last executing test programs: 15.374450945s ago: executing program 4 (id=6972): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) r1 = open(&(0x7f0000000000)='./bus\x00', 0x60142, 0x0) r2 = open(&(0x7f00000004c0)='./file1\x00', 0x185102, 0x1) sendfile(r1, r2, 0x0, 0x1000000201005) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES16=r1], &(0x7f0000000100)='GPL\x00', 0x53, 0x0, 0x0, 0x41100, 0x6, '\x00', 0x0, 0x2, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4001000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000040)) setsockopt$ax25_int(r0, 0x101, 0x1, &(0x7f0000000000)=0x4, 0x4) 9.465267411s ago: executing program 4 (id=6982): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x42000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r1}) r3 = syz_io_uring_setup(0x53d6, &(0x7f0000000380)={0x0, 0x0, 0x10100, 0x3}, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80000000}, 0x50) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB='5'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x41, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x21, 0x1, {0x1}}) io_uring_enter(r3, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 9.206986678s ago: executing program 4 (id=6983): mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000180)='bfs\x00', 0x2208004, 0x0) (fail_nth: 28) 8.62359655s ago: executing program 4 (id=6986): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff81}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0x1c}]}}}]}, 0x3c}}, 0x20048010) openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) r5 = socket(0xa, 0x3, 0x87) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f000905", @ANYBLOB="21c4c5"], 0x0) sendto(r5, &(0x7f00000003c0)="e1118ce4769b", 0xfdef, 0x800, &(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7, @local, 0x5}, 0x80) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f0000000280)={0x0, 0x804}) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r6, 0x80044940, &(0x7f0000000280)=0x14) 7.574266416s ago: executing program 0 (id=6989): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) set_mempolicy(0x4, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x6, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000e00)=ANY=[@ANYBLOB="05000000010000000400000004"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000005000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) close_range(r2, r2, 0x2) set_mempolicy(0x1, &(0x7f0000000000)=0xf, 0x6) r4 = syz_open_dev$usbfs(0x0, 0x76, 0x101301) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000200), 0x3fa, 0x0) socket$inet6(0xa, 0x1, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = dup2(r6, r4) sendmsg$NFT_BATCH(r8, 0x0, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r9 = fanotify_init(0x200, 0x0) fanotify_mark(r9, 0x80, 0x8, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r10, 0x10f, 0x81, &(0x7f0000000080), 0x4a) r11 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', &(0x7f0000000240)={0x521040, 0x1a, 0x4}, 0x18) getdents64(r11, &(0x7f0000000340)=""/45, 0x2d) 7.176968566s ago: executing program 0 (id=6991): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000000000040de2842110000000000010903240001000000000904000001030000000921000000012205000905810300000000001f"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="000606000000060407000000"], &(0x7f0000000340)=ANY=[@ANYRES64=r0], &(0x7f0000000200)=ANY=[@ANYBLOB="000f1dd1d65996083d5b7dc3000000050f1d000403100b0710020067020000100302"], &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x3, 0xc, 0x6, "709f3052", "e53663bd"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x4, 0x67, 0x3, 0x7f, 0xbc6, 0x20}}}, &(0x7f0000000780)={0x84, &(0x7f0000000bc0)=ANY=[@ANYBLOB="00315f000000de20e55f2e06000fc2cf0cb5e9a7dba4a84dd9465765b42a321e81c44f9965cc732418c340c631e361ad2d4a1deeb70094e85199c50f402c751aef5774138eb318f12164f555d5f13bb990eab7c48a5cdd53a927da4e8aec68f38aa8c34923c248173d2227862d087ca708000000b131b6aa6840714213905b967bf9fab296503b54903034c3f236d49923c9393c7c68e0892b85967f11f88cbce77bdd7dfaa640e7d78210f6d37b1ad4e9b7635f01c5f62e7cd17e8a66db1e5898b5366a5a9f4bb52d59b8e58299bb8f055b716319ac9e51b9b54ded8e2b6f2eaaadacc1a6996f4ccefd6da8478052c0343778f5090000004f40e854d20be603cb2de2f2c13c57fdc1e46c18d92bfba86d8808765bd495b6"], &(0x7f00000003c0)={0x0, 0xa, 0x1}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000000380)=ANY=[@ANYBLOB="20721b77f100040060000400"], &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0x5}, &(0x7f0000000540)={0x40, 0xb, 0x2, "32fc"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0x803}, &(0x7f00000005c0)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f0000000600)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000000640)={0x40, 0x19, 0x2, "a8bb"}, &(0x7f0000000680)={0x40, 0x1a, 0x2, 0x5}, &(0x7f00000006c0)={0x40, 0x1c, 0x1, 0x9b}, &(0x7f0000000700)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000740)={0x40, 0x21, 0x1, 0x5}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x0, &(0x7f0000000440)}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) gettid() (async, rerun: 32) timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000980)="8e82ef29f30dd49c8f8b1ba8ad1c08dcdc4f5dc37576284ac70a8184a1a21b9cf3ec277cea34ba1861876602321e8f929cdc63b867bf767b1a2edc2de6ccacf5", &(0x7f0000000ac0)="efb7ef09291953d8d130dad0cba034cbb5e1c40da7ae5672ac3d0533138a1ac81ebcb0de9975059d2f7a6d648f40dc68ce56f805f1035c76a105e4856f307de8c092cf42a6b4c40af759acdf4665d58c3ee0d8cf521887ef6d993413e9dab18e12567687e8cdb3e02853c6ff248cb8235843eff3f387b00b511d5e6a35b48da8e5aecebb835d1da854367a19d53ca900d5d43d737f1e561d3a001609f669f45ee085598df16ae6cbaeeffd08dfe4e5a148af471565b14e6ce778c79d0ee0866997d0bf6b696651d51c0e2c863ff3115c269d9ef929ad16fb3f421180f8ef185d"}}, &(0x7f0000bbdffc)) (async, rerun: 32) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = userfaultfd(0x801) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000400)=[{0x0, 0x0, 0x0}], 0x1, 0x0) (async, rerun: 64) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) (async, rerun: 64) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) (async) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r4 = syz_io_uring_setup(0x50d0, &(0x7f0000000000)={0x0, 0xfffffffd, 0x2, 0x2, 0x332}, &(0x7f0000000100), &(0x7f0000000900)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) (async) sched_setaffinity(0x0, 0xfffffffffffffc22, &(0x7f0000000180)=0x1400200bce) ppoll(&(0x7f0000000840)=[{r4}, {r4, 0x870b}, {r4, 0x8560}], 0x3, &(0x7f0000000880)={0x0, 0x3938700}, &(0x7f00000008c0)={[0x7ff]}, 0x8) (async) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async, rerun: 64) r6 = timerfd_create(0x6, 0x0) (rerun: 64) timerfd_gettime(r6, &(0x7f0000000a00)) (async) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async, rerun: 64) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r7, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0], &(0x7f0000000280), 0x1}) 5.672550762s ago: executing program 2 (id=6999): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r3 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) pwritev(r3, &(0x7f0000001700)=[{&(0x7f0000000700)="30e363082993671813af9490c162e0e8efac543e6ea512ec715c845e8afc9670f2cf22ab037f216f807c0989d5e138eaafad881bc85d2b7e25083435d5b03023568ba26a87ec72c8d93242933dd1cfbd804738e9943bc633995645c210ba6a2c79a763744a421a39dc5b372d9424735edf65ea7e1faf9a670edd4c312bb8c1337a9f11637f9362e4a329c7361710daa5d36c51920f8d55974cd8b8310eac5c25586fc6fc2dee5692f788aba8222c63aae80d5ee898cfebadf4149d202a1f38304c989d623a076ec59408ec2b25d6c8d96c68ef6ac8a020912c5cc607abe44bd3b344bef62a58c673ace67a8000e9f56ffeec24802bc3b87d1ea4fab7998b0f01dd841bbb7cec1faeaf54346236f510ce65886b9074cb5780a697b814d354ad3ce65886fa87465583c727dccb44528b679c1e65ea6e324372bf65ec0f5195b6a68435bfe8e5f4f8fd94395cc872a0326c95afdbe8a9029948a99d8ae92336232fbe29f15f55a956376f90b11706829d4d4f73367405298d28be5914a0e6ec641f31f7053b7cae7bf8a649feba317864d311671edbdc1cb0d725a19184ddab376e530e5160783776bd0e9038da8b5ddb19732466736a517b548b25f0bfdd1b82b33acddb26a607913f20dc5c516c7bcdda1ca24af0e74a220f1aa91d955b2b25afa93e3364823fd0dc148558277d261e5271f7754d2ca723293b30604263c4350dba72046feef0bde5e2e09af85eb3ca147623c095b20eb35981b3914cb4e6cb2e16a4e4c16100354a52456895a926e7c2c5859e9555d79b868960edceaec0d6d39fdb401a9c92742b635e742e1294e122b77a8da48ec5b5a7ffccaf40ed9a31624ff9b7057b101aadf73e2e4b4b031f13db136860046795c893f4ef3b149df38f1c711f3af426990ea5c8e3ea811fd714ccb913ce99a82da000db7ed36a629bbb5fb4d1a5c74ee5890a6834ce56ad68b7b58bf7e59b3f6a101354534995f58a54c1d798b1b5858b58b0c25385e4507a6219244cfbd5416fa01d6c0e880a2dae477a2e05ca844a2ec638e1df34a636d1f91cfbd043f1d7d71db5cdb766d4da4c76c138f3a23c833a1bb2e6d9836ec76f1d1b185b9c3fd99eb1f97f01c51796e317ac1485fa9c20d347626edeb7237cc03897060ead62829162a7184c137af4f99b06847cc9ed1b4a476c03e1edb7a330d4c0c35c6cde541092d05d150eba2196bea6d3350990ad7464fb332ee636fd6896eaba892bd0d391c144b05201a0f940056b620df0a759eb5df06fbf338e9f048fad825b8e6c3798587492d7347f38c55b498ca1f8c391a5c1da5ca3f0749dce316a3a9c7ba761968f269451570579dc27e1a7ea4c8ef276d9a1c56b59cb3243d9c8f84c9edb43ad49b2c4633971486fab5a1e60c9aa513916e91b2640006e01c0ae9809e1e634225367ca66bde0dda424076d5c497a6894e6aeeea742c4b0f4bf9b28ac5df4b8d7c641a2a5b69ef07aa9ebf73f01a4d019be8e56d16d40e57100b9f7046d44be30edf07f043ae2482c6a77ca6a91ed335fa6e8ff40ca3a99466b937bd1a87111458577cd4645b2edb1ea47c4334b5d9b3af2736b5674c184350ce16668e8174307f5188d80e3cc022c7e3acf7ceb2b061ee406ad45fc2788bb068a0af863c742e074bedd3d6ef46472a46bee9df820e163fbb7e8c1e9c9605a7dd5d7302fbe7839a58d899d908ba6ff1e2a2140188cc20e8ecd55e09d5b248cb83a4908efb424ba09ce90007ff6bfc1604be73340c47451521295aee559485d3b646dedf971d7f139f167ef91a29b296074803ed130ccbe2cbc9b99bc6a48955aafff53f888e479a83a01373c384e04b59734da61e27f10888994278a06195293cd37f215421470362b9cdedb9bef2cec2ebfc189b8728469cfd0b4aa70b4414865470e5c68c45014739f6615a4861008a4871e0d2bab2cf86b5050b40c210acc03a2607324fb4c337175306e0ba59ce22067610409eb8b6963f744a4608d3bc385497cdf6dbd69c5fd53c1c0f02124c28a07d3e67f11894c789fcbf51224383268c85b7b4d30743359ccf77b0b601f01500be1c0dd32dd35d9bc70d48ef33dead9b44d10eb1e84533e205680979b2af81b4839af489f81aa798dc48f1ffb4e6fe2a7759f785dcdc5e5e9ca2d1e1fa4a7c70666b08a1798cb969458642f71cd939b11fbe632c65ce5c10df39e36476f76019a4ce1eafebe1a6da55b036e7b28cdade4d2b5a590c9c34cedce99d376c4acb22d019d667c2a5a5152dcde4a9cafda8438a1a8bedac6ec33368e948814d848b6c29088c5fdaaff031ae12ac59846ab3150e412c503726d9a1107eea587caf6c343a305433eb9da8943e371537ca556d925d5a5c339d97ce9673127ec8cf7b28eefdb6912cc6351c53d1dfb59378cb73e5baf44f7c4970019bee47de2c30f7ff69b13b8168722e89faf41b800406d0168b9f4f904e528f6c35a9f3cd6bb7278b9569f791709028a00841c7e0952a1b40313ab01f129143f88b6fcb9f391a0ba5d7f9f9681dc5984aea6d3948e799d7a7ef8362428c4bd26553425e30a2f8ff7b5db2988a94055293aa2ab4ec3c3ffa9c009890005a5088cab6e2551c230dc73b5e025962af6e3db58fbd227e230b229199f26737458b61cc141e37f7a73fc245bc309d1747c078288cdf2f8dd1d6e884709ba196d3fa6e4003b571a79ca4ededf0bb2c791d68bfb02c29b0d07f71b982eb658e619b474e577671f7e607f69d3159aaf8e1847a2a94d9e12a1db2dd55df99c4c432e63e1d6f02b53c281693f303e5c69dbf024bc03516973f19fed901222570f38b363ba945dd01d4c5d9c228e68c9bdfde48f4f8cee07fe00c9117ff7c136350c3780cfffddc1450d9f2d152bbcd7f92a137a758cdf53ac0fde2cc40882b9fbecc6f610b251a521def4ad7aee865fb9135706f996e2c508b4d7471968ac03ec15a62d93934a912342eaedbb1bf2fab9d2a08750821a70fd444d119fbf1a2b809df4f7bcc8c42329f14786d77a2f8050b18a0d244cb019a513f04707983556a93b98d062c9907b6b283f4d94702293eba4182b5a138a5b3ec696a197fcc2b2c157585b99d8e8d05b6f84cca4cdc62f53be63440ec6375446691a105aed0cb7436d69df34d6dfdb339bb6b3768c1f8a251141d863e4f1d256185bc7157081236e2fde62915715585818786ae45456c65d52766d3d44d8404171c803f2fcb33e6e8136be0c38f41f2fea8cc1c40de79ca048d99ad1943dfbbc9f442ce453876b1bf1efaa7b8f4bc4d18fd2edacbba495711274e9deaf62925e221f61aee3a77a59bdf97ffdbcf08202de6f49bfd3bf4b7d031fa8b79418670f2c958ba2bf2e9dfbaafbb4c7d9391729f0d6edccfd3fbac1027a4d7c6a6f98b7b86ae400557265a4797547337980d6fdb0427f3ebd735fde527cedfa9c6b3cca2feb3ff7547aab94f14a21b80581afad01f672154ddde848eb4d3b36f2d4bbf83e9f37f5be6deca2c8171960d0071bd3c0dc1734b5b01589b7ea7162bca3d2d310b9243bbe96d9a39250e7bd631f49eccfe2aaa5f57c33ea0006695d9419b1665f109302120aaeac7707eb52b5acf7bfa2f032d7089763cd87c9d96859d606c10b18621ebdaa33e0ceacba71c2bf90be3e09845d23aff1460c15abadcdf8beb6717d6300ce13b3ce25752f7e3c7f80debbbe41ef17ac65773d4d480cebc4ef82ccf0ee41810af458b484eea895555d74af59aab75e9628c80f257041a62ce526071c9af64eb63aa788f88a00cd109076ab65e5d286b52b79fc7f6ede163f888ad4f75be8eac05f75857f1081442d8e7eb41ca75ae94f337d35789ba3d2757ff4fb1396312f785d863de20a04fb15fdac3fc476b2253ebd9e2cd53b6611eaad2ec307e4af6a0c5a5121884c3af2380ffb135d4d955e52817ebcbeaafb48bf5e0f827179a668a73d8a425b9f4146647520eb2cb561c8415d6d0fbb16b18909f260dab24b1fe3bfdad03666fdb048340aa277be8eee3d48d04422a70f9f629416a81a061ef5df461e21246ea702c22550d72edb61b7569470064493b373567cc0f1a7bfb13ea3561be6aefc5980000bf3da0e8db4fc281eaa3d314f5682e59112fcb9dc3efd3fc9b219b7b9a0ff8d6bfe75f8f5c8559ae4284c1b72d63962606eb3950d14c87a010ee9727c7c2bcf984267fa1db72fa7363e63942d37a499ab3dbb133fbe6789874bdd78ea3f74dce99f6fcae9df9370ea3a60008a5f757393ccb51624c5cc258be336137409b5e6e7e75d704346a123caebaccd0f82e9a62e023ee75254a20f09e672c8dd76af7df86d5f05f486c68350f029d87e929115015cb3bf222273cfb5e32584291ce6b9a5ddb33df1e601d0f84892bba7c8b9541a081a5b9cfa4c8516ec62950a6573bfab81e68bc4ac137112311f278ecc3b1c738cb0e7c2de73c10541e80d2fe568204e3c63e1d996bad50723a2af8864b25707cdfef271ab72a75cff79e9ecc01842764f50053d3962ad3110be2e63676df84b216ff25cf697694db24ec14bf012b8e23f2a71d7fd2c74df784c36bb8868efbe1a0e58e85f39399c8ef3e782d6cdf9f720ec15bef71dfdb24f5a03e92be6a1c10fa78c65df2e4aaa91c2588a8b2c85030a781bfbf74c815005dfb682531ff46f71bb55cc2c3162833f702cdd90c71735adb65a8ead3ef142871beb63804925fcec69739c26b63fe1d62d0ce3828da613ad9c7835d448b28d5310fbc08f2dd067d3a1bb21a1510d2a4a6a1a07e2bbf163151b78a831599e0694a8213f06ad331dbb0457046a14baaf9d747bc6d0139f919377dd9c24a7b51f7350a324e16f7212ae16152df97979afd75a08ac39ace761a945bd8060e9bb77a02221f98c23ad581f6a56243218a8cb52352dd5662a934923504a53134d2bda53f7e175be478f79d3e7e92315a1838fc627498f3c8873e398289c0de58858e4d9c0423e05bc5e0bf3d9c854bb37e6afcb0713a3e9b8529f36089d55bb7a1373f7ad342fc3ed8df4b6a08630c3714d903a785b33ad22b736d76bd90dfcd468a1e6d39e64812a7254f0c1f619f537c53c2000052bd85c33c46cb752523096a17941d6b86b58f52073c9c4c03d02f9d395c4678504757614b8c443e502c3c41bf9d7177a9df088e9f3a2fc6ecd4a406285795d8598ef83a5a17dc0f9decbee65abd976f20d58e614fc45539aff10f45c9845f779c00a9a144fc6ec07fc2eca72c2419201d1668dc7ef7c04e1b8cde5ffa7da362d866d4bcf2e3eaa2e0237a42bdaeb79c3fa10839d1ffa0b1329c7d5536cc26126c7ddde95ccdcb5c17fddeaa8a73275afad42938f40e28b9a48808de4585dc3ad02564732ae5cf91702b66868f76efa6b7b11e204730f286493ec24c8c5c1b9f825427cd0cd1f2877835d3851c6dc7033e39b9de1d145305438473571f794ce5674317b219341057fed36f3e9159623e93112791e436cf91c32817a41323c9a604398def92aece5bfb789834ad9747be9d8236ae686731a10113325475a6904f50a6407bd97aafd8b1c0b3c83e9a165c105e21580920af05c1f940bcf3cd8e559759afff9c298bd886f47c281b0a940b709eddb02e8f0810da94d3bf4bc2d5c9ae38c58f1dd0bf5ac13116beb944ffc753334a0698a3396af9917f254c84e663f930db0153197d7a837d07cf5c6bd6686083650f144e2f2e2bbf9579a80013b22e95a29f53985a00bfa313b05847a7fbd3926049f5218b31d4a1b5e34ba2c9bd0d2a5a42b27c35a7c78e118fe", 0x1000}], 0x1, 0x2, 0xffffffcd) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) read$FUSE(r5, &(0x7f0000009780)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r5, &(0x7f0000000180)={0x10, 0xfffffff5, 0x3}, 0x10) ppoll(&(0x7f0000000040)=[{r1, 0x2008}, {r4, 0x80}, {r4, 0x1023}, {r5, 0x210}, {r2, 0x2400}], 0x5, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000300)={[0x6]}, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000e00)={&(0x7f0000000980)='sys_exit\x00', r4}, 0x10) r6 = socket$kcm(0x21, 0x2, 0x2) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x2e, 0x0, &(0x7f0000000000)) sendmsg$kcm(r6, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0x8000) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, 0x0, 0xe821651e0a1b45fc) 5.413104603s ago: executing program 2 (id=7000): setitimer(0x1, 0x0, &(0x7f0000000300)) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) io_setup(0x2e, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f00000001c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000140)='^', 0x1}]) 5.285659911s ago: executing program 4 (id=7001): r0 = socket$pppoe(0x18, 0x1, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010007000009058dff86"], 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010007000009058dff86"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fcntl$setstatus(r1, 0x4, 0x42400) (async) fcntl$setstatus(r1, 0x4, 0x42400) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x11, 0x4}, 0x18) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r3, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xd}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff00}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xf}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xb985}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x86}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8}]}, 0x5c}}, 0x44) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r3, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xd}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff00}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xf}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xb985}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x86}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8}]}, 0x5c}}, 0x44) connect$pppoe(r0, &(0x7f0000000740)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, 'vlan0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000001340)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000500)="ab", 0x5ea}], 0x1}}], 0x484, 0x24048084) 5.186350369s ago: executing program 2 (id=7003): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x28, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x6, 0x5}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x4) sched_setscheduler(r0, 0x1, &(0x7f00000008c0)=0x7) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x10fff}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000080), 0x0, 0x40000161, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8000, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r4, 0xc0285629, 0x0) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x52001}, 0x18) statx(r5, &(0x7f0000000080)='./file0\x00', 0x8b31866daf883979, 0x2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETINFO(r3, 0xffffffff80000501, r6, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) r9 = syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0) get_robust_list(r7, &(0x7f00000004c0)=&(0x7f0000000480)={&(0x7f0000000200)={&(0x7f00000001c0)}, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)}}, &(0x7f0000000500)=0x18) r10 = syz_pidfd_open(r9, 0x0) setns(r10, 0x10000000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)=@newlink={0x28, 0x10, 0x4, 0x70bd2d, 0x0, {}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0x2}]}, 0x28}}, 0x800) r12 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xe7, 0xcc, 0x61, 0x20, 0x10c4, 0x818a, 0x7d8f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0xc0, 0x5, [{{0x9, 0x4, 0x23, 0x0, 0x0, 0x3}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r12, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)={0x0, 0x15, 