last executing test programs: 8.947937642s ago: executing program 0 (id=2502): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) get_robust_list(0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000300)}}], 0x1, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r2 = socket(0x28, 0x801, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000300)=@userptr={0xbb6, 0x1, 0x4, 0x1, 0xc8bd, {0x0, 0xea60}, {0x3, 0xc, 0x6, 0x7, 0x0, 0xf, "050b2e3b"}, 0x5, 0x2, {&(0x7f0000000440)}, 0xc, 0x0, r1}) r3 = openat$binfmt_register(0xffffff9c, &(0x7f0000005480), 0x1, 0x0) write$binfmt_register(r3, &(0x7f0000000680)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x800000100000003, 0x3a, 'U\x01\x8e\xa1\xff\xd6\xecF\x8e\x00\x00\x00\x00\x00\x00\x00\xedJIh\x9b\x1a\xde*\xb0d.', 0x3a, '\xda\xb8\xfd\xcd\x9a$\xb6\xc9\x0f\xff}\xcc\x92\xba\xafp\xa3\xbd\xf9\xc7\xb6\x8aG\x845\x95YC\xfc\r-dont_appB\xcf&\xd7*\xab\xb6\xde\xcd8\xcc\xe6\x1eG\xb8D\xcd\xfc~Uv\xfc\xd6\x16\x0e\xc5\xcc\xadab5\xf2\x85\xc0\x9e\x9b\x1a\x85v4\x83\xc6\xcb\x83\xbd\xda\xfe\xe8yP[\t\xdd\xab\xbd\xd9\xd2m\xf9o#\x18\xbf\xb9\xd0\xb8\fR7\x9f\xcb\xc7\xf9=w\"8\x1b\xa0\xado=N\xe7(9\xf2\xa2\r\n{\x01BT\xed!\xac#\x95#Hl\x1cV\b\x852\xe0m\xd0t\x15N\x13\bG\xd8\x8d\xb9)\xd2/\xf9\xb8#0\x14m\x83f\xb2\xab\xe3\xc8$$\v\x17]\x7f\xd5\x84\xf4:y\xcf\xbf\xacN!\n8\xd3\x88\xba4\x8c\x02.F\xdfY\xaf!\xf8\xe1!Q2l*\xeca\\\xc5\xeb\xb5CpT[v\x1f2\x12kq\xf0\xf2\xc7XZ_[\x16\x81\xd1a\xad\x18L#<\x85\xc36\x00\f\xafD\xbc\xd5HPs\x90B#B\xdeQ\xd2\xec\xc1\x80\xf1\xf7\x1d\xe5\x9dE:<\xfd\xf8\xe6\x05\x92\xc9&0\xc5\x82\xa0\xffd\x8d1\xa3\x94h\x8f&\x85\x99QP\xf3u\xb9a\xa6\x90\x01\xe8\xbcJ#\xbf\xe8\xb9\xfcEd_\x7f\x06\x94\x195z\xbf\x1f_\xbd\x90n\xcb\x15\xd2A\xb0\xe8\x92\x9e*\x160\xd2V\xe3\x8a\xa4!\xb4\xba\xa6>\x8d\xcc\xc1\xd5\x9aI\x1f%\xf07\xe7\xd4\x80\xc0\xd6\x13I*\xa4E\xac\xc8\xf9-1\xd0\x92\xc6\xde\x10\xed\v]\x13\xf6\\\xbe\x11\xe0\xfe\x8bJ\x17\x96B\xdf_\xad\t\xd2p\xe0\x9f\x9bOs\xdd\'W\xf62b\x02\xce%)Sv\x9e\r_5x<\x18C9\xe1\x18U\x126\xf5|\x1f\xe97x\x1e\x7fr\xb9\x99\xbe\x85\x1cX\xfe\xe6\x99\xa9(q\xab\xef]c-}\x0fnU\xfa\xbfb)\xba\nyI\xd0\x0fb\xbe\xa4\xc3\xe8.\x82\xdf\xff^\x84S\xdf\x12\x93A\xe4\x85I\xce\x8b\x9dX\xa8\'\x0e\xcay\xb6\xb2\xd6%\xeeh\xe3O\x06<\x91\xce\xa6o\x8b^\x96\xd4\xfbT\xfd\x1e\xa6\xaf\xc1\xc9a\xdf\x02\xfe\xfa\xdb\x1fm\x10xJ\x00\xf6\x9b\xb2', 0x3a, './file0'}, 0x25c) 8.38406901s ago: executing program 0 (id=2507): getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000240)={0xffffffffffffffff, 0x8a, 0xfffffffffffffff5, 0x200000000000d, 0x80000000, 0x5, 0x52e6ac5c, 0x2000ffffffff, 0x4aa6, 0xfffffffffffffffe, 0x80000000008, 0x9, 0x5, 0x8000000b, 0x80000000000000, 0x12e, 0x4, 0x85, 0x17, 0x3, 0x100000000, 0x5, 0x200000005, 0x0, 0xffffffffffffffff, 0xa}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x0, 0x0, 0x22, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r3, &(0x7f0000000400)=[{&(0x7f0000000280)='3', 0x1}, {&(0x7f0000000340)}], 0x2) 7.529755746s ago: executing program 0 (id=2508): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='usbip-vudc\x00', 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000b00)='0x01', 0x4) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x4f) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000400)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, 0x0, 0x0) symlinkat(&(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)="18a2b93d1236e859bd1a228a1359541e517cc234f93c8aa9de54f947e3d652d1bd77938d4195cd1aa34f9bfbf6db08a8ff78b655f963236efa2bcd9f308708fdf78ef16da397480edab18b34984983c7eb8a72c933a9a6b5b9508ab16b0c953873a323ce0f3ca1877634669432e48216732120d0e3c783ff894cc3711d08a83a72c400283b8e9f79d0c45901c77a762e33fe67a22331a504d655b14c505e0e652dbb7d677815ac68fe5e27331c765a2dd823b98c1d35dcd93e210759ae2bbd29b72ae004dd56708828c0a5332dd4f59c36d73f1caaaf641fb81cb0f168f0", 0xde) 7.193714385s ago: executing program 3 (id=2509): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/nfsv4leasetime\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0), 0xff7) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x49940, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) close(r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000300)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.064714657s ago: executing program 1 (id=2512): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000025300)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) get_robust_list(0x0, &(0x7f0000000940)=&(0x7f0000000900)={&(0x7f0000000500)={&(0x7f00000004c0)={&(0x7f0000000480)}}, 0x0, &(0x7f0000000640)={&(0x7f0000000600)={&(0x7f0000000540)}}}, &(0x7f0000000980)=0x18) r2 = fsopen(&(0x7f0000000000)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000001c0)='acl\x00JN\xa0\xc3\xcd,\xebl>J\"f\xe7\xe0A\x04%\xb4\xd0\x7fb)\x9f\xd3\xeb\xfe\x8fi\xee\x02\x03\a\xb0p\xe9\xfe_\a0\xee\x82{\xa5\xbc\xb6\x8d\xe8\xe3K{H\xbc\xa0y+\xabL,\x8b^|#x\x85\xacc\xa5\xf3\xa7\x05Y~\xc3\xbag\x1d\x95\xcd\xaf\xd2\xd6\xc7v3\xe1r\xdbL\xcdPu\x91\xce\xa5\x86@vG\xb1t\x0f\xf2gg\xcb\xbc\xe9\x90\x00\xd5\xb2V0yZD/\xa1\x7f\xee{\xd3\xecN\xb1\xee\xb1\xb5\x1bu0=:\x84\xd5N2\xc5\x91\x8d\x12\xf7\xdd\xea\xad\xf8<$b\x8b\x89\x18\xe6\xaa\xf3\xa9\x01_\x9b\x89\x05\xc7\xb9\xac\xf5\xb8\x9d2\x8bt\x16\xe8\x9e\x02*\x8a\x83:\a\xef\xee\xeb\xf9\x96\xe9\b\v7`SN\xd1}s\xa7\x8c\x9bB\x13P\x11\x1fl\xc87\x96\xa2\x8f9\xfe\xb0Y~{=SU\xc8D\xe8(\x1c\xffQ\xa9\xdfY06\x19\xa7\x91&\x03Q\x95\xda\xde\x17\xd4\x954\xf8\xa6\xfad:c\xf4\xaa\x99\xcb\xd2GtO', 0x0, r2) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000040)=0x803, 0x4) pipe(&(0x7f0000000100)={0xffffffffffffffff}) syz_emit_ethernet(0x4e, 0x0, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) recvmmsg(r4, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000300)}}], 0x1, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r5 = socket(0x28, 0x801, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB=',\x00']) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000300)=@userptr={0xbb6, 0x1, 0x4, 0x1, 0xc8bd, {0x0, 0xea60}, {0x3, 0xc, 0x6, 0x7, 0x0, 0xf, "050b2e3b"}, 0x5, 0x2, {&(0x7f0000000440)}, 0xc, 0x0, r3}) r6 = openat$binfmt_register(0xffffff9c, &(0x7f0000005480), 0x1, 0x0) write$binfmt_register(r6, &(0x7f0000000680)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x800000100000003, 0x3a, 'U\x01\x8e\xa1\xff\xd6\xecF\x8e\x00\x00\x00\x00\x00\x00\x00\xedJIh\x9b\x1a\xde*\xb0d.', 0x3a, '\xda\xb8\xfd\xcd\x9a$\xb6\xc9\x0f\xff}\xcc\x92\xba\xafp\xa3\xbd\xf9\xc7\xb6\x8aG\x845\x95YC\xfc\r-dont_appB\xcf&\xd7*\xab\xb6\xde\xcd8\xcc\xe6\x1eG\xb8D\xcd\xfc~Uv\xfc\xd6\x16\x0e\xc5\xcc\xadab5\xf2\x85\xc0\x9e\x9b\x1a\x85v4\x83\xc6\xcb\x83\xbd\xda\xfe\xe8yP[\t\xdd\xab\xbd\xd9\xd2m\xf9o#\x18\xbf\xb9\xd0\xb8\fR7\x9f\xcb\xc7\xf9=w\"8\x1b\xa0\xado=N\xe7(9\xf2\xa2\r\n{\x01BT\xed!\xac#\x95#Hl\x1cV\b\x852\xe0m\xd0t\x15N\x13\bG\xd8\x8d\xb9)\xd2/\xf9\xb8#0\x14m\x83f\xb2\xab\xe3\xc8$$\v\x17]\x7f\xd5\x84\xf4:y\xcf\xbf\xacN!\n8\xd3\x88\xba4\x8c\x02.F\xdfY\xaf!\xf8\xe1!Q2l*\xeca\\\xc5\xeb\xb5CpT[v\x1f2\x12kq\xf0\xf2\xc7XZ_[\x16\x81\xd1a\xad\x18L#<\x85\xc36\x00\f\xafD\xbc\xd5HPs\x90B#B\xdeQ\xd2\xec\xc1\x80\xf1\xf7\x1d\xe5\x9dE:<\xfd\xf8\xe6\x05\x92\xc9&0\xc5\x82\xa0\xffd\x8d1\xa3\x94h\x8f&\x85\x99QP\xf3u\xb9a\xa6\x90\x01\xe8\xbcJ#\xbf\xe8\xb9\xfcEd_\x7f\x06\x94\x195z\xbf\x1f_\xbd\x90n\xcb\x15\xd2A\xb0\xe8\x92\x9e*\x160\xd2V\xe3\x8a\xa4!\xb4\xba\xa6>\x8d\xcc\xc1\xd5\x9aI\x1f%\xf07\xe7\xd4\x80\xc0\xd6\x13I*\xa4E\xac\xc8\xf9-1\xd0\x92\xc6\xde\x10\xed\v]\x13\xf6\\\xbe\x11\xe0\xfe\x8bJ\x17\x96B\xdf_\xad\t\xd2p\xe0\x9f\x9bOs\xdd\'W\xf62b\x02\xce%)Sv\x9e\r_5x<\x18C9\xe1\x18U\x126\xf5|\x1f\xe97x\x1e\x7fr\xb9\x99\xbe\x85\x1cX\xfe\xe6\x99\xa9(q\xab\xef]c-}\x0fnU\xfa\xbfb)\xba\nyI\xd0\x0fb\xbe\xa4\xc3\xe8.\x82\xdf\xff^\x84S\xdf\x12\x93A\xe4\x85I\xce\x8b\x9dX\xa8\'\x0e\xcay\xb6\xb2\xd6%\xeeh\xe3O\x06<\x91\xce\xa6o\x8b^\x96\xd4\xfbT\xfd\x1e\xa6\xaf\xc1\xc9a\xdf\x02\xfe\xfa\xdb\x1fm\x10xJ\x00\xf6\x9b\xb2', 0x3a, './file0'}, 0x25c) add_key$keyring(&(0x7f0000000580), &(0x7f00000005c0)={'syz', 0x2}, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000000)=0x80, 0x4) 6.120650959s ago: executing program 3 (id=2513): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x48043) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0x317e, 0x4) write$P9_RREAD(r1, &(0x7f0000000840)=ANY=[@ANYBLOB], 0xb) write$tun(r1, &(0x7f0000000840)=ANY=[], 0x11b0) 6.035356286s ago: executing program 2 (id=2515): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) r1 = fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000280)='gid', &(0x7f0000000580)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000100)={0x9, @output={0x1000, 0x1, {0x7, 0x8}, 0x5, 0xa}}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x2, 0xe, 0x7fff0000}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x74, 0x43, 0x2}, 0x50) socket(0x40000000015, 0x5, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x8, 0x7d, 0xfffffffffffffffd, 0x5, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x40000000000006, 0xae07, 0x9, 0x4, 0x12, 0x80000006, 0x6}, 0x0, 0x0) connect$bt_l2cap(r2, &(0x7f0000000200)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) 6.034508975s ago: executing program 1 (id=2516): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xa, 0x2, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4000000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xff9e, 0x1ff}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x10) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, 0x0}, 0x0) 5.974066004s ago: executing program 4 (id=2517): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) get_robust_list(0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000300)}}], 0x1, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r2 = socket(0x28, 0x801, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000300)=@userptr={0xbb6, 0x1, 0x4, 0x1, 0xc8bd, {0x0, 0xea60}, {0x3, 0xc, 0x6, 0x7, 0x0, 0xf, "050b2e3b"}, 0x5, 0x2, {&(0x7f0000000440)}, 0xc, 0x0, r1}) r3 = openat$binfmt_register(0xffffff9c, &(0x7f0000005480), 0x1, 0x0) write$binfmt_register(r3, &(0x7f0000000680)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x800000100000003, 0x3a, 'U\x01\x8e\xa1\xff\xd6\xecF\x8e\x00\x00\x00\x00\x00\x00\x00\xedJIh\x9b\x1a\xde*\xb0d.', 0x3a, '\xda\xb8\xfd\xcd\x9a$\xb6\xc9\x0f\xff}\xcc\x92\xba\xafp\xa3\xbd\xf9\xc7\xb6\x8aG\x845\x95YC\xfc\r-dont_appB\xcf&\xd7*\xab\xb6\xde\xcd8\xcc\xe6\x1eG\xb8D\xcd\xfc~Uv\xfc\xd6\x16\x0e\xc5\xcc\xadab5\xf2\x85\xc0\x9e\x9b\x1a\x85v4\x83\xc6\xcb\x83\xbd\xda\xfe\xe8yP[\t\xdd\xab\xbd\xd9\xd2m\xf9o#\x18\xbf\xb9\xd0\xb8\fR7\x9f\xcb\xc7\xf9=w\"8\x1b\xa0\xado=N\xe7(9\xf2\xa2\r\n{\x01BT\xed!\xac#\x95#Hl\x1cV\b\x852\xe0m\xd0t\x15N\x13\bG\xd8\x8d\xb9)\xd2/\xf9\xb8#0\x14m\x83f\xb2\xab\xe3\xc8$$\v\x17]\x7f\xd5\x84\xf4:y\xcf\xbf\xacN!\n8\xd3\x88\xba4\x8c\x02.F\xdfY\xaf!\xf8\xe1!Q2l*\xeca\\\xc5\xeb\xb5CpT[v\x1f2\x12kq\xf0\xf2\xc7XZ_[\x16\x81\xd1a\xad\x18L#<\x85\xc36\x00\f\xafD\xbc\xd5HPs\x90B#B\xdeQ\xd2\xec\xc1\x80\xf1\xf7\x1d\xe5\x9dE:<\xfd\xf8\xe6\x05\x92\xc9&0\xc5\x82\xa0\xffd\x8d1\xa3\x94h\x8f&\x85\x99QP\xf3u\xb9a\xa6\x90\x01\xe8\xbcJ#\xbf\xe8\xb9\xfcEd_\x7f\x06\x94\x195z\xbf\x1f_\xbd\x90n\xcb\x15\xd2A\xb0\xe8\x92\x9e*\x160\xd2V\xe3\x8a\xa4!\xb4\xba\xa6>\x8d\xcc\xc1\xd5\x9aI\x1f%\xf07\xe7\xd4\x80\xc0\xd6\x13I*\xa4E\xac\xc8\xf9-1\xd0\x92\xc6\xde\x10\xed\v]\x13\xf6\\\xbe\x11\xe0\xfe\x8bJ\x17\x96B\xdf_\xad\t\xd2p\xe0\x9f\x9bOs\xdd\'W\xf62b\x02\xce%)Sv\x9e\r_5x<\x18C9\xe1\x18U\x126\xf5|\x1f\xe97x\x1e\x7fr\xb9\x99\xbe\x85\x1cX\xfe\xe6\x99\xa9(q\xab\xef]c-}\x0fnU\xfa\xbfb)\xba\nyI\xd0\x0fb\xbe\xa4\xc3\xe8.\x82\xdf\xff^\x84S\xdf\x12\x93A\xe4\x85I\xce\x8b\x9dX\xa8\'\x0e\xcay\xb6\xb2\xd6%\xeeh\xe3O\x06<\x91\xce\xa6o\x8b^\x96\xd4\xfbT\xfd\x1e\xa6\xaf\xc1\xc9a\xdf\x02\xfe\xfa\xdb\x1fm\x10xJ\x00\xf6\x9b\xb2', 0x3a, './file0'}, 0x25c) 4.901810179s ago: executing program 4 (id=2518): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) 4.822882563s ago: executing program 1 (id=2519): set_mempolicy(0x8006, &(0x7f00000001c0)=0x1, 0x3) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x20000600}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x702}]}, 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x68, 0x0, 0xc8, r4}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 4.805569589s ago: executing program 3 (id=2520): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x2, &(0x7f0000000000)=0x80000000000003) fanotify_init(0x8, 0x80000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/failslab/times\x00', 0x1, 0x0) 4.751447394s ago: executing program 2 (id=2521): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100060044"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, 0x0, 0x90) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x200, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x400000000000000, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@broadcast, 0x0, 0x2, 0x0, 0xb7, 0x1, 0xffffff7e}}, 0xe4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) 4.169072875s ago: executing program 1 (id=2522): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r2 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x18, r2, 0x321, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4048010) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000100)) 4.09906853s ago: executing program 2 (id=2523): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x0, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) r8 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r8, 0xc1105517, &(0x7f0000000080)={{0x0, 0x0, 0xe044, 0x0, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x7) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000000100)) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r12, r11, 0x80000) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0xffffffffffffff9a, 0x1000000, 0x0}) lseek(r9, 0x851, 0x0) 3.620570936s ago: executing program 4 (id=2524): r0 = syz_io_uring_complete(0x0, 0x0) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f00000000c0)=""/52) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) socket(0x200000000000011, 0x2, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x195c81, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800b00010067656e65766500000800028004000e001400030067656e65766531"], 0x4c}}, 0x0) syz_emit_vhci(&(0x7f00000016c0)=ANY=[@ANYBLOB="04221f020000000000000c8c61ae65dcd54408aaaaaaaaaa120501013369c0bd21f0020000e0591afa8bd5f83d5bd84c44b230b0fb460100000000000000cd0fb0471616649f9255706369745f40a71686cb1a21f7e3770c35c517834800e03b4e8aa3d1f79ed9814629c84f2d6072ce5aa06df0365487a48657a571adb04983eb846a844eabfc9d06a8feba57f5f3721d40c422766ed904a0003495d882d606382832767d06a7a96f6570130f0a008ab0873c683bb06b109f9e31ee3e15abc6795b7e17c1d6e8ea0a6eca2d1e726c0e63530f43264cb4909cec6789461a7bb359a3384be022f9a53e78269c8d011e766c3636b096bd617f2230012a16d8df07a6663b39c119c8b709c91ae246dafe726076fa8a2bd806518c5b6ba90df6a4421465721eb53cf6b3d3bbcb40c00b4d00d790d727956eba7def264de49e94e63cd220402fff0d0c5184836cc3ad2e566b0a52c5a88b9b008745c0cac674335926b46b9c8057f196544a84179b09f6fc1dd6ccb57029a66c49de911cc01149dcb00f463840067f5cb6"], 0x22) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x4000) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f0000000040)=0x2, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = openat$procfs(0xffffff9c, &(0x7f0000000100)='/proc/asound/seq/timer\x00', 