed -14 [ 24.783662][ T449] incfs_lookup_dentry err:-5 [ 24.788106][ T449] incfs: Can't find or create .index dir in ./file0 [ 24.794806][ T449] incfs: mount failed -5 [ 24.979816][ T5] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.051560][ T461] netlink: 84 bytes leftover after parsing attributes in process `syz.0.31'. [ 25.061124][ T461] tipc: Enabling of bearer rejected, failed to enable media [ 25.075155][ T462] incfs_lookup_dentry err:-5 [ 25.080052][ T462] incfs: Can't find or create .index dir in ./file0 [ 25.086959][ T462] incfs: mount failed -5 [ 25.219929][ T5] usb 4-1: Using ep0 maxpacket: 16 [ 25.619771][ T5] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 25.629317][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.637060][ T5] usb 4-1: Product: syz [ 25.643374][ T356] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0001/input/input4 [ 25.658987][ T5] usb 4-1: Manufacturer: syz [ 25.663659][ T5] usb 4-1: SerialNumber: syz [ 25.669197][ T5] usb 4-1: config 0 descriptor?? [ 25.675490][ T356] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0001/input/input5 [ 25.689181][ T356] uclogic 0003:256C:006D.0001: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.1-1/input0 [ 25.844553][ T356] usb 2-1: USB disconnect, device number 2 [ 25.939827][ T5] r8152 4-1:0.0: Unknown version 0x0000 [ 26.141589][ T74] usb 4-1: USB disconnect, device number 2 [ 26.191503][ T482] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 26.199234][ T482] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 26.210458][ T482] F2FS-fs (loop4): invalid crc value [ 26.216977][ T482] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.242536][ T482] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 26.249591][ T482] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 26.258000][ T23] kauditd_printk_skb: 66 callbacks suppressed [ 26.258008][ T23] audit: type=1400 audit(1719691417.869:142): avc: denied { mount } for pid=481 comm="syz.4.40" name="/" dev="loop4" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.285091][ T23] audit: type=1400 audit(1719691417.889:143): avc: denied { write } for pid=481 comm="syz.4.40" name="/" dev="loop4" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.306550][ T23] audit: type=1400 audit(1719691417.889:144): avc: denied { add_name } for pid=481 comm="syz.4.40" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.368136][ T490] incfs: Can't find or create .index dir in ./file0 [ 26.374711][ T490] incfs: mount failed -14 [ 26.786952][ T23] audit: type=1400 audit(1719691418.399:145): avc: denied { create } for pid=506 comm="syz.3.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.814221][ T23] audit: type=1400 audit(1719691418.429:146): avc: denied { ioctl } for pid=506 comm="syz.3.47" path="socket:[12534]" dev="sockfs" ino=12534 ioctlcmd=0x48cb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.814656][ T503] incfs_lookup_dentry err:-5 [ 26.843351][ T503] incfs: Can't find or create .index dir in ./file0 [ 26.855363][ T503] incfs: mount failed -5 [ 26.881476][ T23] audit: type=1400 audit(1719691418.499:147): avc: denied { unmount } for pid=355 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.902660][ T179] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 26.912083][ T179] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 26.928488][ T23] audit: type=1400 audit(1719691418.539:148): avc: denied { create } for pid=511 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.121073][ T23] audit: type=1400 audit(1719691418.739:149): avc: denied { write } for pid=511 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.147847][ T516] syz.2.51 (516) used greatest stack depth: 22776 bytes left [ 27.162832][ T23] audit: type=1326 audit(1719691418.759:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=511 comm="syz.2.51" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff9c5a33b99 code=0x0 [ 27.829724][ T18] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 27.837466][ T23] audit: type=1400 audit(1719691419.449:151): avc: denied { create } for pid=530 comm="syz.2.