0x3, "c39242"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.146662895s ago: executing program 1 (id=7006): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, 0x0, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d03, &(0x7f0000000240)) 4.146328727s ago: executing program 3 (id=7007): openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mbind(&(0x7f00009f4000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x6a0e, 0x4) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x1e, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mount$cgroup(0x0, 0x0, 0x0, 0x10012, &(0x7f00000005c0)) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) epoll_create1(0x0) socket(0x10, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x4842, 0x0) writev(r2, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000e00)='t', 0x2fd200}, {0x0, 0x2200}, {&(0x7f0000001000)="d6", 0x20c00}], 0x21) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$isdn(0x22, 0x3, 0x37) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x202, 0x5, 0xd, 0x3ff}, {0x7fff, 0x2, 0x3, 0x5}]}, 0x10) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 3.648778544s ago: executing program 0 (id=7008): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, &(0x7f0000000180)=@keyring={'key_or_keyring:', 0x0, 0x2}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x47, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendfile(r0, r0, &(0x7f0000000100)=0x2, 0x5) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x14, 0x2, 0x0, "11010000001400000100b64c0000000f4cb85200000400", 0x30314442}) socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) read$FUSE(r3, &(0x7f0000004380)={0x2020}, 0x2020) r4 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) r5 = eventfd2(0x43, 0x1) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000000)={0x3, r5}) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f00000005c0)={0x0, r5}) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000500)=' ,1\t#|^q', 0x8}], 0x1) syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x203, 0x0, 0xfffffecc, 0x9, 0x33, 0x44, 0x1d, 0xe4}) r6 = socket$kcm(0xa, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES8, @ANYRESDEC=r5], 0x0) sendmsg$sock(r6, &(0x7f0000000000)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x1, @local, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000640)}, 0x4800) 3.594546933s ago: executing program 1 (id=7009): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x42000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r1}) r3 = syz_io_uring_setup(0x53d6, &(0x7f0000000380)={0x0, 0x0, 0x10100, 0x3}, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000040)=ANY=[@ANYBLOB='5'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x41, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x21, 0x1, {0x1}}) io_uring_enter(r3, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 3.406758s ago: executing program 3 (id=7010): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0), 0x0, 0x4, &(0x7f0000000140)={0x11, 0x8100, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = userfaultfd(0x80801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x54d}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f00003cd000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c9a000/0x2000)=nil) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000002c0)={'wg2\x00'}) r8 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r8, 0x1) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x89901) move_mount(r9, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x206) 3.347549476s ago: executing program 1 (id=7011): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x80000000000000a, 0x2, 0x0) (async) socket$inet6(0xa, 0x1, 0x82) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, 0x0, 0x0) (async) openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x121000, 0x0) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x2c, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000040)=0x10) (async) r7 = socket$netlink(0x10, 0x3, 0x0) (async) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32, @ANYRES32=r5], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) (async) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) (async) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0x4, 0x400103) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r8 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYRES8=r3, @ANYRES32, @ANYRES32=r1, @ANYRES8=r5], 0x2c}}, 0x800) recvmmsg(r8, &(0x7f0000007700), 0x0, 0x10f82, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x736800, 0x0) 2.386194265s ago: executing program 4 (id=7012): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xa4, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_SETUP={0x24, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}]}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x4}, @NL80211_ATTR_MESH_SETUP={0x28, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5}, @NL80211_MESH_SETUP_AUTH_PROTOCOL={0x5, 0x8, 0x7}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}]}, @NL80211_ATTR_MESH_ID={0xa}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8090}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x3, 0x1, 0x101, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x4, 0x2, 0x292}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x8400ae8e, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r10 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$COMEDI_CMD(r10, 0x80506409, &(0x7f0000000100)={0x1, 0x20, 0x2, 0x6dd, 0x4, 0x1ff, 0x10, 0xffff, 0x20, 0x201, 0x20, 0x7, &(0x7f00000000c0)=[0x4], 0x1, 0x0}) r11 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r13, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0xa}}]}, 0x40}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r9, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) 2.21803062s ago: executing program 3 (id=7013): socket$nl_xfrm(0x10, 0x3, 0x6) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 32) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f00000005c0)=@generic={&(0x7f0000000080)='./mnt\x00', 0x0, 0x18}, 0x18) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x7}, 0x0) (async) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) (async) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) recvmmsg(0xffffffffffffffff, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40010000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) (async, rerun: 64) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) (rerun: 64) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000140)) (async, rerun: 32) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x48) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x25, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x62, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x3, 0x9, 0x80000001, 0xfffffff8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x10, 0x7ff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000080)=ANY=[], 0x0, 0xc, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) (async, rerun: 32) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (rerun: 32) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) (rerun: 32) 2.019978886s ago: executing program 0 (id=7014): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="666c6f636b3d6c6f63616c2c666c6f636b3d6c6f63616c2c666c6f636b3d6f70656e6166732c666c6f636b3d77726974652c666c6f636b3d7374726963742c64796e2c64796e2c666c6f636b3d6c6f63616c2c00863a4c8eb67a8afa191b1df65da176"]) openat2$dir(0xffffffffffffff9c, &(0x7f0000000840)='./file0\x00', &(0x7f0000000700), 0x18) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x7fff, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x2) ioctl$TCFLSH(r5, 0x40087101, 0x80000020011100) syz_io_uring_submit(r3, r4, &(0x7f0000000100)=@IORING_OP_MSG_RING={0x28, 0x44, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x625, 0x4c1, 0xc1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r7, 0x4068aea3, &(0x7f00000002c0)={0xc0, 0x0, 0x4000}) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) ioctl$KVM_RESET_DIRTY_RINGS(r7, 0xaec7) 1.829731425s ago: executing program 2 (id=7015): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000580)=@newqdisc={0x58, 0x24, 0xf0b, 0x70bd27, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x15, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1, 0xfbc, 0x0, 0x7fffffff, 0x7, 0x0, 0x7fb182ef, 0xe0f}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x48884}, 0x4090) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) openat$dsp(0xffffff9c, &(0x7f00000003c0), 0x84000, 0x0) r4 = socket(0xa, 0x5, 0x100003a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r7, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[], 0xc48}, 0x0, 0xe3d08660d3cd4684}) io_uring_enter(0xffffffffffffffff, 0x92, 0x21, 0x74, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x0) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="5800373a9410050000000000000000000000000005010100070000000900020073797a31000000000c0007800800124000000000120003006269746d61703a69702c6d616300000005000a00000005000400010000000000792e97f5e6adacfa72309dbe133ca81bccba36994c2db35a38f622389218a0d7d7387608b850d262d800b8fa29f033b62c53aabb0a2bbb76f0f63734aa737d32fd651449c419dc4e66653b683a5a8b4ef0e65b0e6ead6dc0c853f7f79cc9dc8d6b78f0158cca58e56286ce2d4789190dd718ad9519fa7f64e8c2e2223964b4569cd3a87622c3c758c3cff6ce186e32005089ee72075d37d6ff82edb9360eb87d0400000000000000dc94"], 0x58}, 0x1, 0x0, 0x0, 0x4004000}, 0x14) ioctl$SIOCPNDELRESOURCE(r4, 0x89ef, &(0x7f0000000140)=0xcb6) 1.426543457s ago: executing program 1 (id=7016): r0 = syz_open_dev$sndctrl(&(0x7f0000000200), 0xdac, 0x1) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000240)={0x6}) 1.099427391s ago: executing program 1 (id=7017): r0 = io_uring_setup(0x5972, &(0x7f00000001c0)={0x0, 0x7f4d, 0x2000, 0x0, 0x168}) r1 = syz_io_uring_setup(0x743d, &(0x7f0000000480)={0x0, 0xbe09, 0x800, 0x0, 0x31e, 0x0, r0}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0xb, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x4, 0xfcc0, 0x41, 0x0, 0x0) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) 1.096560008s ago: executing program 3 (id=7018): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r1, &(0x7f0000000040)={0x27, 0x0, 0x100000, 0x1, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e961711a03760760beeab91e8ff0055e5c0d48bd63ffdb93bd43a847a1597c8ef03da5be42200", 0x1d}, 0x60) (async) listen(r1, 0x0) (async) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) (async) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) ptrace$getregset(0x4204, r0, 0x1, &(0x7f00000001c0)={&(0x7f0000000340)=""/124, 0x7c}) 939.966735ms ago: executing program 0 (id=7019): syz_open_dev$radio(&(0x7f0000000340), 0x1, 0x2) (async) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') (async) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) (async) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = inotify_init1(0x80000) ioctl$TUNSETPERSIST(r5, 0x400454cb, 0x0) (async) syz_open_procfs$userns(r2, &(0x7f0000000000)) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) (async) r6 = syz_io_uring_setup(0x95, &(0x7f0000000140)={0x0, 0x201, 0x0, 0x0, 0x3}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f00000004c0)={0x20102, 0x0, 0x28}, &(0x7f0000000500)='./file0\x00', 0x18}) (async) syz_emit_ethernet(0x96, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60f81fcb00603a00fc000000000000000000000000000000ff0200000000000000000000000000010400907800000000604aa1d300000000fc01000000000000000000000000000000000000000000000000ffff7f0000013c00000000000000000204010000000000000000000000000000ffffac1414bb2f000400000000000000020000000000"], 0x0) (async) io_uring_enter(r6, 0x4536, 0x6aaf, 0x0, 0x0, 0x0) 854.576877ms ago: executing program 3 (id=7020): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0x9, 0x109301) (async) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000140)=ANY=[]) 668.198408ms ago: executing program 2 (id=7021): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x42000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r1}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='5'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x41, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x21, 0x1, {0x1}}) io_uring_enter(0xffffffffffffffff, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 624.418881ms ago: executing program 3 (id=7022): syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f010000000000000000000624beb400000c241b4800f3ff00050080050905810300020000000904"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001780)=@delchain={0xc84, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x85c, 0x2, [@TCA_U32_POLICE={0x858, 0x6, [@TCA_POLICE_RESULT={0x8, 0x5, 0xc}, @TCA_POLICE_RATE={0x404, 0x2, [0xffffffff, 0x8e3, 0x42, 0x1000, 0x5, 0x5, 0x9, 0x19, 0x81, 0x3ff, 0xcf, 0xbdbd, 0x5, 0xba884ff, 0x9, 0x0, 0x6, 0x9, 0x10, 0x7f, 0xffffffc0, 0x8, 0x70, 0x10000, 0x2, 0x0, 0x8, 0x80000000, 0x2, 0x7, 0x6, 0x100, 0x7, 0x1, 0x5, 0xc0000000, 0x401, 0xfffff23e, 0x9, 0x9, 0x2, 0x400, 0x100, 0x10001, 0x10, 0x8, 0x7, 0x6, 0xb4, 0x2, 0x3, 0x0, 0x2f95, 0x1, 0x6, 0xd, 0x0, 0x1, 0x3, 0x6, 0x9, 0x4, 0x5, 0xc, 0xfffffff8, 0x6, 0x37, 0x8, 0xffffffed, 0x77c9538b, 0x9c2c, 0x3, 0xe3, 0x5, 0x80000000, 0x10, 0x1, 0xdde, 0x9, 0x2, 0x7ff, 0x5, 0x6, 0x8, 0x6, 0x0, 0x2, 0x897fcfc, 0x4, 0x7, 0xfff, 0x5, 0x2, 0x8, 0x32a498f4, 0x401, 0x3, 0x101, 0xbe6, 0x8, 0xac, 0x3, 0xf53, 0x4fb, 0x7, 0x3, 0x3c2c4fbe, 0x10000, 0x8, 0x4, 0x0, 0x4, 0x4, 0x6, 0x8000, 0xfffffff6, 0x2, 0x6, 0x0, 0x72, 0x10001, 0x2, 0x9, 0x7, 0x80, 0x2, 0xfba, 0x7ff, 0x7334, 0x9, 0x422, 0x5, 0xc9eb, 0x4, 0x3, 0xead, 0x3, 0x4, 0x23c6f639, 0x2, 0xfdd, 0x3, 0x0, 0x8, 0x6, 0x3, 0x6, 0x33, 0xfff, 0x4, 0x2, 0x40000000, 0x2c, 0xc0000, 0x3, 0x6, 0x5c4, 0x80000001, 0x800, 0x9, 0x0, 0x2, 0x8, 0xffffffff, 0x6, 0xffffffff, 0x80, 0x4, 0x6, 0x5, 0xa, 0x7, 0x1ed3, 0x1, 0x81, 0x84, 0x80000001, 0x4, 0x1, 0x8, 0x667, 0x2cc, 0x7, 0x2, 0x7, 0x9, 0x1, 0x5, 0x7, 0x9, 0x5, 0x1, 0x3, 0x9, 0x9, 0xe9e7, 0x2, 0x7, 0x3, 0xac2, 0x200, 0xf7, 0x10a, 0xc, 0x9702, 0x9, 0x4, 0x5, 0x10001, 0x4, 0x3, 0x2, 0x7ff, 0x9, 0x9, 0x4, 0x80000000, 0x8, 0x3, 0xfffffffc, 0x7a, 0x4e61, 0x9, 0x10000, 0xfffffffc, 0x401, 0x100, 0x1, 0x8, 0x8, 0x8000, 0x7f, 0xfffffffe, 0x5, 0xe3, 0x2, 0x56, 0x5, 0x6, 0xdf5, 0x7, 0x60000000, 0xae, 0x8, 0x4, 0x400, 0x8, 0x8, 0x4, 0x3ff, 0x8a2, 0x2, 0x8, 0x8, 0x800, 0x52d7f730]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x9, 0x9, 0x2, 0xa79, 0x2, 0x0, 0xfffffff2, 0x0, 0x12a78221, 0x3, 0x6, 0x80000000, 0x0, 0x5, 0x0, 0x2, 0x9, 0xb, 0x5, 0x1, 0x6d, 0x6, 0x8001, 0x1ff, 0x8, 0x6, 0xfffdfeee, 0x3, 0x83, 0x0, 0x4, 0x10000, 0x573, 0x5, 0x6f, 0x200, 0x0, 0xfffffffb, 0x10001, 0x7, 0x7, 0x1, 0xa, 0x6, 0x8001, 0x3, 0x8, 0x5, 0x313d, 0x7fff, 0x1, 0x5, 0x9, 0x4, 0x7, 0x5, 0xfffffffd, 0x4, 0x8000, 0x8, 0x0, 0x1, 0x400, 0x7, 0x0, 0x93, 0x18000, 0x10000, 0x5, 0x6, 0x401, 0x9, 0x10, 0x3, 0x1450, 0x7, 0x0, 0x4, 0xaf, 0x7, 0x4, 0x8, 0xfffffffd, 0x10, 0x8, 0x8, 0x80000001, 0x3, 0x7, 0xffff, 0x8, 0x3, 0x8000, 0xfffffffe, 0xffff, 0x10000, 0x6b1e2df4, 0x3, 0x9, 0x5, 0x7fff, 0x401, 0xa, 0xfffffffb, 0x2, 0x0, 0x9, 0x9, 0x0, 0x430, 0x5, 0x5, 0x2, 0xaa23, 0x81, 0x4, 0x3, 0xea9, 0x80000001, 0x1, 0xd7, 0xf, 0xbc, 0x7fff, 0x44da409b, 0x9, 0x0, 0x8, 0x4, 0x10, 0x6, 0x2f, 0x8, 0x7, 0x802, 0xe, 0x3, 0x1, 0x2, 0x1, 0xa44, 0x5, 0xc3e1, 0x9, 0x7fff, 0x8, 0x254, 0x2, 0xfffffff6, 0x0, 0x56, 0x2, 0x7, 0xb, 0x8, 0x3, 0x1, 0xf, 0x30, 0x401, 0x1ff, 0x8fe, 0x4, 0xf7, 0x8, 0x3, 0x100, 0x7, 0x2, 0x6, 0xfffffe01, 0xffff8000, 0x200, 0x6, 0x0, 0x7, 0xff, 0xfffffc01, 0x5, 0xda, 0xf, 0x1ff, 0x1, 0x7, 0x16, 0x3, 0x100000, 0x100, 0x3000, 0x8, 0x9, 0x2, 0x18b1897, 0x6, 0x40, 0x101, 0x7168, 0x3, 0x5e, 0xd, 0x6, 0x179f6cce, 0x7, 0x1, 0x7, 0x81, 0x0, 0x10, 0x7, 0x6, 0x7, 0xfffff188, 0x3, 0x2, 0x800, 0x81, 0x1ff, 0x9, 0xffffffff, 0x7, 0x80000001, 0xa, 0x5, 0x488, 0x3, 0x0, 0x3, 0x8, 0x1, 0xffffac7e, 0x0, 0x8, 0xab, 0x85, 0x80000000, 0x6, 0x200, 0xffffc968, 0x5, 0x4, 0x8, 0x78, 0x10001, 0x3d8, 0x7, 0xa92, 0x3, 0xc6f0, 0x3, 0x7f, 0x5, 0x78, 0x1, 0x1, 0xa]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x20000000, 0x3, 0x100, 0x4, {0x5, 0x1, 0x9, 0xffff, 0x5, 0xd}, {0x6, 0x2, 0x0, 0xfd1f, 0x1, 0x7}, 0x2, 0x5}}]}]}}, @TCA_RATE={0x6, 0x5, {0xb, 0x40}}, @filter_kind_options=@f_bpf={{0x8}, {0x3ec, 0x2, [@TCA_BPF_ACT={0x3b4, 0x1, [@m_csum={0x1ec, 0x5, 0x0, 0x0, {{0x9}, {0x100, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xd5, 0x9, 0x20000000, 0x200, 0x3ff}, 0x72}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x7, 0x10000000, 0x1, 0x10000}, 0x20}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x20000000, 0x8, 0x7fffffff}, 0x61}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0x6, 0x4, 0x800, 0xff000000}, 0x13}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x519, 0x0, 0x1, 0x10, 0x6}, 0x65}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0xfffffff8, 0x5, 0x1000000, 0x3}, 0x20}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x100, 0x7, 0x4, 0x37}, 0xa}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xff, 0x100, 0x20000000, 0xfffffffa, 0x80000001}}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7d1c, 0xab, 0x0, 0x3, 0x3dd6}, 0x74}}]}, {0xc3, 0x6, "ae261a128a8bc7a52023896eff24ea0603dce24d1105a94647f453bf637eb86c0a30923386a8a4123141c39f45a5446fd3eef540abf1a6e5d463662912f08d60ec6c1a08e3c0bf0a373f9ec790b56e55200e65d80adce89db14e9773af6f97ebe45fe2e4e06144199cb5633dae68fed2c4bcf0082d1fbc6d3e04ad50c1026bdd4f007e96205f0934a336dcf400b4615a170ad3e952ab096cf0ce0169be2c3041ff37ae3e649062e3d8a637425ba184a1399680bbd3e12e81fcc20376099f0c"}, {0xc, 0x7, {0x1, 0x9de2a70811782e59}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_tunnel_key={0x144, 0x17, 0x0, 0x0, {{0xf}, {0x94, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x42}}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x5}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xe0000000, 0x4, 0x4, 0x93, 0x101}, 0x2}}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @empty}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e22}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x9, 0x7, 0x10000000, 0x1, 0x6}, 0x4}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @remote}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, {0x82, 0x6, "3af86b93a4866e60ca333bb03986bdfd6fce7fec9fb6f1dbd823bf2536a7c181da88079b9dacbd51a8c6e64179ee143abcf747e0c2eada2fd67e84c3fba0cbd999495fb6095bb36d3307e198f8c8a0ad5a375a6a5fcc3073056e9153f1943d3c02bea6e33d2c640b59b0f3dfc4009837e94c92cceb6ac94ad1c199cae467"}, {0xc, 0x7, {0x8de182d85b79dff0}}, {0xc}}}, @m_tunnel_key={0x80, 0xd, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x10}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x8, 0xce2, 0x6, 0xffffffff, 0x10}, 0x2}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_BPF_OPS={{0x6, 0x4, 0x4}, {0x24, 0x5, [{0x1, 0x6, 0x2}, {0x8, 0x4, 0x3}, {0x3, 0x1, 0x6, 0x6}, {0x8, 0x3, 0x8, 0x7}]}}, @TCA_BPF_FD={0x8}]}}]}, 0xc84}, 0x1, 0x0, 0x0, 0x40008c5}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2) r2 = open(&(0x7f0000000000)='./file0\x00', 0x90142, 0x2) socket$netlink(0x10, 0x3, 0xf) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x400000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000000)="1700000002000200be8c5ee17688a2003c000303000afdff0230040000d90200bb6a880000d6c9db0000db", 0x2b) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES(r2, 0x1f, &(0x7f0000000180)=[0xffffffffffffffff], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = getpid() r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x5e, @private=0xa010101, 