0x0, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000000240)={0x0, 0x68c, 0x4000, 0x0, 0xf}, &(0x7f00000002c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb83e, 0x0, 0x1, 0x233, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1d95, 0x400, 0x1, 0x115, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8ff1, 0x8, 0x2, 0x164, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1454, 0x40, 0x10000001, 0x15f, 0x0, r2}}], 0x4, &(0x7f0000001540)={0x2e, 0x2, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, '\x00', {0x4, 0xaea, 0x0, &(0x7f0000000540)=@buf_1k="5754eab41013d3e8f1f454768969fcd0eca700d4786c58372dd54a7c47c1c0bc22ed233c3df84ee92eddead698b42da491f557bd6be9a03a93023bc3daaa750c9bb743f6f558cd1a055d4ef7d9517259865ef57ac35819a1ec8a62246673660e562c80cc46c8e704ba50eb56a186006bdde556a163429cdeb7a5af494c171fe2db9a212809e8429bee5e1514db1d9c12b12c0dcafa8795256ccf354e611870bf12bb3746443093058f723c8865b3c7734484c5e66258ee7398fb53713694e95e408fc3fadcae233053d13524c5bb3fd5139925c5f2140fe0c0535138ce279b0124d2d0d17c7999f67c70a384b76782ab36d0150ade3c41aace7307b3cae1a32b3355c34d1a23f07ecf58c9af25d0a51ef7f6c904083b027144a180cb3f576901f37494c681806211a0a065f80f56616e08c2079382e8015a44b9638e49b655c53bc9b3ed6c40ecd6bad756733250dcaafdb9f100110f0dca243dc7daaf040ce25c4e8ca8dc5ffdd999370887e862403885aa2148638d9a3acdaffec7b171fa102992cc620bb9da1319e7f5ebaaee8a9b86bfcafd498a2d2bb856a753c991acf7652c62c36880ccb39574e7a9e416bdc18a03925fbcce24eeadb3932479434d6857b95761c616b9dfd4fa201ca75971edac14b3d1cbc6060d9a5f9b90b06244b16c0474807178395972df9f1bada8429e1c0bd78badd47008c12e4f5ffbd7d84c31df0c972474fda5de8334d36225e7c7d00699738d9af11370b45015aa2380538545f680ab1a5647320b182a82dad3ab08487f301e6d2958ea9c158a0155e3b77291d6f0643b4ec21c0ed245b75d27ee53f57293623689f37eb90edbf9315534ffe86e0214e5f8febf79b45043abd4f8895c23051535972bafe3b35048a81f6325a8e75e40b176c818b886977cdf168b058050374cacf36e1655abd09520fa2553cab5c05616a53289064d81a53ceb33555ba7261b8222b83df8994d1c4a2514ee0acfd927a3d2de3e980a34aa79ae2b4dae5abba462f5708484436d33c63b4d88cd3dbcba0e62f46bb07377ae4d75f6de7ace6f08079ea529a82e00331e67555a53521bbc40d9ff7bfeb6b412c34a1cd1f6c56ff012e895a131f56b684b84275794007521b1ca44e5a5d915d0e9f894ecab0be894bbfb169b8444e7521ddcf77dd919fbaab863a5c98d20cdf283001a87879cb52da6e51c3624c19c265b895b4416428cb653b4594b486834ac9e504d2ac9ec773d17563c9f4045f4a8adacc86d1d23a485774737cc14dcc3a6aa1627252d3c6a47410bbb827b46cf4ed1a45155b86ebc783982ad456cc8dd2072caf7de45cac6d063e1ca7051e1fc85b11e4782e2038485195bbbef467f81b05d83aabf0f533266c2dda08e3d60bba6a489d7be191166747e760f587970ed5bbd62c10c53cb8747e73a1a4b12033d095a44da"}}, &(0x7f00000015c0)) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000001680), 0xffffffffffffffff) 3.312412353s ago: executing program 1 (id=2525): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000100)=0xd, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x7) r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r1, 0xc00c9207, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x7fff}) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x48050) readv(r1, &(0x7f0000000040), 0x2000000000000213) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x1, 0x0) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x40280, 0x41) mount$binder(0x0, &(0x7f0000000480)='./config\x00', &(0x7f0000000500), 0x1000484, &(0x7f0000000580)={[{@max={'max', 0x3d, 0x2}}, {@max={'max', 0x3d, 0x1}}], [{@hash}, {@euid_gt}, {@smackfstransmute}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}]}) write(r3, &(0x7f00000001c0)='my_midi_interface\x00', 0x12) 3.024029709s ago: executing program 1 (id=2526): syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[], 0x0) r0 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000140)={&(0x7f0000002480)=[{0xffff, 0x2010, 0x0, 0x0}, {0x1ff, 0x4811, 0x0, 0x0}], 0x2}) 3.004422155s ago: executing program 2 (id=2527): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@flat=@weak_binder={0x77622a85, 0xb, 0x3}, @fd={0x66642a85, 0x0, r1}, @flat=@weak_handle={0x77682a85, 0x1115}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000140)={0x30, 0x30, 0x30}}, 0x40}], 0x0, 0x1000000000000, 0x0}) 2.917559786s ago: executing program 4 (id=2528): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) get_robust_list(0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0) pipe(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000300)}}], 0x1, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = socket(0x28, 0x801, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000300)=@userptr={0xbb6, 0x1, 0x4, 0x1, 0xc8bd, {0x0, 0xea60}, {0x3, 0xc, 0x6, 0x7, 0x0, 0xf, "050b2e3b"}, 0x5, 0x2, {&(0x7f0000000440)}, 0xc}) r2 = openat$binfmt_register(0xffffff9c, &(0x7f0000005480), 0x1, 0x0) write$binfmt_register(r2, &(0x7f0000000680)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x800000100000003, 0x3a, 'U\x01\x8e\xa1\xff\xd6\xecF\x8e\x00\x00\x00\x00\x00\x00\x00\xedJIh\x9b\x1a\xde*\xb0d.', 0x3a, '\xda\xb8\xfd\xcd\x9a$\xb6\xc9\x0f\xff}\xcc\x92\xba\xafp\xa3\xbd\xf9\xc7\xb6\x8aG\x845\x95YC\xfc\r-dont_appB\xcf&\xd7*\xab\xb6\xde\xcd8\xcc\xe6\x1eG\xb8D\xcd\xfc~Uv\xfc\xd6\x16\x0e\xc5\xcc\xadab5\xf2\x85\xc0\x9e\x9b\x1a\x85v4\x83\xc6\xcb\x83\xbd\xda\xfe\xe8yP[\t\xdd\xab\xbd\xd9\xd2m\xf9o#\x18\xbf\xb9\xd0\xb8\fR7\x9f\xcb\xc7\xf9=w\"8\x1b\xa0\xado=N\xe7(9\xf2\xa2\r\n{\x01BT\xed!\xac#\x95#Hl\x1cV\b\x852\xe0m\xd0t\x15N\x13\bG\xd8\x8d\xb9)\xd2/\xf9\xb8#0\x14m\x83f\xb2\xab\xe3\xc8$$\v\x17]\x7f\xd5\x84\xf4:y\xcf\xbf\xacN!\n8\xd3\x88\xba4\x8c\x02.F\xdfY\xaf!\xf8\xe1!Q2l*\xeca\\\xc5\xeb\xb5CpT[v\x1f2\x12kq\xf0\xf2\xc7XZ_[\x16\x81\xd1a\xad\x18L#<\x85\xc36\x00\f\xafD\xbc\xd5HPs\x90B#B\xdeQ\xd2\xec\xc1\x80\xf1\xf7\x1d\xe5\x9dE:<\xfd\xf8\xe6\x05\x92\xc9&0\xc5\x82\xa0\xffd\x8d1\xa3\x94h\x8f&\x85\x99QP\xf3u\xb9a\xa6\x90\x01\xe8\xbcJ#\xbf\xe8\xb9\xfcEd_\x7f\x06\x94\x195z\xbf\x1f_\xbd\x90n\xcb\x15\xd2A\xb0\xe8\x92\x9e*\x160\xd2V\xe3\x8a\xa4!\xb4\xba\xa6>\x8d\xcc\xc1\xd5\x9aI\x1f%\xf07\xe7\xd4\x80\xc0\xd6\x13I*\xa4E\xac\xc8\xf9-1\xd0\x92\xc6\xde\x10\xed\v]\x13\xf6\\\xbe\x11\xe0\xfe\x8bJ\x17\x96B\xdf_\xad\t\xd2p\xe0\x9f\x9bOs\xdd\'W\xf62b\x02\xce%)Sv\x9e\r_5x<\x18C9\xe1\x18U\x126\xf5|\x1f\xe97x\x1e\x7fr\xb9\x99\xbe\x85\x1cX\xfe\xe6\x99\xa9(q\xab\xef]c-}\x0fnU\xfa\xbfb)\xba\nyI\xd0\x0fb\xbe\xa4\xc3\xe8.\x82\xdf\xff^\x84S\xdf\x12\x93A\xe4\x85I\xce\x8b\x9dX\xa8\'\x0e\xcay\xb6\xb2\xd6%\xeeh\xe3O\x06<\x91\xce\xa6o\x8b^\x96\xd4\xfbT\xfd\x1e\xa6\xaf\xc1\xc9a\xdf\x02\xfe\xfa\xdb\x1fm\x10xJ\x00\xf6\x9b\xb2', 0x3a, './file0'}, 0x25c) 2.485699201s ago: executing program 2 (id=2529): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xa, 0x2, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4000000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xff9e, 0x1ff}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x10) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)}, 0x0) 2.38313127s ago: executing program 4 (id=2530): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x48043) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0x317e, 0x4) write$P9_RREAD(r1, &(0x7f0000000840)=ANY=[@ANYBLOB], 0xb) write$tun(r1, &(0x7f0000000840)=ANY=[], 0x11b0) 2.173504422s ago: executing program 3 (id=2531): r0 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340), &(0x7f00000001c0), &(0x7f0000000000)) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000300)={0x10000001}) 2.111742399s ago: executing program 0 (id=2532): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 2.001181126s ago: executing program 3 (id=2533): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) creat(0x0, 0x175) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) acct(&(0x7f0000000000)='./bus\x00') r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000140), 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x11a, 0x4, 0x0, 0x0) acct(0x0) listen(0xffffffffffffffff, 0x5) r3 = syz_ublk_setup_io_uring(0x617a, &(0x7f0000000040)={0x0, 0x0, 0x10000}, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r6 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) syz_ublk_add_dev(r6, 0x0, r4, r5, &(0x7f00000003c0)={0x2e, 0x71, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0x58e, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff}}}, &(0x7f0000000440)=0x0) syz_ublk_setup_queues(r6, r7, 0x0, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd3db, 0x200, 0x1, 0x3de, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e00, 0x200, 0x1, 0x278, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb60e, 0x1000, 0x1, 0x321, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc9b3, 0x200, 0x3, 0xc4}}], 0x4, &(0x7f00000017c0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xf6}, 0x0, 0x0, '\x00', {0x5, 0xc81, 0x0, 0x0}}, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000140)={0xf, 0x4cd, 0x2, 0x3, 0x1, "c4249d0788fa8dccada7257c3105714622383e", 0xe3b, 0x5}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$kcm(0xa, 0x5, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) 1.872305585s ago: executing program 0 (id=2534): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) 588.02418ms ago: executing program 2 (id=2535): unshare(0x4020400) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, 0x0) chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.sectors\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x803, 0x5, 0x7fffffff, 0x3, 0x1, 0x6, 0x6, 0x2, 0x4}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) close_range(r1, 0xffffffffffffffff, 0x0) 575.177912ms ago: executing program 0 (id=2536): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000100)=0xd, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x7) r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r1, 0xc00c9207, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x7fff}) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x48050) readv(r1, &(0x7f0000000040), 0x2000000000000213) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x1, 0x0) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x40280, 0x41) mount$binder(0x0, &(0x7f0000000480)='./config\x00', &(0x7f0000000500), 0x1000484, &(0x7f0000000580)={[{@max={'max', 0x3d, 0x2}}, {@max={'max', 0x3d, 0x1}}], [{@hash}, {@euid_gt}, {@smackfstransmute}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}]}) write(r3, &(0x7f00000001c0)='my_midi_interface\x00', 0x12) 561.490252ms ago: executing program 4 (id=2537): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x0, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) r8 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r8, 0xc1105517, &(0x7f0000000080)={{0x0, 0x0, 0xe044, 0x0, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x7) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000000100)) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r12, r11, 0x80000) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0xffffffffffffff9a, 0x1000000, 0x0}) lseek(r9, 0x851, 0x0) 0s ago: executing program 3 (id=2538): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r1, 0x80045113, &(0x7f0000000140)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0xe, 0x0, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0x81, 0xe, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cf", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000001c0)={{0x80000000, 0x0, 0x1, [0x0, 0xf7df]}, {0x80000000, 0x0, 0x4, [0x6]}, 0x1, [0x8, 0x3df]}) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x20, 0x1409, 0x4, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x800) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000402000000b00000bc26100000000000bf6720000000000016020000000000016702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) kernel console output (not intermixed with test programs): ages_surp=0 hugepages_size=1048576kB [ 432.327376][T10689] Node 0 hugepages_total=6 hugepages_free=5 hugepages_surp=4 hugepages_size=2048kB [ 432.367615][ T9] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 432.395257][T10689] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 432.467800][T10689] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 432.547260][T10689] 95251 total pagecache pages [ 432.588935][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 432.602848][T10689] 0 pages in swap cache [ 432.659811][T10689] Free swap = 124996kB [ 432.664342][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 432.717650][T10689] Total swap = 124996kB [ 432.761055][ T9] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 432.803590][T10689] 2097051 pages RAM [ 432.836598][T10689] 0 pages HighMem/MovableOnly [ 432.869665][T10689] 432279 pages reserved [ 432.901574][T10689] 0 pages cma reserved [ 433.020132][ T9] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 433.037270][ T9] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 433.051415][T10714] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 433.061031][ T9] usb 5-1: config 14 has no interface number 0 [ 433.063328][T10714] binder: 10713:10714 ioctl c0306201 200000000040 returned -14 [ 433.076588][ T9] usb 5-1: config 14 has no interface number 1 [ 433.085263][ T9] usb 5-1: config 14 interface 57 has no altsetting 0 [ 433.092249][ T9] usb 5-1: config 14 interface 228 has no altsetting 0 [ 433.108938][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.117177][ T9] usb 5-1: Product: syz [ 433.121385][ T9] usb 5-1: Manufacturer: syz [ 433.126258][ T9] usb 5-1: SerialNumber: syz [ 433.325480][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 433.604463][ T9] legousbtower 5-1:14.57: interrupt endpoints not found [ 433.822793][ T9] legousbtower 5-1:14.228: interrupt endpoints not found [ 434.262865][T10727] syzkaller0: entered promiscuous mode [ 434.288109][T10727] syzkaller0: entered allmulticast mode [ 435.256612][ T5595] ffs_data_put(): freeing [ 435.646699][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 435.707767][T10750] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 435.719339][T10750] binder: 10749:10750 ioctl c0306201 200000000040 returned -14 [ 436.312117][ T24] usb 5-1: USB disconnect, device number 8 [ 437.487686][T10765] syzkaller0: entered promiscuous mode [ 437.553763][T10765] syzkaller0: entered allmulticast mode [ 439.227828][ T29] audit: type=1400 audit(1786308117.007:791): avc: denied { write } for pid=10781 comm="syz.2.1478" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 439.783258][ T29] audit: type=1400 audit(1786308117.037:792): avc: denied { write } for pid=10781 comm="syz.2.1478" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 440.013779][T10788] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 440.024981][T10788] binder: 10787:10788 ioctl c0306201 200000000040 returned -14 [ 443.189011][ T29] audit: type=1400 audit(1786308121.017:793): avc: denied { append } for pid=10812 comm="syz.3.1489" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 443.191490][T10813] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 443.384911][ T29] audit: type=1400 audit(1786308121.097:794): avc: denied { map } for pid=10812 