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.970870][ T541] incfs_lookup_dentry err:-5 [ 27.976490][ T541] incfs: Can't find or create .index dir in ./file0 [ 27.983878][ T541] incfs: mount failed -5 [ 28.091591][ T552] request_module fs-cramfs succeeded, but still no fs? [ 28.225547][ T557] netlink: 16 bytes leftover after parsing attributes in process `syz.2.67'. [ 28.249883][ T18] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.619273][ T18] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.659725][ T18] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 28.691202][ T18] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.703526][ T18] usb 4-1: config 0 descriptor?? [ 28.950094][ T561] F2FS-fs (loop4): Invalid log sectorsize (2) [ 28.956018][ T561] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 28.972729][ T563] F2FS-fs (loop2): Invalid log sectorsize (2) [ 28.978894][ T563] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 28.983566][ T561] F2FS-fs (loop4): Found nat_bits in checkpoint [ 29.010006][ T563] F2FS-fs (loop2): Found nat_bits in checkpoint [ 29.028569][ T577] incfs_lookup_dentry err:-5 [ 29.034260][ T577] incfs: Can't find or create .index dir in ./file0 [ 29.041019][ T577] incfs: mount failed -5 [ 29.050390][ T561] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 29.056749][ T563] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 29.057488][ T561] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 29.064184][ T563] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 29.071567][ T74] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.097602][ T353] attempt to access beyond end of device [ 29.097602][ T353] loop2: rw=2049, want=45104, limit=40427 [ 29.109877][ T355] attempt to access beyond end of device [ 29.109877][ T355] loop4: rw=2049, want=45104, limit=40427 [ 29.499727][ T74] usb 2-1: Using ep0 maxpacket: 32 [ 29.640079][ T74] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 29.649268][ T74] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 29.660266][ T74] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 29.671601][ T74] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 29.684944][ T74] usb 2-1: config 0 interface 0 has no altsetting 0 [ 29.993734][ T18] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0002/input/input6 [ 30.007790][ T18] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0002/input/input7 [ 30.026861][ T18] uclogic 0003:256C:006D.0002: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.3-1/input0 [ 30.038667][ T74] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 30.048894][ T74] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 30.057538][ T74] usb 2-1: Product: syz [ 30.063450][ T74] usb 2-1: Manufacturer: syz [ 30.067887][ T74] usb 2-1: SerialNumber: syz [ 30.091111][ T74] usb 2-1: config 0 descriptor?? [ 30.193174][ T74] usb 4-1: USB disconnect, device number 3 [ 30.342037][ T566] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 30.358476][ T18] usb 2-1: USB disconnect, device number 3 [ 30.369813][ T356] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.896588][ T356] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 33, using maximum allowed: 30 [ 30.907560][ T356] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.918980][ T356] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.929138][ T356] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 30.941890][ T356] usb 1-1: New USB device found, idVendor=28bd, idProduct=1903, bcdDevice= 0.00 [ 31.005621][ T356] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.087089][ T356] usb 1-1: config 0 descriptor?? [ 31.288587][ T23] kauditd_printk_skb: 16 callbacks suppressed [ 31.288596][ T23] audit: type=1400 audit(1719691422.899:168): avc: denied { read } for pid=627 comm="syz.2.88" name="kvm" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 31.290002][ T628] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.294707][ T23] audit: type=1400 audit(1719691422.899:169): avc: denied { open } for pid=627 comm="syz.2.88" path="/dev/kvm" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 31.355871][ T23] audit: type=1400 audit(1719691422.899:170): avc: denied { ioctl } for pid=627 comm="syz.2.88" path="/dev/kvm" dev="devtmpfs" ino=109 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 31.381733][ T629] kernel profiling enabled (shift: 3) [ 31.480132][ T632] raw_sendmsg: syz.4.89 forgot to set AF_INET. Fix it! [ 31.487339][ T23] audit: type=1400 audit(1719691423.099:171): avc: denied { read } for pid=631 comm="syz.4.89" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 31.551440][ T23] audit: type=1400 audit(1719691423.169:172): avc: denied { mount } for pid=635 comm="syz.4.92" name="/" dev="tmpfs" ino=13410 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.579200][ T23] audit: type=1400 audit(1719691423.189:173): avc: denied { unmount } for pid=355 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.605055][ T356] hid-generic 0003:28BD:1903.0003: ignoring exceeding usage max [ 31.624263][ T356] hid-generic 0003:28BD:1903.0003: ignoring exceeding usage max [ 31.637581][ T356] hid-generic 0003:28BD:1903.0003: hidraw0: USB HID v0.00 Device [HID 28bd:1903] on usb-dummy_hcd.0-1/input0 [ 31.953302][ T18] usb 1-1: USB disconnect, device number 2 [ 31.978553][ T23] audit: type=1400 audit(1719691423.589:174): avc: denied { mounton } for pid=648 comm="syz.1.97" path="/proc/648/task" dev="proc" ino=12943 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 32.007933][ T23] audit: type=1400 audit(1719691423.589:175): avc: denied { mount } for pid=648 comm="syz.1.97" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 32.036010][ T121] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.239688][ T356] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 32.399787][ T121] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.410714][ T121] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.420321][ T121] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 32.429155][ T121] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.438048][ T121] usb 3-1: config 0 descriptor?? [ 32.659814][ T356] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 32.668806][ T356] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.680535][ T356] usb 4-1: config 0 descriptor?? [ 32.921057][ T649] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 32.930552][ T649] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 33.640525][ T121] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0004/input/input8 [ 33.727892][ T121] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0004/input/input9 [ 33.746970][ T121] uclogic 0003:256C:006D.0004: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.2-1/input0 [ 33.749669][ C0] ================================================================== [ 33.767034][ C0] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 [ 33.773992][ C0] Read of size 8 at addr ffff8881e88cf520 by task udevd/470 [ 33.781080][ C0] [ 33.783258][ C0] CPU: 0 PID: 470 Comm: udevd Not tainted 