0x1d, 0x2003, 'ovf\x00', 0x21, 0x2a1b, 0x4}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) accept$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(r4, 0x5, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(0xffffffffffffffff, 0x89ed, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000200)={{{@in=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@broadcast}}, 0x0) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, r6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000080)={0xfc, 0x2, 0x3, 0x0, 0x4}) 623.559462ms ago: executing program 0 (id=7023): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x9) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$pokeuser(0x6, 0x0, 0x358, 0x800000000000) r2 = socket$igmp(0x2, 0x3, 0x2) sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r3, 0x3) accept4$bt_l2cap(r3, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000000040), 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) read$msr(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) 326.491849ms ago: executing program 2 (id=7024): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) (async) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = openat$mixer(0xffffff9c, &(0x7f0000000280), 0x120, 0x0) ioctl$mixer_OSS_ALSAEMULVER(r4, 0x80044df9, &(0x7f0000000100)) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) (async, rerun: 32) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) (rerun: 32) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x58}]}}]}, 0x60}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}}}, 0x24}}, 0x0) 0s ago: executing program 1 (id=7025): socket$kcm(0x11, 0x200000000000002, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa7c}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r1}, 0x18) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000000)={@loopback, 0x0}, &(0x7f0000000080)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6tnl0\x00', r3, 0x6, 0x4, 0x2, 0x6, 0x40, @empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}, 0x1, 0x8, 0x8, 0xfffffffc}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x1f4, 0xd28, 0x0, &(0x7f0000000940)="ff412f66b083dcc1010b3efc88ca", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x6}, 0x50) kernel console output (not intermixed with test programs): sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 2301.806743][ T815] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2301.813521][ T815] audit: audit_lost=11367 audit_rate_limit=0 audit_backlog_limit=64 [ 2301.821820][ T815] audit: backlog limit exceeded [ 2301.830982][ T815] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2301.837496][ T815] audit: audit_lost=11368 audit_rate_limit=0 audit_backlog_limit=64 [ 2303.129145][ T828] kvm: apic: phys broadcast and lowest prio [ 2303.135227][ T828] kvm: Disabled LAPIC found during irq injection [ 2303.189380][ T829] kvm: apic: phys broadcast and lowest prio [ 2303.892827][ T2968] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2303.902409][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2303.920862][T16616] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2303.931545][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2304.324329][ T838] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2304.819303][ T834] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6690'. [ 2305.005831][ T5848] usbhid 1-1:0.0: can't add hid device: -32 [ 2305.025898][ T5848] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 2305.083078][ T841] netlink: 'syz.4.6692': attribute type 2 has an invalid length. [ 2305.217450][ T834] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=834 comm=syz.3.6690 [ 2305.545277][ T837] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2305.546558][ T5848] usb 1-1: USB disconnect, device number 36 [ 2305.552608][ T837] IPv6: NLM_F_CREATE should be set when creating new route [ 2305.552633][ T837] IPv6: NLM_F_CREATE should be set when creating new route [ 2305.594623][ T30] kauditd_printk_skb: 969 callbacks suppressed [ 2305.594638][ T30] audit: type=1400 audit(2000000044.553:162147): avc: denied { read write } for pid=843 comm="syz.2.6693" name="radio9" dev="devtmpfs" ino=1010 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2305.636843][ T30] audit: type=1400 audit(2000000044.581:162148): avc: denied { read write } for pid=29074 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2305.701369][ T837] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2305.737832][ T30] audit: type=1400 audit(2000000044.581:162149): avc: denied { read write open } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2305.774441][ T30] audit: type=1400 audit(2000000044.581:162151): avc: denied { read write open } for pid=843 comm="syz.2.6693" path="/dev/radio9" dev="devtmpfs" ino=1010 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2305.869605][ T30] audit: type=1400 audit(2000000044.581:162150): avc: denied { ioctl } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2305.942485][ T30] audit: type=1400 audit(2000000044.655:162152): avc: denied { prog_load } for pid=843 comm="syz.2.6693" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2305.970259][ T30] audit: type=1400 audit(2000000044.655:162153): avc: denied { bpf } for pid=843 comm="syz.2.6693" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2305.993480][ T30] audit: type=1400 audit(2000000044.655:162154): avc: denied { perfmon } for pid=843 comm="syz.2.6693" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2306.031754][ T30] audit: type=1400 audit(2000000044.674:162155): avc: denied { prog_load } for pid=843 comm="syz.2.6693" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2306.140667][ T30] audit: type=1400 audit(2000000044.684:162156): avc: denied { bpf } for pid=843 comm="syz.2.6693" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2306.475526][ T859] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2306.522685][ T859] block device autoloading is deprecated and will be removed. [ 2306.540883][T32192] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 2306.796421][ T864] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2307.125713][ T862] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6700'. [ 2307.212074][T32192] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2307.214899][T32195] hid-generic 0000:0000:0000.0078: unknown main item tag 0x0 [ 2307.232975][T32192] usb 1-1: New USB device found, idVendor=056a, idProduct=00e3, bcdDevice= 0.00 [ 2307.291334][T32192] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2307.317843][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2307.326030][T12990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2307.334497][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2307.366669][T26921] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 2307.514292][T32192] usb 1-1: config 0 descriptor?? [ 2308.290366][ T851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2308.393401][ T851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2308.659856][T32192] wacom 0003:056A:00E3.0079: ignoring exceeding usage max [ 2308.831144][T32192] usb 1-1: USB disconnect, device number 37 [ 2308.938149][ T871] netlink: 'syz.3.6702': attribute type 1 has an invalid length. [ 2309.103573][ T872] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=872 comm=syz.3.6702 [ 2309.221390][ T871] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2309.298402][ T871] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2309.485180][T26921] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 2309.532665][T26921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2309.541333][T32195] hid-generic 0000:0000:0000.0078: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2309.551932][T26921] usb 2-1: Product: syz [ 2309.558378][T26921] usb 2-1: Manufacturer: syz [ 2309.563110][T26921] usb 2-1: SerialNumber: syz [ 2309.570346][T26921] usb 2-1: config 0 descriptor?? [ 2309.704307][T26921] usb 2-1: can't set config #0, error -71 [ 2309.730935][T26921] usb 2-1: USB disconnect, device number 38 [ 2310.050437][ T9435] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2310.061105][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2310.070016][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2310.078254][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2310.293644][ T887] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2310.891269][ T890] netlink: 'syz.3.6705': attribute type 2 has an invalid length. [ 2311.020287][ T30] kauditd_printk_skb: 234 callbacks suppressed [ 2311.020320][ T30] audit: type=1400 audit(2000000049.604:162391): avc: denied { read } for pid=878 comm="syz.3.6705" path="socket:[131037]" dev="sockfs" ino=131037 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2311.251673][ T30] audit: type=1400 audit(2000000049.613:162392): avc: denied { read } for pid=878 comm="syz.3.6705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2311.271991][ T30] audit: type=1400 audit(2000000049.613:162393): avc: denied { create } for pid=878 comm="syz.3.6705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 2311.291860][ T30] audit: type=1400 audit(2000000049.622:162394): avc: denied { bind } for pid=878 comm="syz.3.6705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 2311.475434][ T30] audit: type=1400 audit(2000000049.800:162395): avc: denied { map } for pid=883 comm="syz.1.6707" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131034 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2311.500942][ T30] audit: type=1400 audit(2000000049.800:162396): avc: denied { read write } for pid=883 comm="syz.1.6707" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131034 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2311.543053][ T30] audit: type=1400 audit(2000000049.903:162397): avc: denied { create } for pid=876 comm="syz.0.6704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 2311.562241][ T889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6707'. [ 2311.578559][ T30] audit: type=1400 audit(2000000049.912:162398): avc: denied { setopt } for pid=876 comm="syz.0.6704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 2311.598822][ T30] audit: type=1400 audit(2000000050.034:162399): avc: denied { read write } for pid=30348 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2311.628777][ T30] audit: type=1400 audit(2000000050.034:162400): avc: denied { read write open } for pid=30348 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2312.335507][ T900] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6709'. [ 2312.596414][ T899] ªªªªªª speed is unknown, defaulting to 1000 [ 2312.680462][ T899] lo speed is unknown, defaulting to 1000 [ 2312.790249][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 2313.487085][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2313.495434][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2313.820874][T26921] hid-generic 0000:0000:0000.007A: unknown main item tag 0x0 [ 2313.881229][T26921] hid-generic 0000:0000:0000.007A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2314.850717][T12990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2315.053306][ T953] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 2316.329517][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2316.338524][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2316.343579][ T968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6722'. [ 2316.391536][ T30] kauditd_printk_skb: 593 callbacks suppressed [ 2316.391551][ T30] audit: type=1400 audit(2000000054.599:162994): avc: denied { write } for pid=961 comm="syz.4.6722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2317.408348][ T30] audit: type=1400 audit(2000000054.636:162995): avc: denied { perfmon } for pid=960 comm="syz.0.6723" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2317.431102][ T30] audit: type=1400 audit(2000000054.636:162996): avc: denied { perfmon } for pid=960 comm="syz.0.6723" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2317.453111][ T30] audit: type=1400 audit(2000000054.646:162997): avc: denied { read write } for pid=962 comm="syz.1.6724" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=130016 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2317.478402][ T30] audit: type=1400 audit(2000000054.646:162998): avc: denied { read } for pid=962 comm="syz.1.6724" dev="nsfs" ino=4026533398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2317.500292][ T30] audit: type=1400 audit(2000000054.664:162999): avc: denied { read write } for pid=30348 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2317.525026][ C0] vkms_vblank_simulate: vblank timer overrun [ 2317.533828][ T30] audit: type=1400 audit(2000000054.664:163000): avc: denied { read write open } for pid=30348 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2317.583941][ T30] audit: type=1400 audit(2000000054.664:163001): avc: denied { ioctl } for pid=30348 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2317.650577][ T30] audit: type=1400 audit(2000000054.674:163002): avc: denied { read open } for pid=962 comm="syz.1.6724" path="net:[4026533398]" dev="nsfs" ino=4026533398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2317.696519][ T30] audit: type=1400 audit(2000000054.674:163003): avc: denied { create } for pid=962 comm="syz.1.6724" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 2318.966966][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2318.975240][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2319.097752][ T988] netlink: 'syz.0.6729': attribute type 2 has an invalid length. [ 2319.113900][ T988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6729'. [ 2319.216991][ T988] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=988 comm=syz.0.6729 [ 2319.381576][ T1000] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2319.392352][ T1000] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2319.561967][ T1005] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2319.654589][ T1004] binder: 1003:1004 unknown command 0 [ 2319.720370][ T1004] binder: 1003:1004 ioctl c0306201 200000000080 returned -22 [ 2319.950156][ T1004] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 2320.146039][T26921] hid-generic 0000:0000:0000.007B: unknown main item tag 0x0 [ 2320.448864][ T1017] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6736'. [ 2320.570840][ T1017] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 2320.574052][ T1015] vlan2: entered allmulticast mode [ 2320.587488][ T1015] macsec0: entered allmulticast mode [ 2320.592806][ T1015] veth1_macvtap: entered allmulticast mode [ 2320.737859][ T1018] vlan2: entered allmulticast mode [ 2321.047420][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2321.639848][ T1028] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2321.828971][ T30] kauditd_printk_skb: 381 callbacks suppressed [ 2321.828993][ T30] audit: type=1400 audit(2000000059.650:163385): avc: denied { create } for pid=1022 comm="syz.4.6738" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2322.119527][ T30] audit: type=1400 audit(2000000059.697:163386): avc: denied { create } for pid=1030 comm="syz.1.6739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2322.319066][ T30] audit: type=1400 audit(2000000059.697:163387): avc: denied { allowed } for pid=1022 comm="syz.4.6738" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 2322.357052][T26921] hid-generic 0000:0000:0000.007B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2322.368060][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2322.377116][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2322.387394][ T30] audit: type=1400 audit(2000000059.734:163388): avc: denied { bind } for pid=1030 comm="syz.1.6739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2322.408622][ T30] audit: type=1400 audit(2000000059.837:163389): avc: denied { create } for pid=1022 comm="syz.4.6738" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2322.430733][ T30] audit: type=1400 audit(2000000059.903:163390): avc: denied { map } for pid=1022 comm="syz.4.6738" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131400 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2322.456027][ T30] audit: type=1400 audit(2000000059.931:163391): avc: denied { read write } for pid=1022 comm="syz.4.6738" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131400 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2322.611905][ T30] audit: type=1400 audit(2000000060.043:163392): avc: denied { map } for pid=1022 comm="syz.4.6738" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131400 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2322.709468][ T30] audit: type=1400 audit(2000000060.090:163393): avc: denied { read write } for pid=1022 comm="syz.4.6738" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=131400 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2322.825476][ T30] audit: type=1400 audit(2000000060.099:163394): avc: denied { read write } for pid=31443 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2323.736017][T32195] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 2323.942555][T32195] usb 2-1: config 0 has an invalid interface number: 235 but max is 0 [ 2323.951854][T32195] usb 2-1: config 0 has no interface number 0 [ 2323.961830][T32195] usb 2-1: config 0 interface 235 altsetting 16 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2323.972519][T32195] usb 2-1: config 0 interface 235 has no altsetting 0 [ 2323.994422][T32195] usb 2-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=3e.18 [ 2324.006004][T32195] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2324.015577][T32195] usb 2-1: Product: syz [ 2324.020420][T32195] usb 2-1: Manufacturer: syz [ 2324.026358][T32195] usb 2-1: SerialNumber: syz [ 2324.027915][ T1072] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6748'. [ 2324.033416][T32195] usb 2-1: config 0 descriptor?? [ 2324.095749][ T1072] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1072 comm=syz.0.6748 [ 2324.099201][T32195] keyspan 2-1:0.235: Keyspan 1 port adapter converter detected [ 2324.118691][ T5848] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 2324.137575][T32195] keyspan 2-1:0.235: found no endpoint descriptor for endpoint 87 [ 2324.160589][T32195] keyspan 2-1:0.235: found no endpoint descriptor for endpoint 7 [ 2324.175106][T32195] keyspan 2-1:0.235: found no endpoint descriptor for endpoint 81 [ 2324.202201][T32195] keyspan 2-1:0.235: found no endpoint descriptor for endpoint 1 [ 2324.217395][ T1072] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2324.237064][ T1072] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2324.279600][T32195] keyspan 2-1:0.235: found no endpoint descriptor for endpoint 85 [ 2324.308922][T32195] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 2324.317213][ T5848] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2324.317244][ T5848] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2324.317277][ T5848] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 2324.317297][ T5848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2324.339996][ T5848] usb 5-1: config 0 descriptor?? [ 2324.361076][T32195] usb 2-1: USB disconnect, device number 39 [ 2324.420376][T32195] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 2324.420674][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2324.438259][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2324.440008][T32195] keyspan 