comm="syz.3.1489" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 443.607049][ T29] audit: type=1400 audit(1786308121.107:795): avc: denied { write execute } for pid=10812 comm="syz.3.1489" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 443.663775][T10823] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 443.673653][T10823] binder: 10819:10823 ioctl c0306201 200000000040 returned -14 [ 443.745539][ T29] audit: type=1400 audit(1786308121.417:796): avc: denied { create } for pid=10824 comm="syz.2.1491" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 443.807735][T10831] program syz.2.1495 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 444.252456][ T29] audit: type=1400 audit(1786308122.067:797): avc: denied { mounton } for pid=10844 comm="syz.3.1497" path="/279/file0" dev="tmpfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 446.681807][T10870] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1501'. [ 446.725605][T10870] ipvlan2: entered allmulticast mode [ 446.741017][T10870] syz_tun: entered allmulticast mode [ 446.798599][ T5332] hid_parser_main: 98 callbacks suppressed [ 446.798614][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.850556][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.880398][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.902897][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.919844][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.938284][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.954060][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 446.987914][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 447.008098][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 447.027529][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 447.074446][ T5332] hid-generic 000A:FFFFFF1D:0002.0006: hidraw0: HID v0.04 Device [syz0] on syz1 [ 447.194300][T10880] overlay: Unknown parameter '/' [ 447.253424][T10882] netlink: zone id is out of range [ 447.261634][T10882] netlink: zone id is out of range [ 447.300726][T10882] input: syz0 as /devices/virtual/input/input37 [ 447.969498][T10881] fido_id[10881]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 448.100697][T10884] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 448.196220][ T29] audit: type=1400 audit(1786308126.027:798): avc: denied { write } for pid=10885 comm="syz.1.1506" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 448.244892][ T29] audit: type=1400 audit(1786308126.047:799): avc: denied { write } for pid=10885 comm="syz.1.1506" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 448.276228][ T29] audit: type=1400 audit(1786308126.067:800): avc: denied { watch watch_reads } for pid=10886 comm="syz.3.1505" path="/282/file1" dev="tmpfs" ino=1581 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 448.342211][T10888] binder: 10883:10888 ioctl c0306201 200000000040 returned -22 [ 449.692432][T10895] program syz.2.1508 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 450.792002][T10912] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 450.806287][T10910] bridge0: port 3(syz_tun) entered blocking state [ 450.812773][T10910] bridge0: port 3(syz_tun) entered disabled state [ 450.819405][T10910] syz_tun: entered allmulticast mode [ 450.825661][T10910] syz_tun: entered promiscuous mode [ 450.831589][T10910] bridge0: port 3(syz_tun) entered blocking state [ 450.838052][T10910] bridge0: port 3(syz_tun) entered forwarding state [ 450.905570][ T5605] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 452.101035][ T5605] usb 5-1: Using ep0 maxpacket: 16 [ 452.158305][ T5605] usb 5-1: New USB device found, idVendor=0f11, idProduct=2030, bcdDevice=a9.fd [ 452.202984][T10928] overlay: Unknown parameter '/' [ 452.234089][T10928] netlink: zone id is out of range [ 452.240507][T10928] netlink: zone id is out of range [ 452.300112][T10928] input: syz0 as /devices/virtual/input/input38 [ 452.345118][ T5605] usb 5-1: config 222 has an invalid interface number: 31 but max is 0 [ 452.474547][ T5605] usb 5-1: config 222 has an invalid descriptor of length 255, skipping remainder of the config [ 452.649976][ T5605] usb 5-1: config 222 has no interface number 0 [ 452.725648][ T5605] usb 5-1: config 222 interface 31 altsetting 11 endpoint 0x8E has an invalid bInterval 255, changing to 11 [ 452.906050][ T5605] usb 5-1: config 222 interface 31 altsetting 11 endpoint 0x8E has invalid maxpacket 59136, setting to 1024 [ 453.074593][ T5605] usb 5-1: config 222 interface 31 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 453.648934][ T5605] usb 5-1: config 222 interface 31 has no altsetting 0 [ 453.707223][T10933] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 453.819844][T10932] binder: 10931:10932 ioctl c0306201 200000000040 returned -14 [ 453.832677][ T5605] usb 5-1: string descriptor 0 read error: -71 [ 453.854916][ T5605] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.919900][ T5605] usb 5-1: can't set config #222, error -71 [ 453.974626][ T5605] usb 5-1: USB disconnect, device number 9 [ 454.070637][T10952] program syz.4.1522 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 456.053766][T10973] syzkaller0: entered promiscuous mode [ 456.072150][T10973] syzkaller0: entered allmulticast mode [ 456.172251][T10976] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1532'. [ 457.411295][T10983] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 457.421042][T10983] binder: 10981:10983 ioctl c0306201 200000000040 returned -14 [ 459.078864][T11040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1544'. [ 459.928467][T11048] syzkaller0: entered promiscuous mode [ 459.951601][T11048] syzkaller0: entered allmulticast mode [ 460.310061][T11055] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 460.423718][T11055] binder: 11054:11055 ioctl c0306201 200000000040 returned -14 [ 462.631455][T11097] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1557'. [ 462.789552][T11099] No source specified [ 465.175472][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 468.192925][T11156] bridge0: port 3(syz_tun) entered blocking state [ 468.201412][T11156] bridge0: port 3(syz_tun) entered disabled state [ 468.220971][T11156] syz_tun: entered promiscuous mode [ 468.229649][T11156] bridge0: port 3(syz_tun) entered blocking state [ 468.236318][T11156] bridge0: port 3(syz_tun) entered forwarding state [ 471.536058][ T29] audit: type=1400 audit(1786308149.367:801): avc: denied { read write } for pid=11178 comm="syz.3.1578" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 471.617160][T11179] jffs2: notice: (11179) jffs2_build_xattr_subsystem: complete building xattr subsystem, 16 of xdatum (0 unchecked, 15 orphan) and 30 of xref (3 dead, 25 orphan) found. [ 471.707945][ T29] audit: type=1400 audit(1786308149.387:802): avc: denied { open } for pid=11178 comm="syz.3.1578" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 472.348793][ T29] audit: type=1400 audit(1786308149.507:803): avc: denied { create } for pid=11178 comm="syz.3.1578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 472.446055][ T29] audit: type=1400 audit(1786308149.517:804): avc: denied { ioctl } for pid=11178 comm="syz.3.1578" path="socket:[28105]" dev="sockfs" ino=28105 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 472.664715][ T29] audit: type=1400 audit(1786308149.527:805): avc: denied { setopt } for pid=11178 comm="syz.3.1578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 473.464445][ T29] audit: type=1400 audit(1786308151.277:806): avc: denied { create } for pid=11192 comm="syz.0.1582" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 473.623077][T11214] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 474.133593][T11213] tipc: Enabled bearer , priority 0 [ 474.173028][T11213] tipc: Resetting bearer [ 474.421459][T11208] tipc: Disabling bearer [ 476.607510][T11244] validate_nla: 44 callbacks suppressed [ 476.607525][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.656530][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.677769][T11245] 9p: Bad value for 'wfdno' [ 476.684075][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.706659][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.725360][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.743126][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.772294][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.809378][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.840914][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 476.870763][T11244] netlink: 'syz.0.1590': attribute type 3 has an invalid length. [ 477.096758][T11247] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 477.689604][T11247] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.721154][ T5605] hid_parser_main: 98 callbacks suppressed [ 478.721169][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 480.703754][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 480.754717][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 480.813733][T11247] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.866054][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 480.971340][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.019756][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.088430][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.128883][T11247] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.145746][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.203903][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.237450][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: unknown main item tag 0x0 [ 481.278324][T11247] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.322269][ T5605] hid-generic 000A:FFFFFF1D:0002.0007: hidraw0: HID v0.04 Device [syz0] on syz1 [ 481.451385][ T6301] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.491538][ T6301] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.540219][ T6301] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.594357][ T6301] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.653914][ T29] audit: type=1400 audit(1786308159.477:807): avc: denied { connect } for pid=11286 comm="syz.2.1597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 482.576024][T11283] fido_id[11283]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 482.938791][T11306] hub 8-0:1.0: USB hub found [ 482.944867][T11306] hub 8-0:1.0: 1 port detected [ 486.688276][ T5771] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 486.870085][ T5771] usb 3-1: Using ep0 maxpacket: 8 [ 486.894362][ T5771] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 486.936433][ T5771] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 486.977273][ T5771] usb 3-1: config 16 has an invalid descriptor of length 120, skipping remainder of the config [ 487.039471][ T5771] usb 3-1: config 16 has 0 interfaces, different from the descriptor's value: 1 [ 487.110523][ T5771] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.910121][ T30] usb 3-1: USB disconnect, device number 5 [ 490.481909][T11377] qrtr: Invalid version 0 [ 490.588880][T11378] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 490.613376][ T29] audit: type=1804 audit(1786308168.407:808): pid=11378 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.1620" name="/newroot/334/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=28414 res=1 errno=0 [ 491.587095][T11377] syzkaller1: entered promiscuous mode [ 491.592997][T11377] syzkaller1: entered allmulticast mode [ 491.607484][ T29] audit: type=1800 audit(1786308168.407:809): pid=11378 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1620" name="iface_name" dev="configfs" ino=28414 res=0 errno=0 [ 492.365706][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 495.662553][ T29] audit: type=1804 audit(1786308173.487:810): pid=11437 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.1633" name="/newroot/335/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=29436 res=1 errno=0 [ 495.756550][T11437] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 495.968840][T11443] geneve3: entered promiscuous mode [ 496.557829][ T29] audit: type=1800 audit(1786308173.487:811): pid=11437 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1633" name="iface_name" dev="configfs" ino=29436 res=0 errno=0 [ 496.651447][T11450] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 496.806863][T11454] qrtr: Invalid version 0 [ 497.088560][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 497.957241][T11454] syzkaller1: entered promiscuous mode [ 497.988712][T11454] syzkaller1: entered allmulticast mode [ 498.073034][T11450] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.796495][T11450] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.982097][T11450] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.082177][T11474] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 499.088757][T11474] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 499.110302][T11450] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.206085][T11474] vhci_hcd vhci_hcd.0: Device attached [ 499.477086][ T29] audit: type=1400 audit(1786308177.287:812): avc: denied { ioctl } for pid=11472 comm="syz.1.1644" path="socket:[29510]" dev="sockfs" ino=29510 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 499.918970][T11475] vhci_hcd: connection closed [ 499.931265][ T6298] vhci_hcd vhci_hcd.1: stop threads [ 500.051201][ T6298] vhci_hcd vhci_hcd.1: release socket [ 500.119636][ T6298] vhci_hcd vhci_hcd.1: disconnect device [ 500.163113][T11484] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 500.685806][ T13] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.732604][ T13] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.204332][ T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.255725][ T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.479819][T11495] overlay: Unknown parameter '/' [ 502.104808][T11495] netlink: zone id is out of range [ 502.110106][T11495] netlink: zone id is out of range [ 502.316683][T11495] input: syz0 as /devices/virtual/input/input39 [ 502.371851][T11505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 502.444219][T11505] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1652'. [ 502.574448][T11505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 502.726073][T11505] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1652'. [ 502.838339][T11505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 502.933922][ T29] audit: type=1400 audit(1786308180.757:813): avc: denied { read } for pid=11508 comm="syz.1.1654" name="/" dev="configfs" ino=1103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 503.240354][ T29] audit: type=1400 audit(1786308180.757:814): avc: denied { open } for pid=11508 comm="syz.1.1654" path="/342/config" dev="configfs" ino=1103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 503.284616][T11509] UDC core: g1: couldn't find an available UDC or it's busy [ 504.404745][ T29] audit: type=1400 audit(1786308182.233:815): avc: denied { connect } for pid=11525 comm="syz.1.1660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 504.452272][ T29] audit: type=1400 audit(1786308182.233:816): avc: denied { write } for pid=11525 comm="syz.1.1660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 504.813336][ T29] audit: type=1326 audit(1786308182.643:817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 504.903216][ T29] audit: type=1326 audit(1786308182.643:818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 505.282203][ T29] audit: type=1326 audit(1786308182.643:819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 505.444064][ T29] audit: type=1326 audit(1786308182.643:820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 505.511104][T11556] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1668'. [ 505.532389][T11556] netlink: 348 bytes leftover after parsing attributes in process `syz.1.1668'. [ 505.551797][ T29] audit: type=1326 audit(1786308182.673:821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 505.592692][T11556] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1668'. [ 505.613611][T11556] netlink: 348 bytes leftover after parsing attributes in process `syz.1.1668'. [ 505.647323][T11556] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1668'. [ 505.669018][ T29] audit: type=1326 audit(1786308182.703:822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11536 comm="syz.2.1665" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f989079e0d9 code=0x7ffc0000 [ 507.651466][ T5597] ffs_data_put(): freeing [ 508.714519][T11592] netlink: 7 bytes leftover after parsing attributes in process `syz.0.1675'. [ 509.202822][T11596] NILFS (loop2): device size too small [ 509.248099][T11596] jffs2: notice: (11596) jffs2_build_xattr_subsystem: complete building xattr subsystem, 16 of xdatum (0 unchecked, 15 orphan) and 30 of xref (3 dead, 25 orphan) found. [ 509.400782][T11604] qrtr: Invalid version 0 [ 509.440756][T11604] syzkaller1: entered promiscuous mode [ 509.453570][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 509.453583][ T29] audit: type=1800 audit(1786308187.283:827): pid=11609 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1679" name="attr_allow_any_host" dev="configfs" ino=30740 res=0 errno=0 [ 509.484504][T11609] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 509.491194][ T29] audit: type=1800 audit(1786308187.313:828): pid=11609 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1679" name="addr_trtype" dev="configfs" ino=29815 res=0 errno=0 [ 509.495206][T11609] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 509.515314][ T29] audit: type=1800 audit(1786308187.323:829): pid=11609 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1679" name="addr_adrfam" dev="configfs" ino=29816 res=0 errno=0 [ 509.553491][ T29] audit: type=1800 audit(1786308187.383:830): pid=11611 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1679" name="addr_traddr" dev="configfs" ino=30742 res=0 errno=0 [ 509.589360][T11604] syzkaller1: entered allmulticast mode [ 509.598726][T11609] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 509.632457][ T29] audit: type=1800 audit(1786308187.463:831): pid=11609 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1679" name="addr_trsvcid" dev="configfs" ino=29820 res=0 errno=0 [ 509.657598][T11609] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 509.746812][T11614] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 509.753379][T11614] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 509.764648][T11614] vhci_hcd vhci_hcd.0: Device attached [ 509.784253][ T29] audit: type=1400 audit(1786308187.613:832): avc: denied { connect } for pid=11613 comm="syz.3.1681" lport=3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 509.906016][T11619] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 509.920656][T11619] syz.2.1680: vmalloc error: size 15032385536, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 509.936098][T11619] CPU: 0 UID: 0 PID: 11619 Comm: syz.2.1680 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.936134][T11619] Tainted: [L]=SOFTLOCKUP [ 509.936142][T11619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 509.936154][T11619] Call Trace: [ 509.936162][T11619] [ 509.936173][T11619] dump_stack_lvl+0x100/0x190 [ 509.936208][T11619] warn_alloc.cold+0x94/0xa8 [ 509.936231][T11619] ? __pfx_warn_alloc+0x10/0x10 [ 509.936253][T11619] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 509.936295][T11619] ? find_held_lock+0x2b/0x80 [ 509.936319][T11619] ? mark_held_locks+0x40/0x70 [ 509.936348][T11619] __vmalloc_node_range_noprof+0x136c/0x1630 [ 509.936377][T11619] ? rcu_is_watching+0x12/0xc0 [ 509.936411][T11619] ? __lock_acquire+0x49f/0x1a40 [ 509.936437][T11619] ? disksize_store+0x11a/0x4d0 [ 509.936467][T11619] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 509.936497][T11619] ? __pfx___might_resched+0x10/0x10 [ 509.936519][T11619] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 509.936551][T11619] ? disksize_store+0x11a/0x4d0 [ 509.936572][T11619] __vmalloc_node_noprof+0xad/0xf0 [ 509.936602][T11619] ? disksize_store+0x11a/0x4d0 [ 509.936628][T11619] disksize_store+0x11a/0x4d0 [ 509.936651][T11619] ? sysfs_file_kobj+0xe4/0x290 [ 509.936685][T11619] ? __pfx_disksize_store+0x10/0x10 [ 509.936705][T11619] dev_attr_store+0x58/0x80 [ 509.936731][T11619] ? __pfx_dev_attr_store+0x10/0x10 [ 509.936757][T11619] sysfs_kf_write+0xf2/0x150 [ 509.936777][T11619] kernfs_fop_write_iter+0x3e0/0x5f0 [ 509.936803][T11619] ? __pfx_sysfs_kf_write+0x10/0x10 [ 509.936823][T11619] vfs_write+0x6ac/0x1050 [ 509.936842][T11619] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 509.936870][T11619] ? __pfx_vfs_write+0x10/0x10 [ 509.936906][T11619] ksys_write+0x12a/0x250 [ 509.936923][T11619] ? __pfx_ksys_write+0x10/0x10 [ 509.936950][T11619] do_syscall_64+0x115/0x870 [ 509.936983][T11619] ? clear_bhb_loop+0x70/0xc0 [ 509.937007][T11619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.937028][T11619] RIP: 0033:0x7f989079e0d9 [ 509.937049][T11619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.937067][T11619] RSP: 002b:00007f9891679028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 509.937087][T11619] RAX: ffffffffffffffda RBX: 00007f9890a26090 RCX: 00007f989079e0d9 [ 509.937100][T11619] RDX: 0000000000000003 RSI: 0000200000000340 RDI: 000000000000000b [ 509.937112][T11619] RBP: 00007f9890835024 R08: 0000000000000000 R09: 0000000000000000 [ 509.937124][T11619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 509.937136][T11619] R13: 00007f9890a26128 R14: 00007f9890a26090 R15: 00007ffd3b660098 [ 509.937165][T11619] [ 509.937196][T11619] Mem-Info: [ 510.218404][T11619] active_anon:44184 inactive_anon:0 isolated_anon:1482 [ 510.218404][T11619] active_file:0 inactive_file:61404 isolated_file:0 [ 510.218404][T11619] unevictable:2548 dirty:146 writeback:16 [ 510.218404][T11619] slab_reclaimable:12948 slab_unreclaimable:100188 [ 510.218404][T11619] mapped:35188 shmem:37912 pagetables:1295 [ 510.218404][T11619] sec_pagetables:0 bounce:0 [ 510.218404][T11619] kernel_misc_reclaimable:0 [ 510.218404][T11619] free:1254131 free_pcp:8422 free_cma:0 [ 510.264307][T11619] Node 0 active_anon:176736kB inactive_anon:0kB active_file:0kB inactive_file:245412kB unevictable:10192kB isolated(anon):5928kB isolated(file):0kB mapped:140752kB dirty:584kB writeback:64kB shmem:151648kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12244kB pagetables:5048kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 510.299917][T11619] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 510.332697][T11619] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 510.362963][T11619] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 510.369223][T11619] Node 0 DMA32 free:1065280kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:176736kB inactive_anon:0kB active_file:0kB inactive_file:245412kB unevictable:10192kB writepending:648kB zspages:0kB present:3129332kB managed:2532244kB mlocked:14208kB bounce:0kB free_pcp:33720kB local_pcp:18232kB free_cma:0kB [ 510.403634][T11619] lowmem_reserve[]: 0 0 0 0 0 [ 510.409084][T11619] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 510.438666][T11619] lowmem_reserve[]: 0 0 0 0 0 [ 510.443681][T11619] Node 1 Normal free:3935884kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 510.475603][T11619] lowmem_reserve[]: 0 0 0 0 0 [ 510.480856][T11619] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 510.494755][T11619] Node 0 DMA32: 80*4kB (UE) 1846*8kB (UME) 1726*16kB (UME) 1795*32kB (UME) 854*64kB (UME) 345*128kB (UME) 106*256kB (UM) 41*512kB (UM) 25*1024kB (UM) 5*2048kB (UM) 191*4096kB (UM) = 1065264kB [ 510.515305][T11619] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 510.527650][T11619] Node 1 Normal: 1*4kB (M) 7*8kB (UM) 7*16kB (UM) 5*32kB (UM) 7*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 958*4096kB (M) = 3935884kB [ 510.545293][T11619] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 510.555073][T11619] Node 0 hugepages_total=6 hugepages_free=5 hugepages_surp=4 hugepages_size=2048kB [ 510.613728][T11619] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 510.625515][ T5728] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 511.325468][T11617] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 511.362857][ T6298] vhci_hcd vhci_hcd.3: stop threads [ 511.385809][ T29] audit: type=1400 audit(1786308187.643:833): avc: denied { setopt } for pid=11613 comm="syz.3.1681" laddr=fe80::b lport=3 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 511.386796][T11619] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 511.452100][ T6298] vhci_hcd vhci_hcd.3: release socket [ 511.492116][ T6298] vhci_hcd vhci_hcd.3: disconnect device [ 511.575256][T11619] 99311 total pagecache pages [ 511.590712][T11619] 0 pages in swap cache [ 511.647078][T11619] Free swap = 124996kB [ 511.681836][T11619] Total swap = 124996kB [ 511.707483][T11619] 2097051 pages RAM [ 511.724858][T11619] 0 pages HighMem/MovableOnly [ 511.754331][T11619] 432279 pages reserved [ 511.781653][T11619] 0 pages cma reserved [ 512.074778][T11636] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 512.200503][ T29] audit: type=1400 audit(1786308190.013:834): avc: denied { write } for pid=11638 comm="syz.2.1686" name="uvc.usb0" dev="configfs" ino=8077 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 512.251571][ T29] audit: type=1400 audit(1786308190.013:835): avc: denied { create } for pid=11638 comm="syz.2.1686" name="my_configfs" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 512.308753][ T29] audit: type=1400 audit(1786308190.023:836): avc: denied { write } for pid=11638 comm="syz.2.1686" name="uvc.usb0" dev="configfs" ino=8077 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.266180][T11662] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 513.362699][T11662] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 513.479696][T11662] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 513.484494][T11664] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 514.616994][T11681] UDC core: g1: couldn't find an available UDC or it's busy [ 514.636976][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 514.636996][ T29] audit: type=1400 audit(1786308192.433:849): avc: denied { bind } for pid=11676 comm="syz.0.1692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 514.712481][ T29] audit: type=1400 audit(1786308192.543:850): avc: denied { write } for pid=11676 comm="syz.0.1692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 515.794359][ T29] audit: type=1400 audit(1786308193.423:851): avc: denied { write } for pid=11689 comm="syz.2.1699" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 515.957159][ T29] audit: type=1400 audit(1786308193.423:852): avc: denied { connect } for pid=11689 comm="syz.2.1699" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 515.995961][T11685] netlink: 7 bytes leftover after parsing attributes in process `syz.1.1698'. [ 516.433977][ T29] audit: type=1400 audit(1786308194.263:853): avc: denied { create } for pid=11698 comm="syz.4.1702" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 516.455552][ T5728] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 516.546051][ T29] audit: type=1400 audit(1786308194.373:854): avc: denied { rename } for pid=11698 comm="syz.4.1702" name="file0" dev="tmpfs" ino=1914 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 516.630416][ T29] audit: type=1400 audit(1786308194.383:855): avc: denied { unlink } for pid=11698 comm="syz.4.1702" name="file0" dev="tmpfs" ino=1914 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 517.662486][ T29] audit: type=1400 audit(1786308195.403:856): avc: denied { egress } for pid=23 comm="ksoftirqd/1" saddr=fe80::1b daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 517.800234][ T29] audit: type=1400 audit(1786308195.403:857): avc: denied { sendto } for pid=23 comm="ksoftirqd/1" saddr=fe80::1b daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 518.367980][T11722] program syz.1.1707 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 518.378299][T11722] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 518.674079][T11733] UDC core: g1: couldn't find an available UDC or it's busy [ 520.525535][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 522.467115][T11762] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1717'. [ 522.719984][T11772] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 522.730213][T11772] binder: 11768:11772 ioctl c0306201 200000000040 returned -14 [ 523.857766][T11783] UDC core: g1: couldn't find an available UDC or it's busy [ 525.643815][ T29] audit: type=1400 audit(1786308203.053:858): avc: denied { shutdown } for pid=11789 comm="syz.2.1728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 525.794018][T11794] syzkaller0: entered promiscuous mode [ 525.864526][T11794] syzkaller0: entered allmulticast mode [ 525.902436][T11795] tipc: Enabled bearer , priority 0 [ 525.940070][T11800] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1731'. [ 525.968806][T11794] tipc: Resetting bearer [ 525.991621][T11793] tipc: Resetting bearer [ 526.070601][T11803] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 526.081065][T11803] binder: 11802:11803 ioctl c0306201 200000000040 returned -14 [ 526.106223][T11793] tipc: Disabling bearer [ 527.192458][T11823] qrtr: Invalid version 0 [ 527.279403][T11823] syzkaller1: entered promiscuous mode [ 527.294332][T11823] syzkaller1: entered allmulticast mode [ 527.311686][T11827] UDC core: g1: couldn't find an available UDC or it's busy [ 527.459354][T11833] hub 8-0:1.0: USB hub found [ 527.464386][T11833] hub 8-0:1.0: 1 port detected [ 528.480604][T11843] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1744'. [ 528.616453][T11845] No source specified [ 530.100547][T11856] qrtr: Invalid version 0 [ 530.299239][T11856] syzkaller1: entered promiscuous mode [ 530.438617][T11856] syzkaller1: entered allmulticast mode [ 531.447894][T11874] overlay: Unknown parameter '/' [ 531.463137][T11874] input: syz0 as /devices/virtual/input/input40 [ 532.077150][T11883] qrtr: Invalid version 0 [ 532.531608][T11883] syzkaller1: entered promiscuous mode [ 532.560416][T11883] syzkaller1: entered allmulticast mode [ 532.695714][T11895] No source specified [ 532.706333][T11896] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 534.372467][T11908] overlay: Unknown parameter '/' [ 534.395179][T11908] input: syz0 as /devices/virtual/input/input41 [ 535.510423][T11932] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1772'. [ 536.009269][T11946] qrtr: Invalid version 0 [ 536.221144][T11949] syzkaller1: entered promiscuous mode [ 536.241424][T11949] syzkaller1: entered allmulticast mode [ 536.362770][T11952] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 537.108949][T11956] overlay: Unknown parameter '/' [ 537.121294][T11956] input: syz0 as /devices/virtual/input/input42 [ 537.440667][T11954] Process accounting resumed [ 539.470873][ T5604] Bluetooth: hci2: SCO packet for unknown connection handle 200 [ 539.546470][ T30] libceph: connect (1)[c::]:6789 error -101 [ 539.578250][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 540.202321][ T30] libceph: connect (1)[c::]:6789 error -101 [ 540.250066][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 540.538202][T11996] NILFS (loop3): device size too small [ 540.603750][T11996] jffs2: notice: (11996) jffs2_build_xattr_subsystem: complete building xattr subsystem, 16 of xdatum (0 unchecked, 15 orphan) and 30 of xref (3 dead, 25 orphan) found. [ 540.788780][ T30] libceph: connect (1)[c::]:6789 error -101 [ 541.228900][T11986] ceph: No mds server is up or the cluster is laggy [ 542.594243][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 542.610781][ T24] libceph: connect (1)[c::]:6789 error -101 [ 542.630686][T12006] overlay: Unknown parameter '/' [ 542.637990][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 542.660643][T12006] input: syz0 as /devices/virtual/input/input43 [ 542.989571][T12010] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 543.930079][T12019] program syz.1.1795 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.947284][T12019] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 545.935568][ T30] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 546.646735][ T30] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 546.717427][ T30] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 546.728114][ T30] usb 2-1: config 0 has no interface number 0 [ 546.753653][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.779174][ T30] usb 2-1: Product: syz [ 546.796814][ T30] usb 2-1: Manufacturer: syz [ 546.810311][ T30] usb 2-1: SerialNumber: syz [ 546.832962][ T30] usb 2-1: config 0 descriptor?? [ 546.854904][ T30] usb 2-1: selecting invalid altsetting 1 [ 546.905989][ T30] dvb_ttusb_budget: ttusb_init_controller: error [ 546.931864][ T30] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 547.097571][ T29] audit: type=1400 audit(1786308224.923:859): avc: denied { read write } for pid=12038 comm="syz.4.1803" name="file0" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 547.285962][ T29] audit: type=1400 audit(1786308224.923:860): avc: denied { open } for pid=12038 comm="syz.4.1803" path="/362/file0/file0" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 547.494020][T12046] overlay: Unknown parameter '/' [ 547.505271][T12046] input: syz0 as /devices/virtual/input/input44 [ 547.583341][ T30] DVB: Unable to find symbol stv0299_attach() [ 547.826185][T12052] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 548.446863][ T30] DVB: Unable to find symbol tda8083_attach() [ 548.726041][ T30] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 548.740383][ T30] usb 2-1: USB disconnect, device number 7 [ 548.862067][T12059] 9p: Bad value for 'wfdno' [ 550.384084][T12083] overlay: Unknown parameter '/' [ 550.413731][T12083] input: syz0 as /devices/virtual/input/input45 [ 550.690534][T12096] 9p: Bad value for 'wfdno' [ 553.333124][ T29] audit: type=1400 audit(1786308230.843:861): avc: denied { bind } for pid=12116 comm="syz.3.1827" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 555.395638][T12142] jffs2: notice: (12142) jffs2_build_xattr_subsystem: complete building xattr subsystem, 16 of xdatum (0 unchecked, 15 orphan) and 30 of xref (3 dead, 25 orphan) found. [ 555.834002][T12146] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1835'. [ 557.500924][ T24] hid_parser_main: 98 callbacks suppressed [ 557.500939][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 557.569084][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 557.599673][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 557.633311][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 557.657105][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.083785][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.540087][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 558.547918][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.555791][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.563550][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.575071][ T24] hid-generic 000A:FFFFFF1D:0002.0008: unknown main item tag 0x0 [ 558.597652][ T24] hid-generic 000A:FFFFFF1D:0002.0008: hidraw0: HID v0.04 Device [syz0] on syz1 [ 558.669994][T12179] fido_id[12179]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 558.765706][ T5605] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 558.997054][ T5605] usb 2-1: Using ep0 maxpacket: 32 [ 559.024468][ T5605] usb 2-1: unable to get BOS descriptor or descriptor too short [ 559.070858][ T5605] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 559.116158][ T5605] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 559.244522][ T5605] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 559.796995][ T5605] usb 2-1: config 14 has no interface number 0 [ 559.832356][ T5605] usb 2-1: config 14 has no interface number 1 [ 559.873948][ T5605] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 559.919822][ T5605] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 560.017921][ T5605] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 560.089695][ T5605] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 560.174607][ T5605] usb 2-1: config 14 interface 57 has no altsetting 0 [ 560.232639][ T5605] usb 2-1: config 14 interface 228 has no altsetting 0 [ 560.297698][ T5605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.415536][ T5605] usb 2-1: Product: syz [ 560.448453][ T5605] usb 2-1: Manufacturer: syz [ 560.750967][ T5605] usb 2-1: SerialNumber: syz [ 561.024921][ T5605] legousbtower 2-1:14.57: interrupt endpoints not found [ 561.107153][ T5605] legousbtower 2-1:14.228: interrupt endpoints not found [ 561.478223][ T5605] usb 2-1: USB disconnect, device number 8 [ 562.958208][T12222] gfs2: not a GFS2 filesystem [ 562.984220][T12222] hpfs: Bad magic ... probably not HPFS [ 564.997697][T12239] program syz.3.1861 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 565.007702][T12239] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 565.703574][T12243] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 565.717732][T12243] binder: 12240:12243 ioctl c0306201 200000000040 returned -14 [ 566.081601][T12250] comedi comedi3: comedi_config --init_data is deprecated [ 568.982566][ T30] hid_parser_main: 98 callbacks suppressed [ 568.982589][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.054259][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.087897][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.115573][T12281] block nbd0: server does not support multiple connections per device. [ 569.116308][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.163488][T12281] block nbd0: shutting down sockets [ 569.169126][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.169153][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.169173][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.169209][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.169229][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.169248][ T30] hid-generic 000A:FFFFFF1D:0002.0009: unknown main item tag 0x0 [ 569.275475][ T30] hid-generic 000A:FFFFFF1D:0002.0009: hidraw0: HID v0.04 Device [syz0] on syz1 [ 569.656366][T12289] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 569.667184][T12289] binder: 12288:12289 ioctl c0306201 200000000040 returned -14 [ 571.510306][T12293] fido_id[12293]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 571.730064][ T29] audit: type=1400 audit(1786308249.553:862): avc: denied { map } for pid=12311 comm="syz.2.1883" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 571.763188][T12318] No source specified [ 574.775699][T12335] block nbd0: server does not support multiple connections per device. [ 574.785850][T12335] block nbd0: shutting down sockets [ 574.920140][T12340] 9p: Bad value for 'wfdno' [ 575.643993][T12350] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 576.039528][T12362] No source specified [ 576.151520][T12365] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 576.174902][T12365] syz.4.1898: vmalloc error: size 15032385536, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 576.191237][T12365] CPU: 1 UID: 0 PID: 12365 Comm: syz.4.1898 Tainted: G L syzkaller #0 PREEMPT(full) [ 576.191272][T12365] Tainted: [L]=SOFTLOCKUP [ 576.191279][T12365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 576.191292][T12365] Call Trace: [ 576.191302][T12365] [ 576.191311][T12365] dump_stack_lvl+0x100/0x190 [ 576.191340][T12365] warn_alloc.cold+0x94/0xa8 [ 576.191362][T12365] ? __pfx_warn_alloc+0x10/0x10 [ 576.191381][T12365] ? lockdep_hardirqs_on+0x78/0x100 [ 576.191429][T12365] __vmalloc_node_range_noprof+0x136c/0x1630 [ 576.191467][T12365] ? __lock_acquire+0x49f/0x1a40 [ 576.191495][T12365] ? disksize_store+0x11a/0x4d0 [ 576.191525][T12365] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 576.191558][T12365] ? __pfx___might_resched+0x10/0x10 [ 576.191581][T12365] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 576.191611][T12365] ? disksize_store+0x11a/0x4d0 [ 576.191631][T12365] __vmalloc_node_noprof+0xad/0xf0 [ 576.191658][T12365] ? disksize_store+0x11a/0x4d0 [ 576.191682][T12365] disksize_store+0x11a/0x4d0 [ 576.191705][T12365] ? sysfs_file_kobj+0xe4/0x290 [ 576.191736][T12365] ? __pfx_disksize_store+0x10/0x10 [ 576.191759][T12365] dev_attr_store+0x58/0x80 [ 576.191787][T12365] ? __pfx_dev_attr_store+0x10/0x10 [ 576.191813][T12365] sysfs_kf_write+0xf2/0x150 [ 576.191834][T12365] kernfs_fop_write_iter+0x3e0/0x5f0 [ 576.191861][T12365] ? __pfx_sysfs_kf_write+0x10/0x10 [ 576.191884][T12365] vfs_write+0x6ac/0x1050 [ 576.191903][T12365] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 576.191934][T12365] ? __pfx_vfs_write+0x10/0x10 [ 576.191977][T12365] ksys_write+0x12a/0x250 [ 576.191996][T12365] ? __pfx_ksys_write+0x10/0x10 [ 576.192023][T12365] do_syscall_64+0x115/0x870 [ 576.192049][T12365] ? clear_bhb_loop+0x70/0xc0 [ 576.192073][T12365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.192094][T12365] RIP: 0033:0x7f66eb39e0d9 [ 576.192113][T12365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.192132][T12365] RSP: 002b:00007f66ec28b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 576.192150][T12365] RAX: ffffffffffffffda RBX: 00007f66eb626270 RCX: 00007f66eb39e0d9 [ 576.192163][T12365] RDX: 0000000000000003 RSI: 0000200000000340 RDI: 000000000000000a [ 576.192174][T12365] RBP: 00007f66eb435024 R08: 0000000000000000 R09: 0000000000000000 [ 576.192185][T12365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 576.192196][T12365] R13: 00007f66eb626308 R14: 00007f66eb626270 R15: 00007ffd3c8c8e98 [ 576.192224][T12365] [ 576.192435][T12365] Mem-Info: [ 576.457227][T12365] active_anon:64332 inactive_anon:0 isolated_anon:0 [ 576.457227][T12365] active_file:0 inactive_file:61440 isolated_file:0 [ 576.457227][T12365] unevictable:0 dirty:324 writeback:0 [ 576.457227][T12365] slab_reclaimable:12823 slab_unreclaimable:101531 [ 576.457227][T12365] mapped:34215 shmem:54008 pagetables:1299 [ 576.457227][T12365] sec_pagetables:0 bounce:0 [ 576.457227][T12365] kernel_misc_reclaimable:0 [ 576.457227][T12365] free:1232949 free_pcp:11787 free_cma:0 [ 576.503075][T12365] Node 0 active_anon:257328kB inactive_anon:0kB active_file:0kB inactive_file:245556kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:136860kB dirty:1296kB writeback:0kB shmem:216032kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12272kB pagetables:5064kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 576.538792][T12365] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 576.572538][T12365] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 576.604297][T12365] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 576.611241][T12365] Node 0 DMA32 free:980552kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:257328kB inactive_anon:0kB active_file:0kB inactive_file:245556kB unevictable:0kB writepending:1296kB zspages:0kB present:3129332kB managed:2532244kB mlocked:0kB bounce:0kB free_pcp:47148kB local_pcp:26228kB free_cma:0kB [ 576.645264][T12365] lowmem_reserve[]: 0 0 0 0 0 [ 576.650503][T12365] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 576.680119][T12365] lowmem_reserve[]: 0 0 0 0 0 [ 576.685134][T12365] Node 1 Normal free:3935884kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 576.716818][T12365] lowmem_reserve[]: 0 0 0 0 0 [ 576.723531][T12365] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 576.737213][T12365] Node 0 DMA32: 2303*4kB (UME) 1441*8kB (UM) 1349*16kB (ME) 1145*32kB (UME) 165*64kB (UME) 55*128kB (UME) 35*256kB (UME) 35*512kB (UM) 27*1024kB (UM) 15*2048kB (UM) 195*4096kB (UM) = 980532kB [ 576.758089][T12365] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 576.770721][T12365] Node 1 Normal: 1*4kB (M) 7*8kB (UM) 7*16kB (UM) 5*32kB (UM) 7*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 958*4096kB (M) = 3935884kB [ 576.788656][T12365] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 576.798396][T12365] Node 0 hugepages_total=6 hugepages_free=5 hugepages_surp=4 hugepages_size=2048kB [ 576.807885][T12365] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 576.817668][T12365] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 576.827071][T12365] 115444 total pagecache pages [ 576.832398][T12365] 0 pages in swap cache [ 576.836768][T12365] Free swap = 124996kB [ 576.841008][T12365] Total swap = 124996kB [ 576.846122][T12365] 2097051 pages RAM [ 576.850439][T12365] 0 pages HighMem/MovableOnly [ 576.855249][T12365] 432279 pages reserved [ 576.859482][T12365] 0 pages cma reserved [ 578.658891][T12376] block nbd0: server does not support multiple connections per device. [ 578.697120][T12376] block nbd0: shutting down sockets [ 578.799964][T12379] 9p: Bad value for 'wfdno' [ 579.932645][T12394] Bluetooth: hci0: unsupported parameter 255 [ 579.959691][T12395] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 579.975606][T12394] Bluetooth: hci0: unsupported parameter 255 [ 580.029752][T12395] binder: 12391:12395 ioctl c0306201 200000000040 returned -14 [ 580.155946][T12400] No source specified [ 580.776918][ T29] audit: type=1326 audit(1786308258.603:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12389 comm="syz.0.1907" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f697099e0d9 code=0x7fc00000 [ 