5.4.276-syzkaller-00020-g4275fce9fe94 #0 [ 33.792367][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 33.802613][ C0] Call Trace: [ 33.805754][ C0] [ 33.808541][ C0] dump_stack+0x1d8/0x241 [ 33.812717][ C0] ? enqueue_task_fair+0xaac/0x1e40 [ 33.817746][ C0] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 33.823366][ C0] ? printk+0xd1/0x111 [ 33.827276][ C0] ? profile_pc+0xa4/0xe0 [ 33.832229][ C0] ? wake_up_klogd+0xb2/0xf0 [ 33.836699][ C0] ? profile_pc+0xa4/0xe0 [ 33.840819][ C0] print_address_description+0x8c/0x600 [ 33.846206][ C0] ? panic+0x89d/0x89d [ 33.850108][ C0] ? profile_pc+0xa4/0xe0 [ 33.854276][ C0] __kasan_report+0xf3/0x120 [ 33.858717][ C0] ? profile_pc+0xa4/0xe0 [ 33.862992][ C0] ? _raw_spin_lock+0xc0/0x1b0 [ 33.867710][ C0] kasan_report+0x30/0x60 [ 33.871866][ C0] profile_pc+0xa4/0xe0 [ 33.875969][ C0] profile_tick+0xb9/0x100 [ 33.880251][ C0] tick_sched_timer+0x237/0x3c0 [ 33.885021][ C0] ? tick_setup_sched_timer+0x460/0x460 [ 33.891274][ C0] __hrtimer_run_queues+0x3e9/0xb90 [ 33.896701][ C0] ? hrtimer_interrupt+0x890/0x890 [ 33.901742][ C0] ? sched_clock+0x36/0x40 [ 33.905971][ C0] ? sched_clock_cpu+0x18/0x3a0 [ 33.910660][ C0] ? ktime_get+0xf9/0x130 [ 33.914812][ C0] ? ktime_get_update_offsets_now+0x26c/0x280 [ 33.920719][ C0] hrtimer_interrupt+0x38a/0x890 [ 33.925524][ C0] smp_apic_timer_interrupt+0x110/0x460 [ 33.931406][ C0] apic_timer_interrupt+0xf/0x20 [ 33.936161][ C0] [ 33.938948][ C0] RIP: 0010:_raw_spin_lock+0xc0/0x1b0 [ 33.944156][ C0] Code: fd 4c 89 ff be 04 00 00 00 e8 2c dc 42 fd 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 f0 41 0f b1 4d 00 <75> 33 48 c7 04 24 0e 36 e0 45 49 c7 04 1c 00 00 00 00 65 48 8b 04 [ 33.964136][ C0] RSP: 0018:ffff8881e88cf520 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 33.972401][ C0] RAX: 0000000000000000 RBX: 1ffff1103d119ea4 RCX: 0000000000000001 [ 33.980397][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8881e88cf540 [ 33.988192][ C0] RBP: ffff8881e88cf5a8 R08: dffffc0000000000 R09: 0000000000000003 [ 33.996090][ C0] R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000 [ 34.003997][ C0] R13: ffff8881edcf98d8 R14: 1ffff1103d119ea8 R15: ffff8881e88cf540 [ 34.012033][ C0] ? _raw_spin_trylock_bh+0x190/0x190 [ 34.017230][ C0] __d_lookup+0xe5/0x540 [ 34.021310][ C0] lookup_fast+0x119/0xa40 [ 34.025569][ C0] ? handle_dots+0xf10/0xf10 [ 34.029989][ C0] ? dput+0x50/0x80 [ 34.033632][ C0] walk_component+0x138/0x590 [ 34.038768][ C0] ? path_put_conditional+0x90/0x90 [ 34.043789][ C0] ? generic_permission+0x141/0x3e0 [ 34.048822][ C0] ? security_inode_permission+0xad/0xf0 [ 34.054288][ C0] link_path_walk+0x5c6/0x1040 [ 34.058891][ C0] ? handle_lookup_down+0x5b0/0x5b0 [ 34.063921][ C0] ? path_init+0x217/0xee0 [ 34.068176][ C0] path_openat+0x1a3/0x34b0 [ 34.073146][ C0] ? stack_trace_save+0x118/0x1c0 [ 34.077985][ C0] ? stack_trace_snprint+0x170/0x170 [ 34.083109][ C0] ? __kasan_kmalloc+0x1d9/0x210 [ 34.087976][ C0] ? do_filp_open+0x450/0x450 [ 34.093004][ C0] ? do_sys_open+0x357/0x810 [ 34.097526][ C0] ? do_syscall_64+0xca/0x1c0 [ 34.102115][ C0] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 34.108217][ C0] do_filp_open+0x20b/0x450 [ 34.112857][ C0] ? vfs_tmpfile+0x2c0/0x2c0 [ 34.117282][ C0] ? noop_direct_IO+0x10/0x10 [ 34.121807][ C0] ? _raw_spin_unlock+0x49/0x60 [ 34.126539][ C0] ? __alloc_fd+0x4c1/0x560 [ 34.130830][ C0] do_sys_open+0x39c/0x810 [ 34.135071][ C0] ? check_preemption_disabled+0x153/0x320 [ 34.140715][ C0] ? file_open_root+0x490/0x490 [ 34.145491][ C0] do_syscall_64+0xca/0x1c0 [ 34.149823][ C0] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 34.155549][ C0] RIP: 0033:0x7f0a3d4759a4 [ 34.159800][ C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 [ 