2-1:0.235: device disconnected [ 2326.370406][T26921] hid-generic 0000:0000:0000.007C: unknown main item tag 0x0 [ 2326.389672][T26921] hid-generic 0000:0000:0000.007C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2327.177054][ T1102] audit_log_start: 361 callbacks suppressed [ 2327.177077][ T1102] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2327.189722][ T1102] audit: audit_lost=11658 audit_rate_limit=0 audit_backlog_limit=64 [ 2327.198244][ T1102] audit: backlog limit exceeded [ 2327.208949][ T1102] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2327.215583][ T1102] audit: audit_lost=11659 audit_rate_limit=0 audit_backlog_limit=64 [ 2327.223896][ T1102] audit: backlog limit exceeded [ 2327.232097][ T1102] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2327.238820][ T1102] audit: audit_lost=11660 audit_rate_limit=0 audit_backlog_limit=64 [ 2327.247032][ T1102] audit: backlog limit exceeded [ 2327.325547][ T30] audit: type=1400 audit(2000000064.327:163687): avc: denied { write } for pid=1100 comm="syz.0.6755" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2327.403442][ T9430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2327.716325][ T5848] usbhid 5-1:0.0: can't add hid device: -71 [ 2327.723657][ T5848] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2327.735208][ T5848] usb 5-1: USB disconnect, device number 124 [ 2328.320050][ T1120] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6760'. [ 2328.912567][ T1133] netlink: 'syz.0.6762': attribute type 2 has an invalid length. [ 2328.949933][ T1133] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6762'. [ 2329.062962][ T1133] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6762'. [ 2329.115073][ T1133] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1133 comm=syz.0.6762 [ 2329.206618][ T1136] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2329.216126][ T1136] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2329.410316][T14355] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 2329.593971][T14355] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 2329.633812][T14355] usb 5-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 2329.644621][T14355] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2329.652794][T14355] usb 5-1: Product: syz [ 2329.657458][T14355] usb 5-1: Manufacturer: syz [ 2329.662059][T14355] usb 5-1: SerialNumber: syz [ 2329.704807][T14355] usb 5-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 2329.757090][ T1114] netlink: 'syz.3.6759': attribute type 13 has an invalid length. [ 2329.869941][ T5848] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 2329.895017][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2329.903959][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2330.577296][ T9430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2330.585584][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2330.605969][ T9435] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2330.616662][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2330.903360][ T1114] bridge0: port 2(bridge_slave_1) entered disabled state [ 2330.911118][ T1114] bridge0: port 1(bridge_slave_0) entered disabled state [ 2330.928904][ T5848] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2330.941354][ T5848] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2330.951603][ T5848] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2330.968410][ T5848] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2330.980349][ T5848] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2331.000788][ T5848] usb 1-1: config 0 descriptor?? [ 2331.092231][T14355] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2331.107336][T14355] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 2331.170489][T14355] usb 5-1: media controller created [ 2331.177385][ T1114] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2331.534973][T14355] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2331.593465][ T1114] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2332.277890][ T1114] veth1_macvtap: left allmulticast mode [ 2332.365621][ T5848] usbhid 1-1:0.0: can't add hid device: -71 [ 2332.393292][ T5848] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 2332.425241][ T5848] usb 1-1: USB disconnect, device number 38 [ 2332.617269][ T30] kauditd_printk_skb: 413 callbacks suppressed [ 2332.617284][ T30] audit: type=1400 audit(2000000069.818:164101): avc: denied { read } for pid=1166 comm="syz.2.6771" dev="nsfs" ino=4026535535 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2332.648017][ T30] audit: type=1400 audit(2000000069.836:164102): avc: denied { watch } for pid=1168 comm="syz.1.6772" path="/222" dev="tmpfs" ino=1197 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 2332.665302][ T1167] netlink: 'syz.2.6771': attribute type 1 has an invalid length. [ 2332.672701][ T30] audit: type=1400 audit(2000000069.836:164103): avc: denied { watch_sb watch_reads } for pid=1168 comm="syz.1.6772" path="/222" dev="tmpfs" ino=1197 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 2332.704180][ T30] audit: type=1400 audit(2000000069.836:164104): avc: denied { read open } for pid=1166 comm="syz.2.6771" path="net:[4026535535]" dev="nsfs" ino=4026535535 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2332.729174][ T30] audit: type=1400 audit(2000000069.836:164105): avc: denied { create } for pid=1166 comm="syz.2.6771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.729214][ T30] audit: type=1400 audit(2000000069.836:164106): avc: denied { write } for pid=1166 comm="syz.2.6771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.779160][ T1170] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2332.788207][ T1170] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2332.796395][ T5134] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 2332.802516][ T30] audit: type=1400 audit(2000000069.836:164107): avc: denied { create } for pid=1166 comm="syz.2.6771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.804979][ T1146] netlink: 'syz.4.6764': attribute type 3 has an invalid length. [ 2332.836162][ T30] audit: type=1400 audit(2000000069.855:164108): avc: denied { create } for pid=1166 comm="syz.2.6771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.865228][ T9430] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2332.874550][ T36] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2332.875281][ T30] audit: type=1400 audit(2000000069.855:164109): avc: denied { ioctl } for pid=1166 comm="syz.2.6771" path="socket:[131700]" dev="sockfs" ino=131700 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.911169][ T30] audit: type=1400 audit(2000000069.855:164110): avc: denied { create } for pid=1166 comm="syz.2.6771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2332.914102][T32194] usb 5-1: USB disconnect, device number 125 [ 2333.038597][ T36] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2333.048696][ T36] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2333.313449][ T9430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2333.337575][ T1179] netlink: 'syz.2.6773': attribute type 12 has an invalid length. [ 2333.720268][ T1184] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6777'. [ 2333.815415][ T5853] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 2333.899174][ T1184] Invalid ELF section header size [ 2333.987073][ T5853] usb 3-1: Using ep0 maxpacket: 16 [ 2334.057223][ T5853] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 2334.077341][ T5853] usb 3-1: config 0 has no interface number 0 [ 2334.140863][ T1191] netlink: 'syz.4.6778': attribute type 2 has an invalid length. [ 2334.441724][ T5853] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2334.467553][ T5853] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2334.475913][ T5853] usb 3-1: Product: syz [ 2334.486125][ T5853] usb 3-1: Manufacturer: syz [ 2334.510398][ T5853] usb 3-1: SerialNumber: syz [ 2334.529955][ T5853] usb 3-1: config 0 descriptor?? [ 2334.548685][ T5853] hub 3-1:0.132: bad descriptor, ignoring hub [ 2334.561740][ T5853] hub 3-1:0.132: probe with driver hub failed with error -5 [ 2334.588046][ T5853] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input124 [ 2335.082269][T32194] hid-generic 0000:0000:0000.007D: unknown main item tag 0x0 [ 2335.099201][ T5853] usb 3-1: USB disconnect, device number 108 [ 2335.110975][T32194] hid-generic 0000:0000:0000.007D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2337.125718][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2337.134140][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2337.143000][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2337.153719][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2337.320871][ T1206] netlink: 'syz.0.6782': attribute type 12 has an invalid length. [ 2337.628777][ T1214] netlink: 'syz.2.6784': attribute type 1 has an invalid length. [ 2337.664694][ T1214] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2337.679690][ T1214] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2337.690618][ T1215] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6785'. [ 2338.235129][ T30] kauditd_printk_skb: 1829 callbacks suppressed [ 2338.235145][ T30] audit: type=1400 audit(2000000075.084:164497): avc: denied { read write } for pid=1205 comm="syz.0.6782" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.282686][ T30] audit: type=1400 audit(2000000075.093:164498): avc: denied { read write open } for pid=1205 comm="syz.0.6782" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.375634][ T30] audit: type=1400 audit(2000000075.093:164499): avc: denied { ioctl } for pid=1205 comm="syz.0.6782" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.454044][ T1222] netlink: 'syz.3.6787': attribute type 2 has an invalid length. [ 2338.479719][ T1221] binder: 1219:1221 ioctl c0306201 200000001040 returned -14 [ 2338.486688][ T30] audit: type=1400 audit(2000000075.093:164500): avc: denied { ioctl } for pid=1205 comm="syz.0.6782" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.517108][ T30] audit: type=1400 audit(2000000075.112:164501): avc: denied { ioctl } for pid=1205 comm="syz.0.6782" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.520742][ T1222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6787'. [ 2338.551774][ T30] audit: type=1400 audit(2000000075.121:164502): avc: denied { ioctl } for pid=1205 comm="syz.0.6782" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2338.580253][ T1221] binder: 1219:1221 ioctl c0306201 2000000001c0 returned -14 [ 2338.591166][ T5848] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 2338.620879][ T30] audit: type=1400 audit(2000000075.206:164503): avc: denied { read write } for pid=30855 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2338.645690][ T30] audit: type=1400 audit(2000000075.206:164504): avc: denied { read write open } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2338.662890][ T1222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6787'. [ 2338.726836][ T30] audit: type=1400 audit(2000000075.206:164505): avc: denied { ioctl } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2338.749375][ T1222] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1222 comm=syz.3.6787 [ 2338.761714][ T1228] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1228 comm=syz.2.6788 [ 2338.780760][ T30] audit: type=1400 audit(2000000075.243:164506): avc: denied { read } for pid=1219 comm="syz.1.6786" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 2338.787165][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2338.809810][ T5848] usb 1-1: Using ep0 maxpacket: 16 [ 2338.825936][ T5848] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 2338.835451][ T5848] usb 1-1: config 0 has no interface number 0 [ 2338.864665][ T5848] usb 1-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2338.894353][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2338.907673][ T5848] usb 1-1: Product: syz [ 2338.909491][ T1223] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2338.921254][ T5848] usb 1-1: Manufacturer: syz [ 2338.951896][ T5848] usb 1-1: SerialNumber: syz [ 2338.963844][ T1223] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2338.974786][ T5848] usb 1-1: config 0 descriptor?? [ 2339.051534][ T1235] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6790'. [ 2339.054771][ T5848] hub 1-1:0.132: bad descriptor, ignoring hub [ 2339.066826][ T1235] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6790'. [ 2339.075783][ T1235] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6790'. [ 2339.283753][ T1236] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2339.518288][ T5848] hub 1-1:0.132: probe with driver hub failed with error -5 [ 2339.528195][ T5848] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.132/input/input125 [ 2339.846094][T14355] usb 1-1: USB disconnect, device number 39 [ 2339.850648][ T1245] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6794'. [ 2340.069209][ T5848] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 2340.165704][ T1247] rpc_pipefs: Unknown parameter 'discard!íRù]9 ‡÷Ð8çÿÆåS›G‹›37m à‡Æç›3J•›fš$]gó˜~óR' [ 2340.240089][ T5848] usb 3-1: Using ep0 maxpacket: 16 [ 2340.264017][ T5848] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2340.319766][ T5848] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2340.355262][ T5848] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2340.364613][ T5848] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2340.372943][ T5848] usb 3-1: Product: syz [ 2340.377275][ T5848] usb 3-1: Manufacturer: syz [ 2340.382022][ T5848] usb 3-1: SerialNumber: syz [ 2340.388378][ T5848] usb 3-1: config 0 descriptor?? [ 2340.401422][ T5848] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2340.410754][ T5848] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 2340.571835][ T5853] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 2340.742826][ T5853] usb 5-1: Using ep0 maxpacket: 16 [ 2340.773785][ T5853] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2341.210329][ T5853] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 2341.232818][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2341.266998][ T5853] usb 5-1: Product: syz [ 2341.274401][ T5853] usb 5-1: Manufacturer: syz [ 2341.280504][ T5853] usb 5-1: SerialNumber: syz [ 2341.613024][ T5848] em28xx 3-1:0.0: unknown em28xx chip ID (43) [ 2341.629806][ T5853] usb 5-1: config 0 descriptor?? [ 2341.721773][ T5853] hub 5-1:0.0: bad descriptor, ignoring hub [ 2341.728509][ T5853] hub 5-1:0.0: probe with driver hub failed with error -5 [ 2341.770606][ T5853] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input126 [ 2341.836858][ T5848] em28xx 3-1:0.0: Config register raw data: 0x2b [ 2341.844240][ T5848] em28xx 3-1:0.0: I2S Audio (3 sample rate(s)) [ 2341.850418][ T5848] em28xx 3-1:0.0: No AC97 audio processor [ 2342.067183][ T1241] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6791'. [ 2342.129324][ T5848] usb 3-1: USB disconnect, device number 109 [ 2342.154025][ T5853] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 2342.198284][ T1249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2342.351104][ T1249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2342.379163][ T1249] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6795'. [ 2342.449001][ T5853] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2342.460330][ T5853] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2342.494962][ T5853] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2342.514704][ T5853] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2342.584228][ T5853] usb 2-1: config 0 descriptor?? [ 2342.594169][ T5853] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 2342.601102][ T5853] dvb-usb: bulk message failed: -22 (3/0) [ 2342.892233][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2342.902953][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2342.911708][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2342.919949][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2342.948882][ T5853] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 2343.005353][ T5853] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 2343.026543][ T5853] usb 2-1: media controller created [ 2343.044577][ T5853] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2343.112291][ T5853] dvb-usb: bulk message failed: -22 (6/0) [ 2343.119294][ T5853] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 2343.139111][ T5853] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input127 [ 2343.159273][ T24] usb 5-1: USB disconnect, device number 126 [ 2343.355936][ T5853] dvb-usb: schedule remote query interval to 150 msecs. [ 2343.364857][ T5853] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2343.385285][ T5853] usb 2-1: USB disconnect, device number 40 [ 2343.409266][ T5853] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2343.523097][ T1289] netlink: 'syz.2.6804': attribute type 2 has an invalid length. [ 2343.532081][ T1289] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6804'. [ 2343.562976][ T1289] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6804'. [ 2343.591067][ T30] kauditd_printk_skb: 504 callbacks suppressed [ 2343.591085][ T30] audit: type=1400 audit(2000000080.088:165011): avc: denied { create } for pid=1288 comm="syz.2.6804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 2343.593605][ T1289] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1289 comm=syz.2.6804 [ 2343.608262][ T30] audit: type=1400 audit(2000000080.098:165012): avc: denied { read write } for pid=31443 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.688884][ T1291] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2343.699087][ T1291] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2343.699364][ T30] audit: type=1400 audit(2000000080.163:165013): avc: denied { read write open } for pid=31443 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.732250][ C1] vkms_vblank_simulate: vblank timer overrun [ 2343.742694][ T30] audit: type=1400 audit(2000000080.163:165014): avc: denied { ioctl } for pid=31443 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.768586][ C1] vkms_vblank_simulate: vblank timer overrun [ 2343.775497][ T30] audit: type=1400 audit(2000000080.229:165015): avc: denied { read write } for pid=31186 comm="syz-executor" name="loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.799939][ C1] vkms_vblank_simulate: vblank timer overrun [ 2343.809246][ T30] audit: type=1400 audit(2000000080.229:165016): avc: denied { read write open } for pid=31186 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.834648][ C1] vkms_vblank_simulate: vblank timer overrun [ 2343.846166][ T30] audit: type=1400 audit(2000000080.229:165017): avc: denied { ioctl } for pid=31186 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.871974][ C1] vkms_vblank_simulate: vblank timer overrun [ 2343.908581][ T30] audit: type=1400 audit(2000000080.378:165018): avc: denied { read write } for pid=29074 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.934982][ T30] audit: type=1400 audit(2000000080.378:165019): avc: denied { read write open } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2343.968711][ T1294] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6805'. [ 2344.026899][ T30] audit: type=1400 audit(2000000080.378:165020): avc: denied { ioctl } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2344.119792][ T1294] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6805'. [ 2344.183340][ T1300] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6807'. [ 2344.193085][ T1300] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6807'. [ 2344.195996][ T1305] netlink: 'syz.2.6808': attribute type 2 has an invalid length. [ 2344.267745][ T1305] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1305 comm=syz.2.6808 [ 2344.324252][ T24] usb 5-1: new full-speed USB device number 127 using dummy_hcd [ 2344.350707][ T1308] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2344.363118][ T1308] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2344.456009][ T1310] netlink: 'syz.1.6809': attribute type 12 has an invalid length. [ 2344.546872][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2344.572717][ T24] usb 5-1: not running at top speed; connect to a high speed hub [ 2344.605201][ T24] usb 5-1: config 106 has an invalid interface number: 8 but max is 0 [ 2344.645274][ T24] usb 5-1: config 106 has no interface number 0 [ 2344.662417][ T24] usb 5-1: config 106 interface 8 has no altsetting 0 [ 2344.708911][ T24] usb 5-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice=93.dd [ 2344.733214][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2344.749711][ T24] usb 5-1: Product: syz [ 2344.774447][ T24] usb 5-1: Manufacturer: syz [ 2344.788680][ T24] usb 5-1: SerialNumber: syz [ 2344.800550][ T1318] tipc: Enabling of bearer rejected, failed to enable media [ 2344.901045][ T5848] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 2344.945393][ T9430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2345.072165][ T5848] usb 2-1: Using ep0 maxpacket: 16 [ 2345.467733][ T5848] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 2345.523611][ T24] kalmia 5-1:106.8 (unnamed net_device) (uninitialized): Error sending init packet. Status -22 [ 2345.528300][ T5848] usb 2-1: config 0 has no interface number 0 [ 2345.544014][ T1332] 9pnet_fd: Insufficient options for proto=fd [ 2345.567552][ T24] kalmia 5-1:106.8: probe with driver kalmia failed with error -22 [ 2345.599838][ T5848] usb 2-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2345.630030][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2345.638805][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2345.653985][ T24] usb 5-1: USB disconnect, device number 127 [ 2345.667964][ T5848] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2345.714138][ T5848] usb 2-1: Product: syz [ 2345.718361][ T5848] usb 2-1: Manufacturer: syz [ 2345.755320][ T5848] usb 2-1: SerialNumber: syz [ 2345.799878][ T5848] usb 2-1: config 0 descriptor?? [ 2345.842531][ T5848] hub 2-1:0.132: bad descriptor, ignoring hub [ 2345.848651][ T5848] hub 2-1:0.132: probe with driver hub failed with error -5 [ 2345.918906][ T5848] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.132/input/input128 [ 2346.156039][ T1343] input: syz0 as /devices/virtual/input/input129 [ 2346.201609][T26431] Bluetooth: Unexpected continuation frame (len 4) [ 2346.301460][ T5848] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 2346.431639][ T1349] __nla_validate_parse: 3 callbacks suppressed [ 2346.431652][ T1349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6816'. [ 2346.500135][ T5848] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2346.569248][ T5848] usb 4-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 2346.583365][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2346.605816][ T5848] usb 4-1: config 0 descriptor?? [ 2346.758745][ T1357] netlink: 'syz.4.6818': attribute type 2 has an invalid length. [ 2346.768865][ T1357] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6818'. [ 2346.878367][ T1357] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6818'. [ 2347.035120][ T1357] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1357 comm=syz.4.6818 [ 2347.106323][ T1358] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2347.115931][ T1358] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2347.259389][ T5848] steelseries 0003:1038:12B6.007E: hidraw0: USB HID v0.00 Device [HID 1038:12b6] on usb-dummy_hcd.3-1/input0 [ 2347.588660][ T1368] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2347.792725][ T5848] usb 2-1: USB disconnect, device number 41 [ 2347.872559][T14355] usb 4-1: USB disconnect, device number 102 [ 2348.843733][ T1378] 9pnet_fd: Insufficient options for proto=fd [ 2348.891780][ T1376] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6823'. [ 2348.967290][ T30] kauditd_printk_skb: 433 callbacks suppressed [ 2348.967301][ T30] audit: type=1400 audit(2000000085.121:165454): avc: denied { read write } for pid=30855 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2349.038623][ T30] audit: type=1400 audit(2000000085.158:165455): avc: denied { read write open } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2349.075966][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2349.086698][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2349.096920][ T150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2349.105573][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2349.145851][ T30] audit: type=1400 audit(2000000085.158:165456): avc: denied { ioctl } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2349.204220][ T30] audit: type=1400 audit(2000000085.177:165457): avc: denied { prog_load } for pid=1379 comm="syz.4.6824" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2349.292906][ T1384] FAULT_INJECTION: forcing a failure. [ 2349.292906][ T1384] name failslab, interval 1, probability 0, space 0, times 0 [ 2349.314785][ T30] audit: type=1400 audit(2000000085.177:165458): avc: denied { bpf } for pid=1379 comm="syz.4.6824" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.317007][ T1384] CPU: 0 UID: 0 PID: 1384 Comm: syz.2.6826 Not tainted syzkaller #0 PREEMPT(full) [ 2349.317029][ T1384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2349.317039][ T1384] Call Trace: [ 2349.317044][ T1384] [ 2349.317050][ T1384] dump_stack_lvl+0x16c/0x1f0 [ 2349.317070][ T1384] should_fail_ex+0x512/0x640 [ 2349.317089][ T1384] ? fs_reclaim_acquire+0xae/0x150 [ 2349.317109][ T1384] should_failslab+0xc2/0x120 [ 2349.317127][ T1384] __kmalloc_noprof+0xdd/0x880 [ 2349.317147][ T1384] ? kfree+0x252/0x6d0 [ 2349.317165][ T1384] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2349.317189][ T1384] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2349.317206][ T1384] tomoyo_realpath_from_path+0xc2/0x6e0 [ 2349.317231][ T1384] tomoyo_mount_acl+0x664/0x850 [ 2349.317246][ T1384] ? bpf_ksym_find+0x127/0x1c0 [ 2349.317273][ T1384] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 2349.317288][ T1384] ? unwind_get_return_address+0x59/0xa0 [ 2349.317336][ T1384] ? tomoyo_domain+0xbb/0x150 [ 2349.317355][ T1384] ? tomoyo_profile+0x47/0x60 [ 2349.317377][ T1384] tomoyo_mount_permission+0x16d/0x420 [ 2349.317393][ T1384] ? tomoyo_mount_permission+0x14f/0x420 [ 2349.317411][ T1384] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 2349.317441][ T1384] security_sb_mount+0x9b/0x260 [ 2349.317459][ T1384] path_mount+0x158/0x23a0 [ 2349.317482][ T1384] ? __pfx_path_mount+0x10/0x10 [ 2349.317501][ T1384] ? kmem_cache_free+0x2d4/0x6c0 [ 2349.317514][ T1384] ? putname+0x154/0x1a0 [ 2349.317537][ T1384] ? putname+0x154/0x1a0 [ 2349.317552][ T1384] ? putname+0x154/0x1a0 [ 2349.317573][ T1384] ? __x64_sys_mount+0x293/0x310 [ 2349.317589][ T1384] __x64_sys_mount+0x293/0x310 [ 2349.317608][ T1384] ? __pfx___x64_sys_mount+0x10/0x10 [ 2349.317632][ T1384] do_syscall_64+0xcd/0xfa0 [ 2349.317649][ T1384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2349.317665][ T1384] RIP: 0033:0x7f01c158f749 [ 2349.317678][ T1384] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2349.317692][ T1384] RSP: 002b:00007f01c23fa038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2349.317707][ T1384] RAX: ffffffffffffffda RBX: 00007f01c17e5fa0 RCX: 00007f01c158f749 [ 2349.317718][ T1384] RDX: 0000200000000180 RSI: 0000200000000040 RDI: 0000200000000140 [ 2349.317727][ T1384] RBP: 00007f01c23fa090 R08: 0000000000000000 R09: 0000000000000000 [ 2349.317737][ T1384] R10: 0000000002208004 R11: 0000000000000246 R12: 0000000000000002 [ 2349.317745][ T1384] R13: 00007f01c17e6038 R14: 00007f01c17e5fa0 R15: 00007ffc99bb82c8 [ 2349.317768][ T1384] [ 2349.317774][ T1384] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2349.371664][ T30] audit: type=1400 audit(2000000085.177:165459): avc: denied { perfmon } for pid=1379 comm="syz.4.6824" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.378765][ T1382] netlink: 'syz.4.6824': attribute type 2 has an invalid length. [ 2349.422842][ T30] audit: type=1400 audit(2000000085.177:165460): avc: denied { perfmon } for pid=1379 comm="syz.4.6824" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.422887][ T30] audit: type=1400 audit(2000000085.177:165461): avc: denied { perfmon } for pid=1379 comm="syz.4.6824" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.422930][ T30] audit: type=1400 audit(2000000085.177:165462): avc: denied { perfmon } for pid=1379 comm="syz.4.6824" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.423161][ T30] audit: type=1400 audit(2000000085.177:165463): avc: denied { perfmon } for pid=1379 comm="syz.4.6824" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2349.513258][ T1388] netlink: 'syz.0.6827': attribute type 29 has an invalid length. [ 2349.966473][ T1397] netlink: 548 bytes leftover after parsing attributes in process `syz.0.6827'. [ 2350.014628][ T1396] netlink: 'syz.0.6827': attribute type 29 has an invalid length. [ 2350.344085][T26431] Bluetooth: Unexpected continuation frame (len 4) [ 2351.113027][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2351.121288][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2351.129416][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2351.480217][ T1418] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6832'. [ 2351.766395][ T5848] libceph: connect (1)[c::]:6789 error -22 [ 2351.772453][ T5848] libceph: mon0 (1)[c::]:6789 connect error [ 2351.997367][ T1426] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2352.054228][ T5848] libceph: connect (1)[c::]:6789 error -22 [ 2352.061248][ T5848] libceph: mon0 (1)[c::]:6789 connect error [ 2352.542630][ T1421] ceph: No mds server is up or the cluster is laggy [ 2352.620082][ T1437] netlink: 232 bytes leftover after parsing attributes in process `syz.1.6835'. [ 2352.711383][ T5848] libceph: connect (1)[c::]:6789 error -22 [ 2352.717454][ T5848] libceph: mon0 (1)[c::]:6789 connect error [ 2354.323199][ T30] kauditd_printk_skb: 329 callbacks suppressed [ 2354.323215][ T30] audit: type=1400 audit(2000000090.125:165790): avc: denied { read write } for pid=1452 comm="syz.3.6841" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.366959][ T30] audit: type=1400 audit(2000000090.163:165791): avc: denied { read write } for pid=29074 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2354.392537][ T30] audit: type=1400 audit(2000000090.163:165792): avc: denied { read write open } for pid=1452 comm="syz.3.6841" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.435983][ T30] audit: type=1400 audit(2000000090.163:165793): avc: denied { read write open } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2354.469939][ T5848] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 2354.493639][ T30] audit: type=1400 audit(2000000090.163:165794): avc: denied { ioctl } for pid=1452 comm="syz.3.6841" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.525017][T17012] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2354.535743][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2354.563304][ T30] audit: type=1400 audit(2000000090.163:165795): avc: denied { ioctl } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2354.592838][ T30] audit: type=1400 audit(2000000090.163:165796): avc: denied { ioctl } for pid=1452 comm="syz.3.6841" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.620604][T26921] usb 4-1: new low-speed USB device number 103 using dummy_hcd [ 2354.634307][ T30] audit: type=1400 audit(2000000090.172:165797): avc: denied { ioctl } for pid=1452 comm="syz.3.6841" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.739806][ T30] audit: type=1400 audit(2000000090.172:165798): avc: denied { ioctl } for pid=1452 comm="syz.3.6841" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.768356][ T30] audit: type=1400 audit(2000000090.200:165799): avc: denied { ioctl } for pid=1450 comm="syz.4.6840" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2354.801562][T14355] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 2354.819487][ T5848] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 2355.066660][ T5848] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 2355.068242][T26921] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2355.075871][ T5848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2355.094833][ T5848] usb 5-1: config 0 descriptor?? [ 2355.098343][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2355.129066][T26921] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2355.142731][T14355] usb 1-1: Using ep0 maxpacket: 32 [ 2355.153330][T14355] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 2355.161341][T14355] usb 1-1: config 0 has no interface number 0 [ 2355.169049][T14355] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2355.169180][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2355.196528][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2355.210404][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2355.230201][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2355.250033][T14355] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2355.260270][T14355] usb 1-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 2355.269387][T14355] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2355.275685][T26921] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2355.279355][T14355] usb 1-1: config 0 descriptor?? [ 2355.317503][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2355.400338][T26921] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2355.415579][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2355.427600][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2355.447250][T26921] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2355.456328][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2355.467790][T26921] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2355.485115][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2355.499508][T26921] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2355.525264][T26921] usb 4-1: string descriptor 0 read error: -22 [ 2355.534624][T26921] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 2355.563663][T26921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2355.632221][T26921] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 2355.911676][T26921] usb 4-1: USB disconnect, device number 103 [ 2355.965424][ T1469] bond2: entered allmulticast mode [ 2355.971356][ T1469] 8021q: adding VLAN 0 to HW filter on device bond2 [ 2355.982604][ T1469] bridge0: port 4(bond2) entered blocking state [ 2355.989771][ T1469] bridge0: port 4(bond2) entered disabled state [ 2356.007541][ T1469] bond2: entered promiscuous mode [ 2356.124584][ T5848] letsketch 0003:6161:4D15.007F: Device info: Г [ 2356.149623][T14355] uclogic 0003:28BD:0094.0080: pen parameters not found [ 2356.156946][T14355] uclogic 0003:28BD:0094.0080: interface is invalid, ignoring [ 2356.417492][ T1473] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6840'. [ 2356.872217][ T1483] syzkaller0: entered promiscuous mode [ 2356.885666][ T1483] syzkaller0: entered allmulticast mode [ 2357.260030][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2357.268359][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2357.283072][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2357.585807][ T1496] netlink: 232 bytes leftover after parsing attributes in process `syz.2.6850'. [ 2357.745973][T32192] usb 1-1: USB disconnect, device number 40 [ 2357.828137][ T5848] usb 5-1: Max retries (5) exceeded reading string descriptor 201 [ 2357.854099][ T5848] letsketch 0003:6161:4D15.007F: probe with driver letsketch failed with error -71 [ 2357.904681][ T5848] usb 5-1: USB disconnect, device number 2 [ 2358.321603][T26921] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 2358.478191][ T5848] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 2358.526225][T26921] usb 3-1: Using ep0 maxpacket: 16 [ 2358.553632][T26921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2358.600069][T26921] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2358.620953][T26921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2358.639390][T26921] usb 3-1: Product: syz [ 2358.662989][T26921] usb 3-1: Manufacturer: syz [ 2358.667680][T26921] usb 3-1: SerialNumber: syz [ 2358.669359][ T5848] usb 4-1: config 58 has an invalid interface number: 43 but max is 0 [ 2358.693101][T26921] usb 3-1: config 0 descriptor?? [ 2358.697969][ T5848] usb 4-1: config 58 has no interface number 0 [ 2358.709726][ T5848] usb 4-1: config 58 interface 43 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2358.730876][T26921] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2358.744658][ T5848] usb 4-1: New USB device found, idVendor=0c45, idProduct=610a, bcdDevice=ee.a7 [ 2358.762838][T26921] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 2358.787469][ T5848] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2358.810904][ T5848] usb 4-1: Product: syz [ 2358.815088][ T5848] usb 4-1: Manufacturer: syz [ 2358.830637][ T5848] usb 4-1: SerialNumber: syz [ 2358.850198][ T5848] gspca_main: sonixj-2.14.0 probing 0c45:610a [ 2358.875334][ T1518] wg1: entered promiscuous mode [ 2358.893973][ T1518] wg1: entered allmulticast mode [ 2359.202218][ T1502] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 2359.237830][ T24] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 2359.415804][T26921] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 2359.442633][ T24] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 2359.463365][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2359.484983][ T24] usb 1-1: config 0 has no interface number 0 [ 2359.492676][ T24] usb 1-1: config 0 interface 251 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2359.532728][T26921] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2359.554446][T26921] em28xx 3-1:0.0: board has no eeprom [ 2359.576946][ T24] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2359.591841][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2359.603698][ T24] usb 1-1: Product: syz [ 2359.607891][ T24] usb 1-1: Manufacturer: syz [ 2359.614205][ T24] usb 1-1: SerialNumber: syz [ 2359.670587][T26921] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2359.734426][T26921] em28xx 3-1:0.0: dvb set to bulk mode. [ 2359.751459][ T5853] em28xx 3-1:0.0: Binding DVB extension [ 2359.767039][T26921] usb 3-1: USB disconnect, device number 110 [ 2359.775811][T26921] em28xx 3-1:0.0: Disconnecting em28xx [ 2359.787561][ T5848] gspca_sonixj: reg_r err -32 [ 2359.788521][ T24] usb 1-1: config 0 descriptor?? [ 2359.792338][ T30] kauditd_printk_skb: 417 callbacks suppressed [ 2359.792354][ T30] audit: type=1400 audit(2000000095.242:166217): avc: denied { ioctl } for pid=1499 comm="syz.3.6853" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2359.838189][ T5848] sonixj 