581.066510][T12398] ublk8: read batch cmd buffer failed [ 581.073076][T12398] ublk8: read batch cmd buffer failed [ 581.854902][T12409] af_packet: tpacket_rcv: packet too big, clamped from 1036 to 4294967272. macoff=96 [ 582.303270][T12409] netlink: 1004 bytes leftover after parsing attributes in process `syz.0.1913'. [ 582.496561][T12419] block nbd0: server does not support multiple connections per device. [ 582.516645][T12419] block nbd0: shutting down sockets [ 583.387480][T12430] 9p: Bad value for 'wfdno' [ 583.973959][T12443] Bluetooth: hci0: unsupported parameter 255 [ 583.980385][T12443] Bluetooth: hci0: unsupported parameter 255 [ 586.355035][T12482] 9p: Bad value for 'wfdno' [ 586.451761][ T29] audit: type=1400 audit(1786308264.283:864): avc: denied { write } for pid=12483 comm="syz.3.1932" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.265193][ T29] audit: type=1400 audit(1786308264.323:865): avc: denied { write } for pid=12483 comm="syz.3.1932" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.320047][T12487] Bluetooth: hci0: unsupported parameter 255 [ 587.385853][T12487] Bluetooth: hci0: unsupported parameter 255 [ 588.095530][ T5728] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 589.975494][ T5728] usb 4-1: Using ep0 maxpacket: 32 [ 589.988726][ T5728] usb 4-1: unable to get BOS descriptor or descriptor too short [ 590.005551][ T5728] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 590.017246][ T5728] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 590.025866][ T5728] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 590.034365][ T5728] usb 4-1: config 14 has no interface number 0 [ 590.043021][ T5728] usb 4-1: config 14 has no interface number 1 [ 590.050831][ T5728] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 590.066492][ T5728] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 590.078795][ T5728] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 590.092970][ T5728] usb 4-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 590.119301][ T5728] usb 4-1: config 14 interface 57 has no altsetting 0 [ 590.129418][ T5728] usb 4-1: config 14 interface 228 has no altsetting 0 [ 590.142400][ T5728] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.151021][ T5728] usb 4-1: Product: syz [ 590.155356][ T5728] usb 4-1: Manufacturer: syz [ 590.163437][ T5728] usb 4-1: SerialNumber: syz [ 590.739592][ T5728] legousbtower 4-1:14.57: interrupt endpoints not found [ 590.788260][ T5728] legousbtower 4-1:14.228: interrupt endpoints not found [ 590.915749][ T5728] usb 4-1: USB disconnect, device number 8 [ 591.705712][T12524] 9p: Bad value for 'wfdno' [ 593.184697][T12543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1950'. [ 593.193644][T12543] netlink: 348 bytes leftover after parsing attributes in process `syz.2.1950'. [ 593.202805][T12543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1950'. [ 593.211724][T12543] netlink: 348 bytes leftover after parsing attributes in process `syz.2.1950'. [ 593.220916][T12543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1950'. [ 593.632295][T12558] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 593.653105][T12558] syz.4.1953: vmalloc error: size 15032385536, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 593.668322][T12558] CPU: 0 UID: 0 PID: 12558 Comm: syz.4.1953 Tainted: G L syzkaller #0 PREEMPT(full) [ 593.668353][T12558] Tainted: [L]=SOFTLOCKUP [ 593.668360][T12558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 593.668372][T12558] Call Trace: [ 593.668379][T12558] [ 593.668387][T12558] dump_stack_lvl+0x100/0x190 [ 593.668414][T12558] warn_alloc.cold+0x94/0xa8 [ 593.668435][T12558] ? __pfx_warn_alloc+0x10/0x10 [ 593.668463][T12558] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 593.668495][T12558] ? finish_task_switch.isra.0+0x3b6/0x10c0 [ 593.668530][T12558] ? rcu_is_watching+0x12/0xc0 [ 593.668563][T12558] ? trace_sched_exit_tp+0x120/0x160 [ 593.668606][T12558] __vmalloc_node_range_noprof+0x136c/0x1630 [ 593.668645][T12558] ? disksize_store+0x11a/0x4d0 [ 593.668667][T12558] ? __pfx___schedule+0x10/0x10 [ 593.668700][T12558] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 593.668731][T12558] ? __pfx_disksize_store+0x10/0x10 [ 593.668753][T12558] ? preempt_schedule_common+0x42/0xc0 [ 593.668778][T12558] ? preempt_schedule_thunk+0x16/0x40 [ 593.668806][T12558] ? disksize_store+0x11a/0x4d0 [ 593.668826][T12558] __vmalloc_node_noprof+0xad/0xf0 [ 593.668853][T12558] ? disksize_store+0x11a/0x4d0 [ 593.668876][T12558] disksize_store+0x11a/0x4d0 [ 593.668896][T12558] ? rcu_is_watching+0x12/0xc0 [ 593.668929][T12558] ? __pfx_disksize_store+0x10/0x10 [ 593.668949][T12558] dev_attr_store+0x58/0x80 [ 593.668976][T12558] ? __pfx_dev_attr_store+0x10/0x10 [ 593.669003][T12558] sysfs_kf_write+0xf2/0x150 [ 593.669025][T12558] kernfs_fop_write_iter+0x3e0/0x5f0 [ 593.669053][T12558] ? __pfx_sysfs_kf_write+0x10/0x10 [ 593.669075][T12558] vfs_write+0x6ac/0x1050 [ 593.669093][T12558] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 593.669123][T12558] ? __pfx_vfs_write+0x10/0x10 [ 593.669158][T12558] ksys_write+0x12a/0x250 [ 593.669176][T12558] ? __pfx_ksys_write+0x10/0x10 [ 593.669202][T12558] do_syscall_64+0x115/0x870 [ 593.669228][T12558] ? clear_bhb_loop+0x70/0xc0 [ 593.669252][T12558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.669272][T12558] RIP: 0033:0x7f66eb39e0d9 [ 593.669290][T12558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.669310][T12558] RSP: 002b:00007f66ec2ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 593.669328][T12558] RAX: ffffffffffffffda RBX: 00007f66eb626180 RCX: 00007f66eb39e0d9 [ 593.669340][T12558] RDX: 0000000000000003 RSI: 0000200000000340 RDI: 000000000000000a [ 593.669351][T12558] RBP: 00007f66eb435024 R08: 0000000000000000 R09: 0000000000000000 [ 593.669362][T12558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 593.669373][T12558] R13: 00007f66eb626218 R14: 00007f66eb626180 R15: 00007ffd3c8c8e98 [ 593.669400][T12558] [ 593.669480][T12558] Mem-Info: [ 594.065702][T12558] active_anon:54203 inactive_anon:0 isolated_anon:1545 [ 594.065702][T12558] active_file:0 inactive_file:61439 isolated_file:0 [ 594.065702][T12558] unevictable:1027 dirty:60 writeback:14 [ 594.065702][T12558] slab_reclaimable:12777 slab_unreclaimable:101182 [ 594.065702][T12558] mapped:37835 shmem:42950 pagetables:1414 [ 594.065702][T12558] sec_pagetables:0 bounce:0 [ 594.065702][T12558] kernel_misc_reclaimable:0 [ 594.065702][T12558] free:1241487 free_pcp:11048 free_cma:0 [ 594.166962][T12558] Node 0 active_anon:218912kB inactive_anon:0kB active_file:0kB inactive_file:245552kB unevictable:4108kB isolated(anon):6180kB isolated(file):0kB mapped:155040kB dirty:240kB writeback:56kB shmem:173700kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:12356kB pagetables:5624kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 594.204839][ T5728] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 594.281909][T12558] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 594.551610][T12558] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 594.695475][ T5728] usb 3-1: Using ep0 maxpacket: 32 [ 594.719865][ T5728] usb 3-1: unable to get BOS descriptor or descriptor too short [ 594.728944][T12558] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 594.734902][ T5728] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 594.768679][T12558] Node 0 DMA32 free:1010704kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:232412kB inactive_anon:0kB active_file:0kB inactive_file:245552kB unevictable:12kB writepending:232kB zspages:0kB present:3129332kB managed:2532244kB mlocked:12kB bounce:0kB free_pcp:42868kB local_pcp:19072kB free_cma:0kB [ 594.777789][ T5728] usb 3-1: config 14 has an invalid interface number: 228 but max is 0 [ 594.918649][ T5728] usb 3-1: config 14 has no interface number 0 [ 594.985071][ T5728] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 595.858901][ T5728] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 596.411418][ T29] audit: type=1400 audit(1786308273.663:866): avc: denied { write } for pid=12573 comm="syz.1.1956" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 596.992582][ T5728] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 597.319062][ T5728] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 597.345196][ T29] audit: type=1400 audit(1786308273.673:867): avc: denied { write } for pid=12573 comm="syz.1.1956" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 597.469413][ T5728] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 597.560070][ T5728] usb 3-1: config 14 interface 228 has no altsetting 0 [ 597.570705][T12558] lowmem_reserve[]: 0 0 0 0 0 [ 597.594547][T12558] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 597.652615][ T5728] usb 3-1: string descriptor 0 read error: -71 [ 597.674210][ T5728] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.678625][T12581] 9p: Bad value for 'wfdno' [ 597.754091][ T5728] usb 3-1: can't set config #14, error -71 [ 597.771002][T12558] lowmem_reserve[]: 0 0 0 0 0 [ 597.800969][T12558] Node 1 Normal free:3935884kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 597.834895][ T5728] usb 3-1: USB disconnect, device number 6 [ 597.924487][T12558] lowmem_reserve[]: 0 0 0 0 0 [ 597.942922][T12558] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 597.962718][T12588] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1961'. [ 597.992959][T12558] Node 0 DMA32: 342*4kB (UE) 223*8kB (UM) 6*16kB (UE) 867*32kB (UME) 693*64kB (UME) 269*128kB (UME) 62*256kB (UME) 34*512kB (UM) 23*1024kB (UM) 10*2048kB (UM) 197*4096kB (UM) = 994000kB [ 598.405906][T12558] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 598.425138][T12595] program syz.3.1962 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 598.461124][T12592] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 598.528181][T12558] Node 1 Normal: 1*4kB (M) 7*8kB (UM) 7*16kB (UM) 5*32kB (UM) 7*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 958*4096kB (M) = 3935884kB [ 598.755087][T12558] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 598.850157][T12558] Node 0 hugepages_total=6 hugepages_free=5 hugepages_surp=4 hugepages_size=2048kB [ 598.913265][T12558] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 598.978887][T12558] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 599.033410][T12558] 117488 total pagecache pages [ 599.061566][T12558] 0 pages in swap cache [ 599.915703][T12558] Free swap = 124996kB [ 599.935243][T12558] Total swap = 124996kB [ 599.950666][T12558] 2097051 pages RAM [ 599.973559][T12558] 0 pages HighMem/MovableOnly [ 599.997509][T12558] 432279 pages reserved [ 600.005550][T12558] 0 pages cma reserved [ 600.264720][T12624] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 600.546515][ T29] audit: type=1400 audit(1786308278.373:868): avc: denied { write } for pid=12626 comm="syz.0.1974" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 600.912594][ T29] audit: type=1400 audit(1786308278.423:869): avc: denied { write } for pid=12626 comm="syz.0.1974" name="c.1" dev="configfs" ino=8112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 600.935944][ T29] audit: type=1400 audit(1786308278.423:870): avc: denied { write } for pid=12626 comm="syz.0.1974" name="c.1" dev="configfs" ino=8112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 602.537452][T12661] NILFS (loop2): device size too small [ 602.555943][T12661] jffs2: notice: (12661) jffs2_build_xattr_subsystem: complete building xattr subsystem, 16 of xdatum (0 unchecked, 15 orphan) and 30 of xref (3 dead, 25 orphan) found. [ 602.582940][ T29] audit: type=1400 audit(1786308280.413:871): avc: denied { write } for pid=12659 comm="syz.2.1983" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 604.644208][T12688] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1992'. [ 607.100634][ T29] audit: type=1400 audit(1786308284.333:872): avc: denied { lock } for pid=12695 comm="syz.0.1995" path="socket:[33589]" dev="sockfs" ino=33589 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 608.772275][ T29] audit: type=1400 audit(1786308286.603:873): avc: denied { setopt } for pid=12716 comm="syz.1.2004" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 608.909236][T12719] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2004'. [ 609.334860][T12726] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 610.506345][ T187] hid_parser_main: 98 callbacks suppressed [ 610.506366][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.540656][T12731] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2008'. [ 610.550663][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.559167][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.567367][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.575286][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.682663][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 610.703233][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 611.135559][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 611.161506][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 611.184054][ T187] hid-generic 000A:FFFFFF1D:0002.000A: unknown main item tag 0x0 [ 611.249635][ T187] hid-generic 000A:FFFFFF1D:0002.000A: hidraw0: HID v0.04 Device [syz0] on syz1 [ 611.450082][T12745] fido_id[12745]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 612.118037][T12753] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 613.100377][T12772] syzkaller0: entered promiscuous mode [ 613.106299][T12772] syzkaller0: entered allmulticast mode [ 613.228447][T12781] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2021'. [ 613.247268][ T29] audit: type=1400 audit(1786308291.083:874): avc: denied { read } for pid=12779 comm="syz.4.2025" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 613.279673][T12781] netlink: 348 bytes leftover after parsing attributes in process `syz.0.2021'. [ 613.327999][T12781] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2021'. [ 613.330685][ T29] audit: type=1400 audit(1786308291.083:875): avc: denied { open } for pid=12779 comm="syz.4.2025" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 613.381769][T12781] netlink: 348 bytes leftover after parsing attributes in process `syz.0.2021'. [ 613.413863][T12781] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2021'. [ 613.517561][ T29] audit: type=1400 audit(1786308291.313:876): avc: denied { create } for pid=12786 comm="syz.1.2028" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 614.601134][T12794] netlink: 7 bytes leftover after parsing attributes in process `syz.4.2029'. [ 616.154057][T12810] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 616.784148][ T29] audit: type=1400 audit(1786308294.613:877): avc: denied { bind } for pid=12819 comm="syz.4.2037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 616.961818][T12827] comedi comedi3: comedi_config --init_data is deprecated [ 618.297087][T12844] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2048'. [ 618.519363][T12843] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2047'. [ 618.999666][T12859] input: syz0 as /devices/virtual/input/input46 [ 619.972520][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 620.084615][T12869] comedi comedi3: comedi_config --init_data is deprecated [ 621.800886][T12880] syzkaller0: entered promiscuous mode [ 621.820130][T12880] syzkaller0: entered allmulticast mode [ 621.856253][ T29] audit: type=1400 audit(1786308299.683:878): avc: denied { setopt } for pid=12879 comm="syz.0.2061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 621.883770][T12884] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2063'. [ 621.947972][ T29] audit: type=1400 audit(1786308299.683:879): avc: denied { write } for pid=12879 comm="syz.0.2061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 624.119334][T12925] syzkaller0: entered promiscuous mode [ 624.140789][T12925] syzkaller0: entered allmulticast mode [ 625.360204][T12936] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2080'. [ 630.605679][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 632.741785][ T29] audit: type=1800 audit(1786308310.563:880): pid=13000 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2101" name="attr_allow_any_host" dev="configfs" ino=34526 res=0 errno=0 [ 632.783609][T13001] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2100'. [ 632.836419][T13000] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 632.862957][T13000] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 632.894688][T13000] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 632.922936][ T29] audit: type=1800 audit(1786308310.653:881): pid=13000 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2101" name="addr_trtype" dev="configfs" ino=34536 res=0 errno=0 [ 633.004657][T13000] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 633.053819][ T29] audit: type=1800 audit(1786308310.693:882): pid=13000 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2101" name="addr_adrfam" dev="configfs" ino=35105 res=0 errno=0 [ 633.172614][ T29] audit: type=1800 audit(1786308310.723:883): pid=13000 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2101" name="addr_traddr" dev="configfs" ino=35106 res=0 errno=0 [ 633.279796][T13011] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 633.297529][T13011] binder: 13008:13011 ioctl c0306201 200000000040 returned -14 [ 634.033717][ T29] audit: type=1800 audit(1786308310.753:884): pid=13000 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2101" name="addr_trsvcid" dev="configfs" ino=35107 res=0 errno=0 [ 634.078319][T13012] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2106'. [ 636.860179][T13038] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2115'. [ 638.422061][T13052] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 638.469405][T13052] binder: 13050:13052 ioctl c0306201 200000000040 returned -14 [ 641.264676][T13082] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2131'. [ 641.356075][T13087] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 642.099462][T13088] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.317783][T13088] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.437269][T13095] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2133'. [ 642.467312][T13088] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.621351][T13098] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 642.692877][T13098] binder: 13096:13098 ioctl c0306201 200000000040 returned -14 [ 642.981657][T13088] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.139918][ T6296] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.283143][ T6296] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.423035][ T6296] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.495955][ T6296] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.570099][T13102] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 644.239641][T13115] hub 8-0:1.0: USB hub found [ 644.245528][T13115] hub 8-0:1.0: 1 port detected [ 646.393828][ T29] audit: type=1400 audit(1786308324.203:885): avc: denied { write } for pid=13127 comm="syz.3.2144" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 646.747495][ T29] audit: type=1400 audit(1786308324.223:886): avc: denied { write } for pid=13127 comm="syz.3.2144" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 648.273505][T13150] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2149'. [ 648.487988][ T29] audit: type=1400 audit(1786308326.133:887): avc: denied { connect } for pid=13147 comm="syz.2.2149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 648.584111][T13149] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 648.612856][T13149] binder: 13146:13149 ioctl c0306201 200000000040 returned -14 [ 649.468665][T13157] netlink: 7 bytes leftover after parsing attributes in process `syz.3.2152'. [ 649.840885][ T5604] block nbd0: Receive control failed (result -22) [ 649.973057][T13167] nbd0: detected capacity change from 0 to 32 [ 650.044040][ T6261] block nbd0: Dead connection, failed to find a fallback [ 650.057337][ T6261] block nbd0: shutting down sockets [ 650.063581][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.077044][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.096346][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.106201][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.116301][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.125918][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.138272][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.147880][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.163963][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.174269][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.187166][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.196730][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.210038][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.220147][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.230615][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.240610][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.257608][ T6545] ldm_validate_partition_table(): Disk read failed. [ 650.280934][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.292149][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.300675][ T6261] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 650.310221][ T6261] Buffer I/O error on dev nbd0, logical block 0, async page read [ 650.318445][ T6545] Dev nbd0: unable to read RDB block 0 [ 650.326097][ T6545] nbd0: unable to read partition table [ 650.337580][ T6545] ldm_validate_partition_table(): Disk read failed. [ 650.349790][ T6545] Dev nbd0: unable to read RDB block 0 [ 650.362549][ T6545] nbd0: unable to read partition table [ 650.584988][T13177] syzkaller0: entered promiscuous mode [ 650.673314][T13182] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 650.716667][T13182] binder: 13178:13182 ioctl c0306201 200000000040 returned -14 [ 651.035287][T13184] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2163'. [ 651.436283][T13177] syzkaller0: entered allmulticast mode [ 651.813289][T13190] binder: BINDER_SET_CONTEXT_MGR already set [ 651.820156][T13190] binder: 13186:13190 ioctl 4018620d 200000001000 returned -16 [ 653.035735][ T5728] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 653.142400][ T29] audit: type=1400 audit(1786308330.963:888): avc: denied { relabelfrom } for pid=13202 comm="syz.2.2169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 653.226299][ T29] audit: type=1400 audit(1786308331.003:889): avc: denied { relabelto } for pid=13202 comm="syz.2.2169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 653.270931][ T5728] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 653.312873][ T5728] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 653.358271][ T5728] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 653.445037][ T5728] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 653.505071][ T5728] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 653.573190][ T5728] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 653.612524][ T5604] block nbd1: Receive control failed (result -22) [ 653.631242][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 653.652027][ T5728] usb 2-1: Product: syz [ 653.656672][ T5728] usb 2-1: Manufacturer: syz [ 653.690835][ T5728] cdc_wdm 2-1:1.0: skipping garbage [ 653.705457][ T5728] cdc_wdm 2-1:1.0: skipping garbage [ 653.830154][ T5728] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 653.912685][ T5728] cdc_wdm 2-1:1.0: Unknown control protocol [ 653.930467][T13211] nbd1: detected capacity change from 0 to 32 [ 654.052884][ T6261] block nbd1: Dead connection, failed to find a fallback [ 654.066779][ T6261] block nbd1: shutting down sockets [ 654.173426][ T7632] ldm_validate_partition_table(): Disk read failed. [ 654.276778][ T7632] Dev nbd1: unable to read RDB block 0 [ 654.371083][ T7632] nbd1: unable to read partition table [ 654.449611][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 654.462787][ T29] audit: type=1400 audit(1786308332.263:890): avc: denied { read write } for pid=13198 comm="syz.1.2167" name="cdc-wdm0" dev="devtmpfs" ino=3090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 654.495530][ T29] audit: type=1400 audit(1786308332.263:891): avc: denied { open } for pid=13198 comm="syz.1.2167" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 654.515711][ T7632] ldm_validate_partition_table(): Disk read failed. [ 654.536760][T13225] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 654.560998][T13225] binder: 13219:13225 ioctl c0306201 200000000040 returned -14 [ 654.603853][ T7632] Dev nbd1: unable to read RDB block 0 [ 654.662404][ T5728] usb 2-1: USB disconnect, device number 9 [ 654.692604][ T7632] nbd1: unable to read partition table [ 655.070571][ T2390] blk_print_req_error: 62 callbacks suppressed [ 655.070642][ T2390] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 655.088649][ T2390] buffer_io_error: 62 callbacks suppressed [ 655.088672][ T2390] Buffer I/O error on dev nbd1, logical block 0, async page read [ 655.136968][ T2390] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 655.147193][ T2390] Buffer I/O error on dev nbd1, logical block 0, async page read [ 655.548448][T13223] netlink: 7 bytes leftover after parsing attributes in process `syz.4.2175'. [ 657.225824][ T5771] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 657.399649][T13260] nbd: must specify a size in bytes for the device [ 657.477701][ T5771] usb 2-1: unable to get BOS descriptor or descriptor too short [ 657.522035][ T5771] usb 2-1: not running at top speed; connect to a high speed hub [ 657.574121][ T5771] usb 2-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 657.640478][ T5771] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 4 [ 658.283923][T13267] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 658.456733][ T5771] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 4 [ 658.471842][ T5771] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.480184][ T5771] usb 2-1: Product: syz [ 658.484394][ T5771] usb 2-1: Manufacturer: syz [ 658.489326][T13266] binder: 13264:13266 ioctl c0306201 200000000040 returned -14 [ 658.496126][ T5771] usb 2-1: SerialNumber: syz [ 659.903158][T13299] hub 8-0:1.0: USB hub found [ 659.910326][T13299] hub 8-0:1.0: 1 port detected [ 660.714736][ T5771] usb 2-1: USB disconnect, device number 10 [ 660.827579][T13306] nbd: must specify a size in bytes for the device [ 660.915576][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 661.170298][ T29] audit: type=1400 audit(1786308338.983:892): avc: denied { recv } for pid=13308 comm="syz.0.2200" saddr=10.128.0.169 src=33162 daddr=10.128.1.176 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 661.348164][T13315] 9p: Bad value for 'rfdno' [ 662.841263][ T29] audit: type=1400 audit(1786308340.613:893): avc: denied { read write } for pid=13326 comm="syz.4.2205" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 662.878148][ T29] audit: type=1400 audit(1786308340.623:894): avc: denied { open } for pid=13326 comm="syz.4.2205" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 663.381823][ T29] audit: type=1400 audit(1786308341.203:895): avc: denied { write } for pid=13343 comm="syz.2.2210" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 663.535249][ T29] audit: type=1400 audit(1786308341.253:896): avc: denied { write } for pid=13343 comm="syz.2.2210" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 664.067343][T13313] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2198'. [ 664.271522][T13350] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 664.288287][ T29] audit: type=1400 audit(1786308342.123:897): avc: denied { ioctl } for pid=13345 comm="syz.4.2209" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 664.320831][T13350] binder: 13345:13350 ioctl c0306201 200000000040 returned -14 [ 665.338505][ T5728] hid_parser_main: 98 callbacks suppressed [ 665.338525][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.392523][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.467180][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.493821][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.534920][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.569929][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.597985][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.635544][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.666903][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 665.701866][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: unknown main item tag 0x0 [ 666.003831][ T5728] hid-generic 000A:FFFFFF1D:0002.000B: hidraw0: HID v0.04 Device [syz0] on syz1 [ 666.314631][T13366] fido_id[13366]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 666.686004][ T5728] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 666.722719][ T29] audit: type=1400 audit(1786308344.553:898): avc: denied { read } for pid=13379 comm="syz.0.2222" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 667.042807][ T29] audit: type=1400 audit(1786308344.553:899): avc: denied { open } for pid=13379 comm="syz.0.2222" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 667.192661][T13385] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 667.235789][T13385] binder: 13383:13385 ioctl c0306201 200000000040 returned -14 [ 667.285003][ T5728] usb 5-1: Using ep0 maxpacket: 32 [ 667.352341][ T5728] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 667.460522][ T5728] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 667.555292][ T5728] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 667.661860][ T5728] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 667.748828][ T5728] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 667.854552][ T5728] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.914267][ T5728] usb 5-1: Product: syz [ 668.194497][ T5728] usb 5-1: Manufacturer: syz [ 668.199229][ T5728] usb 5-1: SerialNumber: syz [ 668.345567][ C0] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 669.323645][ T5728] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input47 [ 669.675262][ T5728] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 