34.179253][ C0] RSP: 002b:00007ffc25e3e210 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 34.187484][ C0] RAX: ffffffffffffffda RBX: 00007f0a3d34ab70 RCX: 00007f0a3d4759a4 [ 34.197505][ C0] RDX: 0000000000080002 RSI: 0000556fc0cde8c0 RDI: 00000000ffffff9c [ 34.205395][ C0] RBP: 0000556fc0cde8c0 R08: 0000000000000000 R09: 1524c7280776ac35 [ 34.213205][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080002 [ 34.221017][ C0] R13: 00007f0a3d836370 R14: 00007ffc25e3e290 R15: 00007ffc25e3ed17 [ 34.229004][ C0] [ 34.231167][ C0] The buggy address belongs to the page: [ 34.236740][ C0] page:ffffea0007a233c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 34.245688][ C0] flags: 0x8000000000000000() [ 34.250182][ C0] raw: 8000000000000000 0000000000000000 ffffea0007a233c8 0000000000000000 [ 34.258686][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 34.267334][ C0] page dumped because: kasan: bad access detected [ 34.273568][ C0] page_owner tracks the page as allocated [ 34.279118][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT) [ 34.290667][ C0] prep_new_page+0x18f/0x370 [ 34.295093][ C0] get_page_from_freelist+0x2d13/0x2d90 [ 34.300555][ C0] __alloc_pages_nodemask+0x393/0x840 [ 34.305781][ C0] dup_task_struct+0x85/0x600 [ 34.310281][ C0] copy_process+0x56d/0x3230 [ 34.314703][ C0] _do_fork+0x197/0x900 [ 34.318701][ C0] __x64_sys_clone+0x26b/0x2c0 [ 34.323291][ C0] do_syscall_64+0xca/0x1c0 [ 34.327650][ C0] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 34.333360][ C0] page last free stack trace: [ 34.338171][ C0] __free_pages_ok+0x847/0x950 [ 34.342752][ C0] __free_pages+0x91/0x140 [ 34.347004][ C0] __free_slab+0x221/0x2e0 [ 34.351258][ C0] unfreeze_partials+0x14e/0x180 [ 34.356040][ C0] put_cpu_partial+0x44/0x180 [ 34.360731][ C0] __slab_free+0x297/0x360 [ 34.365073][ C0] qlist_free_all+0x43/0xb0 [ 34.369410][ C0] quarantine_reduce+0x1d9/0x210 [ 34.374189][ C0] __kasan_kmalloc+0x41/0x210 [ 34.380367][ C0] kmem_cache_alloc+0xd9/0x250 [ 34.385045][ C0] __kernfs_new_node+0xdb/0x6e0 [ 34.389926][ C0] kernfs_new_node+0x130/0x230 [ 34.395044][ C0] kernfs_create_link+0x9e/0x1f0 [ 34.400110][ C0] sysfs_do_create_link_sd+0x85/0x100 [ 34.405350][ C0] device_add_class_symlinks+0x211/0x2a0 [ 34.411215][ C0] device_add+0x4d3/0xbb0 [ 34.415454][ C0] [ 34.418079][ C0] addr ffff8881e88cf520 is located in stack of task udevd/470 at offset 0 in frame: [ 34.427273][ C0] _raw_spin_lock+0x0/0x1b0 [ 34.431949][ C0] [ 34.434117][ C0] this frame has 1 object: [ 34.438371][ C0] [32, 36) 'val.i.i.i' [ 34.438373][ C0] [ 34.444629][ C0] Memory state around the buggy address: [ 34.450176][ C0] ffff8881e88cf400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.458607][ C0] ffff8881e88cf480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.466586][ C0] >ffff8881e88cf500: 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 [ 34.475121][ C0] ^ [ 34.480092][ C0] ffff8881e88cf580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.488831][ C0] ffff8881e88cf600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.496781][ C0] ================================================================== [ 34.504766][ C0] Disabling lock debugging due to kernel taint [ 34.615656][ T451] usb 3-1: USB disconnect, device number 2 [ 34.633767][ T23] audit: type=1400 audit(1719691426.249:176): avc: denied { read } for pid=684 comm="syz.0.108" name="uinput" dev="devtmpfs" ino=244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.677771][ T23] audit: type=1400 audit(1719691426.249:177): avc: denied { open } for pid=684 comm="syz.0.108" path="/dev/uinput" dev="devtmpfs" ino=244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.068993][ T356] usb 4-1: USB disconnect, device number 4