4-1:58.43: probe with driver sonixj failed with error -32 [ 2359.911371][ T24] asix 1-1:0.251: probe with driver asix failed with error -22 [ 2359.998766][ T30] audit: type=1400 audit(2000000095.242:166218): avc: denied { ioctl } for pid=1499 comm="syz.3.6853" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x550c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2360.014728][ T5853] em28xx 3-1:0.0: Registering input extension [ 2360.043971][ T1536] netlink: 'syz.2.6861': attribute type 4 has an invalid length. [ 2360.103859][T26921] em28xx 3-1:0.0: Closing input extension [ 2360.128302][ T30] audit: type=1400 audit(2000000095.298:166219): avc: denied { create } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2360.170116][T26921] em28xx 3-1:0.0: Freeing device [ 2360.224309][ T30] audit: type=1400 audit(2000000095.326:166220): avc: denied { read } for pid=1525 comm="syz.2.6861" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 2360.586356][ T1542] IPv6: NLM_F_CREATE should be specified when creating new route [ 2360.602195][ T1542] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=1542 comm=syz.4.6863 [ 2360.614975][ T1542] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1024 sclass=netlink_route_socket pid=1542 comm=syz.4.6863 [ 2360.627733][ T1542] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1542 comm=syz.4.6863 [ 2360.700899][ T30] audit: type=1400 audit(2000000095.326:166221): avc: denied { read open } for pid=1525 comm="syz.2.6861" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 2360.736052][T16616] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2360.746661][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2360.772174][ T30] audit: type=1400 audit(2000000095.335:166222): avc: denied { create } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2360.809443][ T30] audit: type=1400 audit(2000000095.335:166223): avc: denied { create } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2360.848834][ T30] audit: type=1400 audit(2000000095.335:166224): avc: denied { write } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2360.869515][ C1] vkms_vblank_simulate: vblank timer overrun [ 2360.888326][ T30] audit: type=1400 audit(2000000095.335:166225): avc: denied { write } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2360.925992][ T30] audit: type=1400 audit(2000000095.354:166226): avc: denied { write } for pid=1525 comm="syz.2.6861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2361.155044][ T1514] bond0: entered promiscuous mode [ 2361.160116][ T1514] bond_slave_0: entered promiscuous mode [ 2361.183564][ T1514] bond_slave_1: entered promiscuous mode [ 2361.191121][ T1514] dummy0: entered promiscuous mode [ 2361.205883][ T1514] hsr1: entered promiscuous mode [ 2361.211726][ T1514] hsr1: entered allmulticast mode [ 2361.218352][ T1514] bond0: entered allmulticast mode [ 2361.235796][ T1514] bond_slave_0: entered allmulticast mode [ 2361.254269][ T1514] bond_slave_1: entered allmulticast mode [ 2361.263699][ T1514] dummy0: entered allmulticast mode [ 2361.366576][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2361.375018][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2361.670707][T26921] usb 4-1: USB disconnect, device number 104 [ 2361.847332][ T5853] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 2362.018346][ T5853] usb 5-1: Using ep0 maxpacket: 8 [ 2362.061318][ T5853] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2362.109325][ T5853] usb 5-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 2362.138100][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2362.162825][ T1564] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2362.194374][ T1568] overlay: Unknown parameter 'smackfsroot' [ 2362.321934][ T5853] usb 5-1: Product: syz [ 2362.326141][ T5853] usb 5-1: Manufacturer: syz [ 2362.331614][ T5853] usb 5-1: SerialNumber: syz [ 2362.392466][ T1572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2362.416839][ T5853] usb 5-1: config 0 descriptor?? [ 2362.461285][ T5853] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 2362.541357][ T24] usb 1-1: USB disconnect, device number 41 [ 2362.572643][ T5853] usb 5-1: selecting invalid altsetting 1 [ 2362.744120][T26921] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 2363.029241][ T5853] gspca_stk014: init reg: 0x00 [ 2363.035110][ T5853] stk014 5-1:0.0: probe with driver stk014 failed with error -5 [ 2363.090735][T26921] usb 2-1: device descriptor read/64, error -71 [ 2363.246890][ T5848] usb 5-1: USB disconnect, device number 3 [ 2363.374985][T26921] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 2363.418568][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2363.426727][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2363.435413][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2363.524637][T26921] usb 2-1: device descriptor read/64, error -71 [ 2363.642815][T26921] usb usb2-port1: attempt power cycle [ 2363.665643][T32194] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 2364.234150][T32194] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 2364.256773][T32194] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2364.296647][T32194] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 2364.321087][T32194] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 2364.347204][T32194] usb 3-1: Manufacturer: syz [ 2364.364333][T32194] usb 3-1: config 0 descriptor?? [ 2364.422943][T26921] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 2364.574636][T26921] usb 2-1: device descriptor read/8, error -71 [ 2364.616815][ T1600] fuse: blksize only supported for fuseblk [ 2364.626543][ T1587] mac80211_hwsim hwsim40 wlan0: entered promiscuous mode [ 2364.673660][ T1587] macsec1: entered promiscuous mode [ 2364.690761][ T1587] macsec1: entered allmulticast mode [ 2364.701311][ T1587] mac80211_hwsim hwsim40 wlan0: entered allmulticast mode [ 2364.743194][T32194] rc_core: IR keymap rc-hauppauge not found [ 2364.749195][T32194] Registered IR keymap rc-empty [ 2364.754903][T32194] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 2364.767054][T32194] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input131 [ 2364.790397][ C0] igorplugusb 3-1:0.0: Error: urb status = -32 [ 2364.792082][ T5853] usb 3-1: USB disconnect, device number 111 [ 2364.796584][ C0] igorplugusb 3-1:0.0: submit urb failed: -19 [ 2364.828874][T26921] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 2364.853790][T26921] usb 2-1: device descriptor read/8, error -71 [ 2364.866632][ T1607] netlink: 'syz.4.6883': attribute type 10 has an invalid length. [ 2364.877445][ T1607] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 2364.945932][ T5848] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 2364.946325][T32195] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 2364.978912][T26921] usb usb2-port1: unable to enumerate USB device [ 2365.140755][ T30] kauditd_printk_skb: 524 callbacks suppressed [ 2365.140772][ T30] audit: type=1400 audit(2000000100.237:166749): avc: denied { ioctl } for pid=1602 comm="syz.0.6882" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.175205][T32195] usb 1-1: config 1 has an invalid interface descriptor of length 8, skipping [ 2365.181419][ T30] audit: type=1400 audit(2000000100.284:166750): avc: denied { ioctl } for pid=1602 comm="syz.0.6882" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.192934][T32195] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2365.217220][ T30] audit: type=1400 audit(2000000100.302:166751): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.223592][T32195] usb 1-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 2365.246189][ T30] audit: type=1400 audit(2000000100.331:166752): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.261873][T32195] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 2365.301750][ T30] audit: type=1400 audit(2000000100.331:166753): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.326848][ C1] vkms_vblank_simulate: vblank timer overrun [ 2365.353702][ T1614] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2365.395610][T32195] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2365.419222][T32195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2365.442283][T32195] usb 1-1: SerialNumber: syz [ 2365.457156][ T30] audit: type=1400 audit(2000000100.359:166754): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.494198][ T5848] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2365.523227][ T5848] usb 4-1: New USB device found, idVendor=046d, idProduct=c086, bcdDevice= 0.00 [ 2365.532295][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2365.542149][ T5848] usb 4-1: config 0 descriptor?? [ 2365.547444][ T30] audit: type=1400 audit(2000000100.359:166755): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.603334][T32195] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 2365.630012][T32195] cdc_acm 1-1:1.0: This needs exactly 3 endpoints [ 2365.636473][T32195] cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -22 [ 2365.652650][ T30] audit: type=1400 audit(2000000100.396:166756): avc: denied { ioctl } for pid=1601 comm="syz.3.6881" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2365.705036][ T30] audit: type=1400 audit(2000000100.443:166757): avc: denied { create } for pid=1611 comm="syz.4.6885" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2365.726704][ T30] audit: type=1400 audit(2000000100.443:166758): avc: denied { setopt } for pid=1611 comm="syz.4.6885" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2365.778313][ T1616] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2365.837149][T32194] usb 1-1: USB disconnect, device number 42 [ 2366.046426][ T1603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2366.121104][ T1603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2366.155884][ T150] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2366.166620][ T150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2366.306394][ T5848] usbhid 4-1:0.0: can't add hid device: -71 [ 2366.318442][ T5848] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2366.346667][ T5848] usb 4-1: USB disconnect, device number 105 [ 2366.411210][ T1627] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2367.664055][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2367.672985][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2368.278213][ T1642] ªªªªªª speed is unknown, defaulting to 1000 [ 2368.360158][ T1642] lo speed is unknown, defaulting to 1000 [ 2368.911823][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2368.991642][T32195] hid-generic 0000:0000:0000.0081: unknown main item tag 0x0 [ 2369.846626][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2369.855532][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2369.876928][T32195] hid-generic 0000:0000:0000.0081: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2370.332719][ T1666] netlink: 'syz.2.6899': attribute type 4 has an invalid length. [ 2370.339036][ T1668] netlink: 'syz.2.6899': attribute type 4 has an invalid length. [ 2370.496928][ T30] kauditd_printk_skb: 5725 callbacks suppressed [ 2370.496962][ T30] audit: type=1400 audit(2000000105.251:167690): avc: denied { create } for pid=1661 comm="syz.4.6900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2370.694924][ T30] audit: type=1400 audit(2000000105.260:167691): avc: denied { write } for pid=1617 comm="syz.1.6887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 2370.898854][ T30] audit: type=1400 audit(2000000105.260:167692): avc: denied { write } for pid=1617 comm="syz.1.6887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 2370.933110][ T30] audit: type=1400 audit(2000000105.260:167693): avc: denied { write } for pid=1617 comm="syz.1.6887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 2370.965228][ T1619] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2370.990999][ T1674] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2370.997982][ T1674] audit: audit_lost=13742 audit_rate_limit=0 audit_backlog_limit=64 [ 2371.005949][ T1674] audit: backlog limit exceeded [ 2371.045869][ T1619] audit: audit_lost=13743 audit_rate_limit=0 audit_backlog_limit=64 [ 2371.055549][ T1674] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2371.151419][ T1676] netlink: 'syz.0.6902': attribute type 1 has an invalid length. [ 2371.265870][ T1674] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2371.308824][ T1674] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2371.530494][ T1678] overlayfs: maximum fs stacking depth exceeded [ 2372.312302][T17012] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2372.323043][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2372.381743][ T1687] netlink: 'syz.0.6905': attribute type 2 has an invalid length. [ 2372.851292][ T1692] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2372.892456][ T1695] netlink: 'syz.3.6909': attribute type 12 has an invalid length. [ 2373.052059][ T1702] netlink: 'syz.2.6907': attribute type 1 has an invalid length. [ 2373.161576][ T5853] hid-generic 0000:0000:0000.0082: unknown main item tag 0x0 [ 2373.178352][ T5853] hid-generic 0000:0000:0000.0082: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2373.192923][ T1700] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 2374.008132][T32195] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 2374.021915][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2374.033144][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2374.215162][T32195] usb 4-1: Using ep0 maxpacket: 16 [ 2374.245041][T32195] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 2374.271206][T32195] usb 4-1: config 0 has no interface number 0 [ 2374.316861][T32195] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2374.331444][ T1715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2374.362406][T32195] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2374.389829][T32195] usb 4-1: Product: syz [ 2374.394019][T32195] usb 4-1: Manufacturer: syz [ 2374.410922][ T1715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2374.423345][T32195] usb 4-1: SerialNumber: syz [ 2374.451323][T32195] usb 4-1: config 0 descriptor?? [ 2374.472953][T32195] hub 4-1:0.132: bad descriptor, ignoring hub [ 2374.487941][T32195] hub 4-1:0.132: probe with driver hub failed with error -5 [ 2374.517640][T32195] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input132 [ 2374.578460][T32192] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 2374.768878][ T1730] netlink: 'syz.0.6918': attribute type 2 has an invalid length. [ 2374.845571][T32194] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 2374.889049][ T5848] usb 4-1: USB disconnect, device number 106 [ 2375.021735][T32194] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 2375.030751][T32194] usb 2-1: config 0 has no interface number 0 [ 2375.037344][T32194] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2375.049120][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.057352][T32194] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 2375.070949][T32194] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 2375.082283][T32194] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 2375.093662][T32194] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 2375.106930][T32194] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 2375.116453][T32194] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2375.126739][T32194] usb 2-1: config 0 descriptor?? [ 2375.145919][ T1725] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 2375.158878][T32194] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 2375.733198][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.741458][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.920603][ T30] kauditd_printk_skb: 5203 callbacks suppressed [ 2375.920619][ T30] audit: type=1400 audit(2000000110.330:168466): avc: denied { read } for pid=1723 comm="syz.1.6916" name="video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2377.773573][ T30] audit: type=1400 audit(2000000110.367:168467): avc: denied { read open } for pid=1723 comm="syz.1.6916" path="/dev/video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2377.805297][ T30] audit: type=1400 audit(2000000110.452:168468): avc: denied { read write } for pid=30855 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2377.806279][ T1756] bridge1: entered allmulticast mode [ 2377.831041][ T30] audit: type=1400 audit(2000000110.470:168469): avc: denied { read write open } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2377.862372][ T30] audit: type=1400 audit(2000000110.508:168470): avc: denied { ioctl } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2377.889922][ T30] audit: type=1400 audit(2000000110.704:168471): avc: denied { write } for pid=1750 comm="syz.3.6923" name="sg0" dev="devtmpfs" ino=773 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 2378.015642][ T5853] usb 2-1: USB disconnect, device number 46 [ 2378.032435][ T5853] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 2378.051204][ T30] audit: type=1400 audit(2000000110.770:168472): avc: denied { write open } for pid=1750 comm="syz.3.6923" path="/dev/sg0" dev="devtmpfs" ino=773 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 2378.187296][ T1762] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2378.193942][ T1762] audit: audit_lost=15221 audit_rate_limit=0 audit_backlog_limit=64 [ 2378.201972][ T1762] audit: backlog limit exceeded [ 2378.485380][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 2378.498730][T17012] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2378.509453][T17012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2378.534160][T26431] Bluetooth: Unexpected continuation frame (len 4) [ 2379.008724][ T1782] cgroup: Unknown subsys name 'cpuset' [ 2379.763309][T32194] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 2379.838273][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2379.846546][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2379.940099][T32194] usb 3-1: config 0 has an invalid interface number: 98 but max is 1 [ 2379.948348][T32194] usb 3-1: config 0 has no interface number 1 [ 2379.954458][T32194] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2380.019126][T32194] usb 3-1: New USB device found, idVendor=1943, idProduct=2255, bcdDevice=13.03 [ 2380.049875][T32194] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2380.067360][T32194] usb 3-1: Product: syz [ 2380.084984][T32194] usb 3-1: Manufacturer: syz [ 2380.097360][T32194] usb 3-1: SerialNumber: syz [ 2380.189726][T32194] usb 3-1: config 0 descriptor?? [ 2380.227493][T32194] s2255 3-1:0.98: Could not find bulk-in endpoint [ 2380.234199][T32194] Sensoray 2255 driver load failed: 0xfffffff4 [ 2380.240378][T32194] s2255 3-1:0.98: probe with driver s2255 failed with error -12 [ 2380.280699][T32194] s2255 3-1:0.0: Could not find bulk-in endpoint [ 2380.470380][ T1799] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6935'. [ 2381.053548][T32194] Sensoray 2255 driver load failed: 0xfffffff4 [ 2381.065991][T32194] s2255 3-1:0.0: probe with driver s2255 failed with error -12 [ 2381.183150][T32194] usb 3-1: USB disconnect, device number 112 [ 2381.207361][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2381.321545][ T30] kauditd_printk_skb: 311 callbacks suppressed [ 2381.321559][ T30] audit: type=1400 audit(2000000115.381:168742): avc: denied { read write } for pid=29074 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2381.352928][T26431] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 2381.363125][ T30] audit: type=1400 audit(2000000115.381:168743): avc: denied { create } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.386705][ T30] audit: type=1400 audit(2000000115.390:168744): avc: denied { write } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.409617][ T30] audit: type=1400 audit(2000000115.390:168745): avc: denied { read } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.430261][ T30] audit: type=1400 audit(2000000115.390:168746): avc: denied { read } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.451108][ T30] audit: type=1400 audit(2000000115.390:168747): avc: denied { create } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.472299][ T30] audit: type=1400 audit(2000000115.390:168748): avc: denied { write } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.536314][ T30] audit: type=1400 audit(2000000115.390:168749): avc: denied { read } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.600098][ T30] audit: type=1400 audit(2000000115.390:168750): avc: denied { read } for pid=1804 comm="syz.3.6937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2381.654088][ T30] audit: type=1400 audit(2000000115.390:168751): avc: denied { write } for pid=1804 comm="syz.3.6937" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 2381.684666][ T1810] netlink: 'syz.3.6940': attribute type 2 has an invalid length. [ 2381.891532][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2381.894097][ T1813] netlink: 'syz.0.6941': attribute type 6 has an invalid length. [ 2381.899841][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2382.095332][ T1821] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6943'. [ 2383.183860][ T1839] bond2 (unregistering): Released all slaves [ 2383.268005][ T1837] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2383.504814][T32194] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 2384.050031][T32194] usb 5-1: device descriptor read/64, error -71 [ 2384.306769][T32194] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 2384.526101][ T1848] /dev/nullb0: Can't open blockdev [ 2384.531394][T32194] usb 5-1: device descriptor read/64, error -71 [ 2384.634058][T16616] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2384.644833][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2384.659631][T32194] usb usb5-port1: attempt power cycle [ 2385.151258][T32194] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 2385.284347][T32194] usb 5-1: device descriptor read/8, error -71 [ 2385.996175][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2386.004484][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2386.259667][ T5848] hid-generic 0000:0000:0000.0083: unknown main item tag 0x0 [ 2386.374305][ T5848] hid-generic 0000:0000:0000.0083: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2386.539600][ T1884] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2386.779530][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2386.793902][ T30] kauditd_printk_skb: 480 callbacks suppressed [ 2386.793920][ T30] audit: type=1400 audit(2000000120.498:169232): avc: denied { ioctl } for pid=1875 comm="syz.0.6957" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2387.087369][ T30] audit: type=1400 audit(2000000120.498:169233): avc: denied { ioctl } for pid=1875 comm="syz.0.6957" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b89 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2387.366841][ T30] audit: type=1400 audit(2000000120.647:169234): avc: denied { map_create } for pid=1888 comm="syz.3.6959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2387.397125][ T30] audit: type=1400 audit(2000000120.647:169235): avc: denied { map_read map_write } for pid=1888 comm="syz.3.6959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2387.447530][ T30] audit: type=1400 audit(2000000120.657:169236): avc: denied { map_create } for pid=1888 comm="syz.3.6959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2387.482438][ T30] audit: type=1400 audit(2000000120.666:169237): avc: denied { map_read map_write } for pid=1888 comm="syz.3.6959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2387.503243][ T30] audit: type=1400 audit(2000000120.872:169238): avc: denied { mac_admin } for pid=1867 comm="syz.2.6954" capability=33 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2387.570064][ T1894] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6960'. [ 2387.589718][ T30] audit: type=1400 audit(2000000120.956:169239): avc: denied { read write } for pid=29074 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2387.727179][ T30] audit: type=1400 audit(2000000120.993:169240): avc: denied { read write open } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2387.809379][ T30] audit: type=1400 audit(2000000121.022:169241): avc: denied { ioctl } for pid=29074 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2387.895008][ T1906] netlink: 'syz.3.6963': attribute type 2 has an invalid length. [ 2387.932575][ T1910] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6962'. [ 2388.060034][T16616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2388.068230][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2388.312829][ T1916] ALSA: mixer_oss: invalid OSS volume '' [ 2388.435969][T26431] Bluetooth: hci3: unexpected event 0x08 length: 11 > 4 [ 2388.627681][ T1903] could not allocate digest TFM handle blake2s-160 [ 2388.930930][ T1920] overlay: ./file1 is not a directory [ 2389.758344][T32195] hid-generic 0000:0000:0000.0084: unknown main item tag 0x0 [ 2389.768860][T32195] hid-generic 0000:0000:0000.0084: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2390.394721][ T1934] serio: Serial port ptm0 [ 2390.587364][ T1944] can: request_module (can-proto-3) failed. [ 2390.615374][ T5134] Bluetooth: hci3: command 0x0406 tx timeout [ 2390.837765][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2390.848526][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2391.034776][ T1957] netlink: zone id is out of range [ 2391.039966][ T1957] netlink: zone id is out of range [ 2391.046527][ T1957] netlink: set zone limit has 8 unknown bytes [ 2392.147501][ T30] kauditd_printk_skb: 344 callbacks suppressed [ 2392.147518][ T30] audit: type=1400 audit(2000000125.511:169586): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2393.315377][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.323837][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.332771][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.341241][ T30] audit: type=1400 audit(2000000125.624:169587): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2393.362274][ T30] audit: type=1400 audit(2000000125.727:169588): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2393.382503][ T30] audit: type=1400 audit(2000000125.839:169589): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.386788][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2394.395179][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2394.489271][ T30] audit: type=1400 audit(2000000125.951:169590): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.629158][ T30] audit: type=1400 audit(2000000126.054:169591): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.663958][ T1967] netlink: 'syz.3.6977': attribute type 2 has an invalid length. [ 2394.666245][ T5853] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 2394.691366][ T30] audit: type=1400 audit(2000000126.166:169592): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.731961][ T30] audit: type=1400 audit(2000000126.269:169593): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.803732][ T30] audit: type=1400 audit(2000000126.381:169594): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.860313][ T30] audit: type=1400 audit(2000000126.494:169595): avc: denied { execmem } for pid=1958 comm="syz.2.6978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2394.912378][ T5853] usb 2-1: Using ep0 maxpacket: 16 [ 2394.928525][ T5853] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 2394.945262][ T5853] usb 2-1: config 0 has no interface number 0 [ 2394.975270][ T5853] usb 2-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2394.995837][ T5853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2395.019156][ T5853] usb 2-1: Product: syz [ 2395.023356][ T5853] usb 2-1: Manufacturer: syz [ 2395.027958][ T5853] usb 2-1: SerialNumber: syz [ 2395.042862][ T1971] netlink: 'syz.2.6979': attribute type 12 has an invalid length. [ 2395.053396][ T5853] usb 2-1: config 0 descriptor?? [ 2395.070115][ T5853] hub 2-1:0.132: bad descriptor, ignoring hub [ 2395.083864][ T5853] hub 2-1:0.132: probe with driver hub failed with error -5 [ 2395.102480][ T5853] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.132/input/input134 [ 2395.313009][ T1974] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6981'. [ 2395.313336][ T1975] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2395.493544][ T5853] usb 2-1: USB disconnect, device number 47 [ 2395.532195][ T5848] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 2395.562626][T26431] Bluetooth: hci0: unexpected event for opcode 0x0c6d [ 2395.597891][ T1980] FAULT_INJECTION: forcing a failure. [ 2395.597891][ T1980] name failslab, interval 1, probability 0, space 0, times 0 [ 2395.613186][ T1980] CPU: 1 UID: 0 PID: 1980 Comm: syz.4.6983 Not tainted syzkaller #0 PREEMPT(full) [ 2395.613213][ T1980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2395.613224][ T1980] Call Trace: [ 2395.613230][ T1980] [ 2395.613238][ T1980] dump_stack_lvl+0x16c/0x1f0 [ 2395.613261][ T1980] should_fail_ex+0x512/0x640 [ 2395.613282][ T1980] ? __kmalloc_cache_noprof+0x5f/0x780 [ 2395.613309][ T1980] should_failslab+0xc2/0x120 [ 2395.613331][ T1980] __kmalloc_cache_noprof+0x72/0x780 [ 2395.613359][ T1980] ? alloc_super+0x52/0xb60 [ 2395.613380][ T1980] ? alloc_super+0x52/0xb60 [ 2395.613395][ T1980] ? __pfx_super_s_dev_test+0x10/0x10 [ 2395.613418][ T1980] alloc_super+0x52/0xb60 [ 2395.613432][ T1980] ? sget_fc+0xd3/0xc20 [ 2395.613450][ T1980] ? __pfx_super_s_dev_test+0x10/0x10 [ 2395.613473][ T1980] sget_fc+0x116/0xc20 [ 2395.613490][ T1980] ? __pfx_super_s_dev_set+0x10/0x10 [ 2395.613516][ T1980] get_tree_bdev_flags+0x1ba/0x620 [ 2395.613532][ T1980] ? __pfx_bfs_fill_super+0x10/0x10 [ 2395.613551][ T1980] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 2395.613571][ T1980] ? bpf_lsm_capable+0x9/0x10 [ 2395.613591][ T1980] ? security_capable+0x7e/0x260 [ 2395.613618][ T1980] vfs_get_tree+0x8e/0x340 [ 2395.613640][ T1980] path_mount+0x7b9/0x23a0 [ 2395.613665][ T1980] ? __pfx_path_mount+0x10/0x10 [ 2395.613688][ T1980] ? putname+0x154/0x1a0 [ 2395.613713][ T1980] ? putname+0x154/0x1a0 [ 2395.613731][ T1980] ? putname+0x154/0x1a0 [ 2395.613754][ T1980] ? __x64_sys_mount+0x293/0x310 [ 2395.613774][ T1980] __x64_sys_mount+0x293/0x310 [ 2395.613795][ T1980] ? __pfx___x64_sys_mount+0x10/0x10 [ 2395.613824][ T1980] do_syscall_64+0xcd/0xfa0 [ 2395.613843][ T1980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2395.613860][ T1980] RIP: 0033:0x7f224918f749 [ 2395.613882][ T1980] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2395.613898][ T1980] RSP: 002b:00007f2249fd0038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2395.613915][ T1980] RAX: ffffffffffffffda RBX: 00007f22493e5fa0 RCX: 00007f224918f749 [ 2395.613926][ T1980] RDX: 0000200000000180 RSI: 0000200000000040 RDI: 0000200000000140 [ 2395.613937][ T1980] RBP: 00007f2249fd0090 R08: 0000000000000000 R09: 0000000000000000 [ 2395.613946][ T1980] R10: 0000000002208004 R11: 0000000000000246 R12: 0000000000000002 [ 2395.613956][ T1980] R13: 00007f22493e6038 R14: 00007f22493e5fa0 R15: 00007ffc61928d98 [ 2395.613981][ T1980] [ 2395.873896][ T5848] usb 3-1: Using ep0 maxpacket: 16 [ 2395.893463][ T5848] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 2395.901929][ T5848] usb 3-1: config 0 has no interface number 0 [ 2395.982807][ T5848] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2395.995056][ T5848] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2396.011936][ T5848] usb 3-1: Product: syz [ 2396.025937][ T5848] usb 3-1: Manufacturer: syz [ 2396.031511][ T5848] usb 3-1: SerialNumber: syz [ 2396.034922][ T1984] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 2396.040073][ T5848] usb 3-1: config 0 descriptor?? [ 2396.042691][ T1984] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 2396.043516][ T1984] vhci_hcd vhci_hcd.0: Device attached [ 2396.061144][ T5848] hub 3-1:0.132: bad descriptor, ignoring hub [ 2396.071068][ T1986] vhci_hcd: cannot find the pending unlink 4294967287 [ 2396.083515][ T1986] vhci_hcd: connection closed [ 2396.085018][ T9435] vhci_hcd: stop threads [ 2396.096415][ T5848] hub 3-1:0.132: probe with driver hub failed with error -5 [ 2396.121440][ T9435] vhci_hcd: release socket [ 2396.125947][ T9435] vhci_hcd: disconnect device [ 2396.149259][ T5848] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input135 [ 2396.414023][ T1992] bridge2: entered promiscuous mode [ 2396.419914][ T1992] bridge2: entered allmulticast mode [ 2396.723574][ T5853] hid-generic 0000:0000:0000.0085: unknown main item tag 0x0 [ 2396.751791][ T5853] hid-generic 0000:0000:0000.0085: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2396.781042][ T1994] netlink: 'syz.1.6988': attribute type 2 has an invalid length. [ 2396.836038][ T1994] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6988'. [ 2396.863620][ T1994] netlink: 'syz.1.6988': attribute type 1 has an invalid length. [ 2396.872384][T32194] usb 3-1: USB disconnect, device number 113 [ 2396.879534][T32195] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 2396.905276][ T1994] bond8: entered promiscuous mode [ 2396.911977][ T1994] 8021q: adding VLAN 0 to HW filter on device bond8 [ 2396.968788][ T1994] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1994 comm=syz.1.6988 [ 2397.025551][ T1994] 8021q: adding VLAN 0 to HW filter on device bond8 [ 2397.042102][ T1994] bond8: (slave wireguard4): The slave device specified does not support setting the MAC address [ 2397.054677][ T1994] bond8: (slave wireguard4): Setting fail_over_mac to active for active-backup mode [ 2397.069895][ T1996] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2397.072693][T32195] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x21, changing to 0x1 [ 2397.080012][ T1996] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2397.095963][T32195] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 197, setting to 64 [ 2397.116645][T32195] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2397.125167][ T1994] bond8: (slave wireguard4): making interface the new active one [ 2397.136417][T32195] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2397.147989][T32195] usb 5-1: config 0 descriptor?? [ 2397.186579][ T1994] wireguard4: entered promiscuous mode [ 2397.194626][ T1994] bond8: (slave wireguard4): Enslaving as an active interface with an up link [ 2397.506684][ T30] kauditd_printk_skb: 439 callbacks suppressed [ 2397.506714][ T30] audit: type=1400 audit(2000000130.516:170035): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.551948][ T30] audit: type=1400 audit(2000000130.553:170036): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.572827][ T30] audit: type=1400 audit(2000000130.553:170037): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.596343][ T30] audit: type=1400 audit(2000000130.563:170038): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.636962][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2397.647845][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2397.669220][ T30] audit: type=1400 audit(2000000130.563:170039): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.690362][ T30] audit: type=1400 audit(2000000130.563:170040): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.741575][ T30] audit: type=1400 audit(2000000130.563:170041): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.769993][ T30] audit: type=1400 audit(2000000130.563:170042): avc: denied { write } for pid=1990 comm="syz.3.6987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2397.921031][ T30] audit: type=1400 audit(2000000130.563:170043): avc: denied { read write } for pid=30855 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2398.031044][ T30] audit: type=1400 audit(2000000130.563:170044): avc: denied { read write open } for pid=30855 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2398.057359][ T5853] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 2398.133958][ T2013] bridge1: entered promiscuous mode [ 2398.317413][T32195] ath6kl: Failed to submit usb control message: -110 [ 2398.334308][ T5853] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2398.349381][ T5853] usb 1-1: can't read configurations, error -61 [ 2398.357725][T32195] ath6kl: unable to send the bmi data to the device: -110 [ 2398.383250][T32195] ath6kl: Unable to send get target info: -110 [ 2398.424903][T32195] ath6kl: Failed to init ath6kl core: -110 [ 2398.483985][T32195] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 2398.515163][ T5853] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 2398.714166][ T5853] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2398.723360][ T5853] usb 1-1: can't read configurations, error -61 [ 2398.732330][ T5853] usb usb1-port1: attempt power cycle [ 2398.902873][ T2023] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2398.998839][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2399.007138][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2399.103125][ T5853] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 2399.137987][ T5853] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2399.146137][ T5853] usb 1-1: can't read configurations, error -61 [ 2399.289355][T32195] usb 5-1: USB disconnect, device number 9 [ 2399.361095][ T5853] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 2399.432581][ T5853] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2399.457405][ T5853] usb 1-1: can't read configurations, error -61 [ 2399.468343][ T5853] usb usb1-port1: unable to enumerate USB device [ 2399.475239][ T2036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2399.485302][ T2036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2399.797442][T32195] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 2399.986520][ T2038] netlink: 'syz.3.7002': attribute type 10 has an invalid length. [ 2399.996158][ T2038] netlink: 55 bytes leftover after parsing attributes in process `syz.3.7002'. [ 2400.131522][T32195] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 2400.162731][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.204387][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.218762][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.235022][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.245577][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.258045][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.271471][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.282251][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.294128][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.306369][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.326517][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.338477][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.338734][ T2049] netlink: 'syz.3.7005': attribute type 3 has an invalid length. [ 2400.352865][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.362662][ T2049] netlink: 'syz.3.7005': attribute type 3 has an invalid length. [ 2400.366456][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.377113][ T2050] comedi comedi0: fl512: I/O port conflict (0x3,16) [ 2400.383049][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.388825][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2400.388976][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2400.390044][T30772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2400.438055][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.460517][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.482530][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.513072][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.531263][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.549995][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.596836][T32195] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2400.644224][T32195] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2400.656973][T32195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2400.985248][T32195] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2401.005883][T32195] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2401.014257][T32195] usb 5-1: Product: syz [ 2401.044465][T32195] usb 5-1: Manufacturer: syz [ 2401.050412][T32195] usb 5-1: SerialNumber: syz [ 2401.060045][T32195] usb 5-1: config 0 descriptor?? [ 2401.077677][T32195] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 2401.214098][ T2062] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2401.322069][ T5848] usb 5-1: USB disconnect, device number 10 [ 2401.330873][ T5848] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 2402.769228][T32194] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 2402.866786][ T30] kauditd_printk_skb: 439 callbacks suppressed [ 2402.866797][ T30] audit: type=1400 audit(2000000135.539:170484): avc: denied { ioctl } for pid=2077 comm="syz.4.7012" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2402.987851][T32194] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2403.001228][ T30] audit: type=1400 audit(2000000135.595:170485): avc: denied { allowed } for pid=2084 comm="syz.0.7014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 2403.023706][T32194] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 2403.043513][T32194] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 2403.055473][ T30] audit: type=1400 audit(2000000135.595:170486): avc: denied { create } for pid=2084 comm="syz.0.7014" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2403.078148][ T2089] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7015'. [ 2403.087688][T32194] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 2403.097680][T32194] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2403.110890][ T2089] netlink: 17 bytes leftover after parsing attributes in process `syz.2.7015'. [ 2403.111794][ T30] audit: type=1400 audit(2000000135.595:170487): avc: denied { map } for pid=2084 comm="syz.0.7014" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=136081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2403.157754][ T30] audit: type=1400 audit(2000000135.595:170488): avc: denied { read write } for pid=2084 comm="syz.0.7014" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=136081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2403.191887][ T30] audit: type=1400 audit(2000000135.595:170489): avc: denied { map } for pid=2084 comm="syz.0.7014" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=136081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2403.216665][T32194] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 2403.226517][T32194] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 2403.235335][T32194] usb 5-1: Product: syz [ 2403.239571][T32194] usb 5-1: Manufacturer: syz [ 2403.244200][T32194] usb 5-1: SerialNumber: syz [ 2403.251831][T32194] usb 5-1: config 0 descriptor?? [ 2403.259982][ T2089] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7015'. [ 2403.269390][ T30] audit: type=1400 audit(2000000135.595:170490): avc: denied { read write } for pid=2084 comm="syz.0.7014" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=136081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2403.312241][ T30] audit: type=1400 audit(2000000135.633:170491): avc: denied { create } for pid=2084 comm="syz.0.7014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2403.339493][ T30] audit: type=1400 audit(2000000135.633:170492): avc: denied { read write } for pid=2084 comm="syz.0.7014" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2403.365441][ T30] audit: type=1400 audit(2000000135.633:170493): avc: denied { ioctl open } for pid=2084 comm="syz.0.7014" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2403.556634][T32194] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 2403.563970][T32194] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 2403.779757][T32194] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 2403.788181][T30942] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 2403.798875][T30942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2403.810603][T32194] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 2403.836353][T32194] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 2403.894829][ T2104] overlayfs: failed to resolve './bus': -2 [ 2403.996880][T32194] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 2404.171508][ T2111] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2404.458425][ T5848] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 2404.559792][T26431] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 2404.570907][T26431] CPU: 0 UID: 0 PID: 26431 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 2404.570939][T26431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2404.570953][T26431] Workqueue: hci0 hci_rx_work [ 2404.570976][T26431] Call Trace: [ 2404.570990][T26431] [ 2404.571001][T26431] dump_stack_lvl+0x16c/0x1f0 [ 2404.571023][T26431] sysfs_warn_dup+0x7f/0xa0 [ 2404.571050][T26431] sysfs_create_dir_ns+0x24b/0x2b0 [ 2404.571076][T26431] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2404.571101][T26431] ? find_held_lock+0x2b/0x80 [ 2404.571126][T26431] ? do_raw_spin_unlock+0x172/0x230 [ 2404.571146][T26431] kobject_add_internal+0x2c4/0x9b0 [ 2404.571168][T26431] kobject_add+0x16e/0x240 [ 2404.571186][T26431] ? __pfx_kobject_add+0x10/0x10 [ 2404.571209][T26431] ? kobject_put+0xab/0x5a0 [ 2404.571232][T26431] device_add+0x288/0x1aa0 [ 2404.571254][T26431] ? __pfx_dev_set_name+0x10/0x10 [ 2404.571279][T26431] ? __pfx_device_add+0x10/0x10 [ 2404.571302][T26431] ? mgmt_send_event_skb+0x2fb/0x460 [ 2404.571336][T26431] hci_conn_add_sysfs+0x17e/0x230 [ 2404.571356][T26431] le_conn_complete_evt+0x1260/0x2150 [ 2404.571389][T26431] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2404.571415][T26431] ? hci_event_packet+0x459/0x11c0 [ 2404.571449][T26431] hci_le_conn_complete_evt+0x23c/0x370 [ 2404.571482][T26431] hci_le_meta_evt+0x357/0x5e0 [ 2404.571499][T26431] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 2404.571530][T26431] hci_event_packet+0x685/0x11c0 [ 2404.571556][T26431] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2404.571575][T26431] ? __pfx_hci_event_packet+0x10/0x10 [ 2404.571606][T26431] ? kcov_remote_start+0x3d9/0x6d0 [ 2404.571636][T26431] hci_rx_work+0x2c5/0x16b0 [ 2404.571661][T26431] process_one_work+0x9cf/0x1b70 [ 2404.571691][T26431] ? __pfx_process_one_work+0x10/0x10 [ 2404.571720][T26431] ? assign_work+0x1a0/0x250 [ 2404.571739][T26431] worker_thread+0x6c8/0xf10 [ 2404.571771][T26431] ? __pfx_worker_thread+0x10/0x10 [ 2404.571791][T26431] kthread+0x3c5/0x780 [ 2404.571811][T26431] ? __pfx_kthread+0x10/0x10 [ 2404.571831][T26431] ? rcu_is_watching+0x12/0xc0 [ 2404.571855][T26431] ? __pfx_kthread+0x10/0x10 [ 2404.571874][T26431] ret_from_fork+0x675/0x7d0 [ 2404.571892][T26431] ? __pfx_kthread+0x10/0x10 [ 2404.571910][T26431] ret_from_fork_asm+0x1a/0x30 [ 2404.571950][T26431] [ 2404.574781][T26431] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2404.840917][T26431] Bluetooth: hci0: failed to register connection device [ 2405.126492][T32194] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 2405.138921][T26431] ================================================================== [ 2405.146981][T26431] BUG: KASAN: slab-use-after-free in l2cap_sock_new_connection_cb+0x221/0x240 [ 2405.155830][T26431] Read of size 8 at addr ffff8880407275a0 by task kworker/u9:2/26431 [ 2405.163895][T26431] [ 2405.166217][T26431] CPU: 0 UID: 0 PID: 26431 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 2405.166234][T26431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2405.166244][T26431] Workqueue: hci0 hci_rx_work [ 2405.166260][T26431] Call Trace: [ 2405.166265][T26431] [ 2405.166270][T26431] dump_stack_lvl+0x116/0x1f0 [ 2405.166283][T26431] print_report+0xcd/0x630 [ 2405.166300][T26431] ? __virt_addr_valid+0x81/0x610 [ 2405.166317][T26431] ? __phys_addr+0xe8/0x180 [ 2405.166332][T26431] ? l2cap_sock_new_connection_cb+0x221/0x240 [ 2405.166343][T26431] kasan_report+0xe0/0x110 [ 2405.166356][T26431] ? l2cap_sock_new_connection_cb+0x221/0x240 [ 2405.166370][T26431] l2cap_sock_new_connection_cb+0x221/0x240 [ 2405.166383][T26431] l2cap_connect_cfm+0x4c7/0xf80 [ 2405.166401][T26431] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2405.166419][T26431] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2405.166435][T26431] le_conn_complete_evt+0x1ba6/0x2150 [ 2405.166457][T26431] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2405.166473][T26431] ? hci_event_packet+0x459/0x11c0 [ 2405.166489][T26431] hci_le_conn_complete_evt+0x23c/0x370 [ 2405.166506][T26431] hci_le_meta_evt+0x357/0x5e0 [ 2405.166516][T26431] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 2405.166532][T26431] hci_event_packet+0x685/0x11c0 [ 2405.166546][T26431] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2405.166556][T26431] ? __pfx_hci_event_packet+0x10/0x10 [ 2405.166573][T26431] ? kcov_remote_start+0x3d9/0x6d0 [ 2405.166589][T26431] hci_rx_work+0x2c5/0x16b0 [ 2405.166600][T26431] process_one_work+0x9cf/0x1b70 [ 2405.166615][T26431] ? __pfx_process_one_work+0x10/0x10 [ 2405.166628][T26431] ? assign_work+0x1a0/0x250 [ 2405.166639][T26431] worker_thread+0x6c8/0xf10 [ 2405.166653][T26431] ? __pfx_worker_thread+0x10/0x10 [ 2405.166664][T26431] kthread+0x3c5/0x780 [ 2405.166675][T26431] ? __pfx_kthread+0x10/0x10 [ 2405.166685][T26431] ? rcu_is_watching+0x12/0xc0 [ 2405.166699][T26431] ? __pfx_kthread+0x10/0x10 [ 2405.166709][T26431] ret_from_fork+0x675/0x7d0 [ 2405.166719][T26431] ? __pfx_kthread+0x10/0x10 [ 2405.166728][T26431] ret_from_fork_asm+0x1a/0x30 [ 2405.166747][T26431] [ 2405.166751][T26431] [ 2405.372471][T26431] Allocated by task 26431: [ 2405.376854][T26431] kasan_save_stack+0x33/0x60 [ 2405.381504][T26431] kasan_save_track+0x14/0x30 [ 2405.386158][T26431] __kasan_kmalloc+0xaa/0xb0 [ 2405.390717][T26431] __kmalloc_noprof+0x32f/0x880 [ 2405.395541][T26431] sk_prot_alloc+0x1a8/0x2a0 [ 2405.400098][T26431] sk_alloc+0x36/0xc20 [ 2405.404146][T26431] bt_sock_alloc+0x3b/0x3a0 [ 2405.408637][T26431] l2cap_sock_alloc.constprop.0+0x33/0x1d0 [ 2405.414466][T26431] l2cap_sock_new_connection_cb+0x101/0x240 [ 2405.420347][T26431] l2cap_connect_cfm+0x4c7/0xf80 [ 2405.425284][T26431] le_conn_complete_evt+0x1ba6/0x2150 [ 2405.430637][T26431] hci_le_conn_complete_evt+0x23c/0x370 [ 2405.436162][T26431] hci_le_meta_evt+0x357/0x5e0 [ 2405.440896][T26431] hci_event_packet+0x685/0x11c0 [ 2405.445805][T26431] hci_rx_work+0x2c5/0x16b0 [ 2405.450274][T26431] process_one_work+0x9cf/0x1b70 [ 2405.455179][T26431] worker_thread+0x6c8/0xf10 [ 2405.459791][T26431] kthread+0x3c5/0x780 [ 2405.464087][T26431] ret_from_fork+0x675/0x7d0 [ 2405.468651][T26431] ret_from_fork_asm+0x1a/0x30 [ 2405.473498][T26431] [ 2405.475800][T26431] Freed by task 2117: [ 2405.479747][T26431] kasan_save_stack+0x33/0x60 [ 2405.484400][T26431] kasan_save_track+0x14/0x30 [ 2405.489045][T26431] __kasan_save_free_info+0x3b/0x60 [ 2405.494222][T26431] __kasan_slab_free+0x5f/0x80 [ 2405.498974][T26431] kfree+0x2b8/0x6d0 [ 2405.502842][T26431] __sk_destruct+0x75f/0x9a0 [ 2405.507402][T26431] sk_destruct+0xc2/0xf0 [ 2405.511618][T26431] __sk_free+0xf4/0x3e0 [ 2405.515751][T26431] sk_free+0x6a/0x90 [ 2405.519636][T26431] l2cap_sock_kill+0x171/0x2d0 [ 2405.524376][T26431] l2cap_sock_cleanup_listen+0x3d/0x2a0 [ 2405.529894][T26431] l2cap_sock_release+0x69/0x250 [ 2405.534815][T26431] __sock_release+0xb3/0x270 [ 2405.539391][T26431] sock_close+0x1c/0x30 [ 2405.543534][T26431] __fput+0x402/0xb70 [ 2405.547494][T26431] task_work_run+0x150/0x240 [ 2405.552054][T26431] get_signal+0x1d0/0x26d0 [ 2405.556444][T26431] arch_do_signal_or_restart+0x8f/0x7c0 [ 2405.561977][T26431] exit_to_user_mode_loop+0x85/0x130 [ 2405.567234][T26431] do_syscall_64+0x426/0xfa0 [ 2405.571815][T26431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2405.577679][T26431] [ 2405.579991][T26431] The buggy address belongs to the object at ffff888040727000 [ 2405.579991][T26431] which belongs to the cache kmalloc-2k of size 2048 [ 2405.594017][T26431] The buggy address is located 1440 bytes inside of [ 2405.594017][T26431] freed 2048-byte region [ffff888040727000, ffff888040727800) [ 2405.608100][T26431] [ 2405.610400][T26431] The buggy address belongs to the physical page: [ 2405.616776][T26431] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40720 [ 2405.625507][T26431] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2405.633976][T26431] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 2405.641923][T26431] page_type: f5(slab) [ 2405.645875][T26431] raw: 00fff00000000040 ffff88813ffa7000 0000000000000000 0000000000000001 [ 2405.654435][T26431] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 2405.662996][T26431] head: 00fff00000000040 ffff88813ffa7000 0000000000000000 0000000000000001 [ 2405.671647][T26431] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 2405.680291][T26431] head: 00fff00000000003 ffffea000101c801 00000000ffffffff 00000000ffffffff [ 2405.688935][T26431] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 2405.697572][T26431] page dumped because: kasan: bad access detected [ 2405.703967][T26431] page_owner tracks the page as allocated [ 2405.709651][T26431] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1619, tgid 1617 (syz.1.6887), ts 2372580911337, free_ts 2372479438858 [ 2405.732024][T26431] post_alloc_hook+0x1af/0x220 [ 2405.736790][T26431] get_page_from_freelist+0x10a3/0x3a30 [ 2405.742308][T26431] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 2405.748182][T26431] alloc_pages_mpol+0x1fb/0x550 [ 2405.753003][T26431] new_slab+0x24a/0x360 [ 2405.757129][T26431] ___slab_alloc+0xd79/0x1a50 [ 2405.761775][T26431] __slab_alloc.constprop.0+0x63/0x110 [ 2405.767209][T26431] __kmalloc_node_track_caller_noprof+0x4db/0x8a0 [ 2405.773592][T26431] kmalloc_reserve+0xef/0x2c0 [ 2405.778241][T26431] __alloc_skb+0x166/0x380 [ 2405.782716][T26431] audit_log_start+0x34e/0x950 [ 2405.787461][T26431] common_lsm_audit+0xb2/0x300 [ 2405.792204][T26431] slow_avc_audit+0x186/0x210 [ 2405.796868][T26431] avc_has_perm+0x1b5/0x1f0 [ 2405.801362][T26431] sock_has_perm+0x252/0x2f0 [ 2405.805932][T26431] security_socket_sendmsg+0x9b/0x240 [ 2405.811274][T26431] page last free pid 31186 tgid 31186 stack trace: [ 2405.817737][T26431] __free_frozen_pages+0x7df/0x1160 [ 2405.822924][T26431] __put_partials+0x130/0x170 [ 2405.827572][T26431] qlist_free_all+0x4d/0x120 [ 2405.832130][T26431] kasan_quarantine_reduce+0x195/0x1e0 [ 2405.837573][T26431] __kasan_slab_alloc+0x69/0x90 [ 2405.842427][T26431] kmem_cache_alloc_noprof+0x250/0x6e0 [ 2405.847870][T26431] getname_flags.part.0+0x4c/0x550 [ 2405.853054][T26431] getname_flags+0x93/0xf0 [ 2405.857455][T26431] user_path_at+0x24/0x60 [ 2405.861775][T26431] __x64_sys_umount+0x10a/0x1a0 [ 2405.866609][T26431] do_syscall_64+0xcd/0xfa0 [ 2405.871082][T26431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2405.876957][T26431] [ 2405.879251][T26431] Memory state around the buggy address: [ 2405.884849][T26431] ffff888040727480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2405.892880][T26431] ffff888040727500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2405.900924][T26431] >ffff888040727580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2405.909051][T26431] ^ [ 2405.914148][T26431] ffff888040727600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2405.922186][T26431] ffff888040727680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2405.930221][T26431] ================================================================== [ 2405.939381][T32194] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 2405.955917][ T9435] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2405.964137][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2405.974156][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2405.987446][T26431] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2405.994755][T26431] CPU: 0 UID: 0 PID: 26431 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 2406.004309][T26431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2406.014471][T26431] Workqueue: hci0 hci_rx_work [ 2406.019158][T26431] Call Trace: [ 2406.022434][T26431] [ 2406.025364][T26431] dump_stack_lvl+0x3d/0x1f0 [ 2406.029952][T26431] vpanic+0x640/0x6f0 [ 2406.033943][T26431] panic+0xca/0xd0 [ 2406.037674][T26431] ? __pfx_panic+0x10/0x10 [ 2406.042091][T26431] ? l2cap_sock_new_connection_cb+0x221/0x240 [ 2406.048153][T26431] ? preempt_schedule_common+0x44/0xc0 [ 2406.053618][T26431] ? preempt_schedule_thunk+0x16/0x30 [ 2406.059006][T26431] check_panic_on_warn+0xab/0xb0 [ 2406.063942][T26431] end_report+0x107/0x170 [ 2406.068270][T26431] kasan_report+0xee/0x110 [ 2406.072677][T26431] ? l2cap_sock_new_connection_cb+0x221/0x240 [ 2406.078787][T26431] l2cap_sock_new_connection_cb+0x221/0x240 [ 2406.084663][T26431] l2cap_connect_cfm+0x4c7/0xf80 [ 2406.089596][T26431] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2406.095040][T26431] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2406.100486][T26431] le_conn_complete_evt+0x1ba6/0x2150 [ 2406.105847][T26431] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2406.111549][T26431] ? hci_event_packet+0x459/0x11c0 [ 2406.116650][T26431] hci_le_conn_complete_evt+0x23c/0x370 [ 2406.122185][T26431] hci_le_meta_evt+0x357/0x5e0 [ 2406.126926][T26431] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 2406.132978][T26431] hci_event_packet+0x685/0x11c0 [ 2406.137903][T26431] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2406.143165][T26431] ? __pfx_hci_event_packet+0x10/0x10 [ 2406.148528][T26431] ? kcov_remote_start+0x3d9/0x6d0 [ 2406.153627][T26431] hci_rx_work+0x2c5/0x16b0 [ 2406.158116][T26431] process_one_work+0x9cf/0x1b70 [ 2406.163048][T26431] ? __pfx_process_one_work+0x10/0x10 [ 2406.168403][T26431] ? assign_work+0x1a0/0x250 [ 2406.172973][T26431] worker_thread+0x6c8/0xf10 [ 2406.177552][T26431] ? __pfx_worker_thread+0x10/0x10 [ 2406.182644][T26431] kthread+0x3c5/0x780 [ 2406.186693][T26431] ? __pfx_kthread+0x10/0x10 [ 2406.191261][T26431] ? rcu_is_watching+0x12/0xc0 [ 2406.196100][T26431] ? __pfx_kthread+0x10/0x10 [ 2406.200675][T26431] ret_from_fork+0x675/0x7d0 [ 2406.205244][T26431] ? __pfx_kthread+0x10/0x10 [ 2406.209826][T26431] ret_from_fork_asm+0x1a/0x30 [ 2406.214582][T26431] [ 2406.217902][T26431] Kernel Offset: disabled [ 2406.222212][T26431] Rebooting in 86400 seconds..