669.700313][ T5728] (id 0x00) [ 669.825335][T13420] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 669.836358][T13420] binder: 13418:13420 ioctl c0306201 200000000040 returned -14 [ 669.928757][ T5728] rc_core: IR keymap rc-imon-pad not found [ 669.953626][ T5728] Registered IR keymap rc-empty [ 669.966725][ T5728] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 670.680980][ T5728] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 670.692734][ T5728] imon:send_packet: packet tx failed (-71) [ 670.693228][T13436] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2240'. [ 670.725493][ T5728] imon 5-1:155.0: remote input dev register failed [ 670.736546][ T5728] imon 5-1:155.0: imon_init_intf0: rc device setup failed [ 671.213240][ T5728] imon 5-1:155.0: unable to initialize intf0, err 0 [ 671.245258][ T5728] imon:imon_probe: failed to initialize context! [ 671.274463][ T5728] imon 5-1:155.0: unable to register, err -19 [ 671.652801][ T5728] usb 5-1: USB disconnect, device number 10 [ 671.767470][T13461] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 671.781901][T13461] binder: 13458:13461 ioctl c0306201 200000000040 returned -14 [ 671.939098][T13470] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2251'. [ 671.955496][ T187] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 672.020882][T13474] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2252'. [ 672.056021][T13474] 8021q: adding VLAN 0 to HW filter on device bond1 [ 672.240022][ T187] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 672.251777][ T187] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 672.261475][ T187] usb 2-1: config 0 has no interface number 0 [ 672.270126][ T187] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.278795][ T187] usb 2-1: Product: syz [ 672.283887][ T187] usb 2-1: Manufacturer: syz [ 672.289723][ T187] usb 2-1: SerialNumber: syz [ 672.300387][ T187] usb 2-1: config 0 descriptor?? [ 672.319409][ T187] usb 2-1: selecting invalid altsetting 1 [ 672.355870][ T187] dvb_ttusb_budget: ttusb_init_controller: error [ 672.365076][ T187] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 672.396856][ T29] audit: type=1400 audit(1786308350.233:900): avc: denied { accept } for pid=13480 comm="syz.4.2254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 672.427041][ T187] DVB: Unable to find symbol stv0299_attach() [ 672.543116][ T187] DVB: Unable to find symbol tda8083_attach() [ 672.550750][ T187] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 672.562525][ T187] usb 2-1: USB disconnect, device number 11 [ 672.684398][ T57] nvmet: Created nvm controller 12 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:8186742f-3e35-4e69-b028-39f9ad89619f. [ 672.704581][T13490] nvme nvme11: creating 2 I/O queues. [ 672.823624][T13490] nvme nvme11: new ctrl: "testnqn" [ 675.282474][T13533] GUP no longer grows the stack in syz.0.2268 (13533): 200000007000-200000008000 (200000004000) [ 675.357697][T13533] CPU: 1 UID: 0 PID: 13533 Comm: syz.0.2268 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.357732][T13533] Tainted: [L]=SOFTLOCKUP [ 675.357740][T13533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 675.357752][T13533] Call Trace: [ 675.357759][T13533] [ 675.357767][T13533] dump_stack_lvl+0x100/0x190 [ 675.357798][T13533] gup_vma_lookup.cold+0x83/0x96 [ 675.357828][T13533] fixup_user_fault+0x253/0x510 [ 675.357860][T13533] fault_in_user_writeable+0x70/0xe0 [ 675.357885][T13533] futex_lock_pi+0x689/0x7f0 [ 675.357908][T13533] ? __pfx_futex_lock_pi+0x10/0x10 [ 675.357945][T13533] ? tomoyo_path_number_perm+0x188/0x580 [ 675.357973][T13533] ? __pfx_futex_wake_mark+0x10/0x10 [ 675.357996][T13533] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 675.358024][T13533] do_futex+0x371/0x440 [ 675.358050][T13533] ? __pfx_do_futex+0x10/0x10 [ 675.358073][T13533] ? do_raw_spin_lock+0x128/0x260 [ 675.358101][T13533] __x64_sys_futex+0x34f/0x4d0 [ 675.358127][T13533] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 675.358148][T13533] ? __pfx___x64_sys_futex+0x10/0x10 [ 675.358174][T13533] ? kcov_ioctl+0x17a/0x750 [ 675.358200][T13533] do_syscall_64+0x115/0x870 [ 675.358222][T13533] ? clear_bhb_loop+0x70/0xc0 [ 675.358243][T13533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.358259][T13533] RIP: 0033:0x7f697099e0d9 [ 675.358274][T13533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.358289][T13533] RSP: 002b:00007f697190a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 675.358310][T13533] RAX: ffffffffffffffda RBX: 00007f6970c26090 RCX: 00007f697099e0d9 [ 675.358323][T13533] RDX: 0000000000000002 RSI: 000000000000008d RDI: 0000200000004000 [ 675.358335][T13533] RBP: 00007f6970a35024 R08: 0000000000000000 R09: 0000000000000082 [ 675.358345][T13533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 675.358364][T13533] R13: 00007f6970c26128 R14: 00007f6970c26090 R15: 00007ffdbb316c48 [ 675.358389][T13533] [ 675.362622][ T29] audit: type=1400 audit(1786308353.193:901): avc: denied { nlmsg_read } for pid=13528 comm="syz.0.2268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 675.882728][ T5771] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 676.395501][ T5771] usb 4-1: Using ep0 maxpacket: 32 [ 676.425156][ T5771] usb 4-1: unable to get BOS descriptor or descriptor too short [ 676.442370][ T5771] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 676.490944][ T5771] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 676.501559][ T5771] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 676.510341][ T5771] usb 4-1: config 14 has no interface number 0 [ 676.516743][ T5771] usb 4-1: config 14 has no interface number 1 [ 676.523658][ T5771] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 676.536093][ T5771] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 676.549551][ T5771] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 676.561326][ T5771] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 676.577416][ T5771] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 676.591275][ T5771] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 676.612107][ T5771] usb 4-1: config 14 interface 57 has no altsetting 0 [ 676.619431][ T5771] usb 4-1: config 14 interface 228 has no altsetting 0 [ 676.809786][ T5771] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.854106][ T5771] usb 4-1: Product: syz [ 676.913104][ T5771] usb 4-1: Manufacturer: syz [ 676.964253][ T5771] usb 4-1: SerialNumber: syz [ 677.953356][ T5771] legousbtower 4-1:14.57: interrupt endpoints not found [ 678.035216][ T5771] legousbtower 4-1:14.228: get version request failed: -71 [ 678.043027][ T5771] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -71 [ 678.110618][ T5771] usb 4-1: USB disconnect, device number 9 [ 678.437429][T13581] ip6gre1: entered promiscuous mode [ 678.455450][T13581] ip6gre1: entered allmulticast mode [ 678.491945][T13585] Bluetooth: hci0: invalid len left 7, exp >= 50 [ 679.313997][T13602] binder: BINDER_SET_CONTEXT_MGR already set [ 679.320432][T13602] binder: 13594:13602 ioctl 4018620d 200000001000 returned -16 [ 680.272299][ T29] audit: type=1400 audit(1786308358.103:902): avc: denied { write } for pid=13614 comm="syz.1.2297" name="c.1" dev="configfs" ino=8112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 680.286111][T13616] UDC core: g1: couldn't find an available UDC or it's busy [ 680.762445][T13627] overlayfs: missing 'lowerdir' [ 680.951778][ T29] audit: type=1400 audit(1786308358.763:903): avc: denied { connect } for pid=13619 comm="syz.0.2298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 681.486696][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 681.625708][T13628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2290'. [ 681.685307][T13636] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2301'. [ 682.789096][T13628] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2290'. [ 682.866551][T13628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2290'. [ 682.915777][T13628] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2290'. [ 683.071276][T13640] overlayfs: missing 'lowerdir' [ 683.132656][T13628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2290'. [ 683.153679][T13641] input: syz0 as /devices/virtual/input/input49 [ 683.891592][ T24] hid_parser_main: 98 callbacks suppressed [ 683.891606][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 683.962126][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 683.996443][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.033132][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.071214][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.085132][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.193234][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.201281][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.209791][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.218983][ T24] hid-generic 000A:FFFFFF1D:0002.000C: unknown main item tag 0x0 [ 684.285716][ T24] hid-generic 000A:FFFFFF1D:0002.000C: hidraw0: HID v0.04 Device [syz0] on syz1 [ 684.285784][T13656] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2308'. [ 684.335476][T13656] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2308'. [ 684.552748][T13661] fido_id[13661]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 684.931811][T13669] syzkaller0: entered promiscuous mode [ 684.949591][T13669] syzkaller0: entered allmulticast mode [ 685.089208][T13675] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2315'. [ 687.492932][T13705] syzkaller0: entered promiscuous mode [ 687.520266][T13705] syzkaller0: entered allmulticast mode [ 688.625554][T13716] 9p: Bad value for 'rfdno' [ 689.200495][T13724] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2329'. [ 690.184624][T13747] syzkaller0: entered promiscuous mode [ 690.209483][T13747] syzkaller0: entered allmulticast mode [ 690.949033][T13758] 9p: Bad value for 'rfdno' [ 691.378727][T13761] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2344'. [ 691.610754][T13771] hub 8-0:1.0: USB hub found [ 691.615829][T13771] hub 8-0:1.0: 1 port detected [ 692.573366][ T29] audit: type=1400 audit(1786308369.913:904): avc: denied { connect } for pid=13768 comm="syz.3.2347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 692.938938][T13784] syzkaller0: entered promiscuous mode [ 692.959259][T13786] gadgetfs: bound to dummy_udc driver [ 692.967518][T13784] syzkaller0: entered allmulticast mode [ 693.638362][ T29] audit: type=1400 audit(1786308371.473:905): avc: denied { unmount } for pid=5614 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 693.870645][T13797] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 695.528527][T13814] 9p: Bad value for 'rfdno' [ 697.885542][T13838] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 697.929471][T13838] syz.2.2371: vmalloc error: size 15032385536, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 698.072048][T13838] CPU: 1 UID: 0 PID: 13838 Comm: syz.2.2371 Tainted: G L syzkaller #0 PREEMPT(full) [ 698.072081][T13838] Tainted: [L]=SOFTLOCKUP [ 698.072088][T13838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 698.072099][T13838] Call Trace: [ 698.072105][T13838] [ 698.072112][T13838] dump_stack_lvl+0x100/0x190 [ 698.072139][T13838] warn_alloc.cold+0x94/0xa8 [ 698.072158][T13838] ? __pfx_warn_alloc+0x10/0x10 [ 698.072189][T13838] ? look_up_lock_class+0x55/0x120 [ 698.072218][T13838] __vmalloc_node_range_noprof+0x136c/0x1630 [ 698.072250][T13838] ? __lock_acquire+0x49f/0x1a40 [ 698.072272][T13838] ? disksize_store+0x11a/0x4d0 [ 698.072299][T13838] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 698.072330][T13838] ? __pfx___might_resched+0x10/0x10 [ 698.072360][T13838] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 698.072391][T13838] ? disksize_store+0x11a/0x4d0 [ 698.072411][T13838] __vmalloc_node_noprof+0xad/0xf0 [ 698.072437][T13838] ? disksize_store+0x11a/0x4d0 [ 698.072458][T13838] disksize_store+0x11a/0x4d0 [ 698.072477][T13838] ? sysfs_file_kobj+0xe4/0x290 [ 698.072503][T13838] ? __pfx_disksize_store+0x10/0x10 [ 698.072519][T13838] dev_attr_store+0x58/0x80 [ 698.072546][T13838] ? __pfx_dev_attr_store+0x10/0x10 [ 698.072567][T13838] sysfs_kf_write+0xf2/0x150 [ 698.072587][T13838] kernfs_fop_write_iter+0x3e0/0x5f0 [ 698.072610][T13838] ? __pfx_sysfs_kf_write+0x10/0x10 [ 698.072630][T13838] vfs_write+0x6ac/0x1050 [ 698.072651][T13838] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 698.072679][T13838] ? __pfx_vfs_write+0x10/0x10 [ 698.072709][T13838] ksys_write+0x12a/0x250 [ 698.072724][T13838] ? __pfx_ksys_write+0x10/0x10 [ 698.072746][T13838] do_syscall_64+0x115/0x870 [ 698.072766][T13838] ? clear_bhb_loop+0x70/0xc0 [ 698.072785][T13838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.072803][T13838] RIP: 0033:0x7f989079e0d9 [ 698.072819][T13838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.072836][T13838] RSP: 002b:00007f9891679028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 698.072854][T13838] RAX: ffffffffffffffda RBX: 00007f9890a26090 RCX: 00007f989079e0d9 [ 698.072865][T13838] RDX: 0000000000000003 RSI: 0000200000000340 RDI: 000000000000000b [ 698.072875][T13838] RBP: 00007f9890835024 R08: 0000000000000000 R09: 0000000000000000 [ 698.072886][T13838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 698.072896][T13838] R13: 00007f9890a26128 R14: 00007f9890a26090 R15: 00007ffd3b660098 [ 698.072920][T13838] [ 698.072957][T13838] Mem-Info: [ 698.445945][T13838] active_anon:51572 inactive_anon:0 isolated_anon:0 [ 698.445945][T13838] active_file:0 inactive_file:61477 isolated_file:0 [ 698.445945][T13838] unevictable:0 dirty:420 writeback:0 [ 698.445945][T13838] slab_reclaimable:12717 slab_unreclaimable:103154 [ 698.445945][T13838] mapped:38238 shmem:40736 pagetables:1356 [ 698.445945][T13838] sec_pagetables:0 bounce:0 [ 698.445945][T13838] kernel_misc_reclaimable:0 [ 698.445945][T13838] free:1235817 free_pcp:21356 free_cma:0 [ 698.499283][T13838] Node 0 active_anon:203640kB inactive_anon:0kB active_file:0kB inactive_file:245704kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:153352kB dirty:1680kB writeback:0kB shmem:160296kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12340kB pagetables:5392kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 698.510701][T13850] syzkaller0: entered promiscuous mode [ 698.551041][T13838] Node 1 active_anon:2048kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2048kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 698.598110][T13838] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 698.747323][T13838] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 698.758435][T13838] Node 0 DMA32 free:999280kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:215636kB inactive_anon:0kB active_file:0kB inactive_file:245716kB unevictable:0kB writepending:1760kB zspages:0kB present:3129332kB managed:2532244kB mlocked:0kB bounce:0kB free_pcp:68812kB local_pcp:21396kB free_cma:0kB [ 698.791474][T13850] syzkaller0: entered allmulticast mode [ 698.875296][T13858] 9p: Bad value for 'rfdno' [ 699.197469][T13838] lowmem_reserve[]: 0 0 0 0 0 [ 699.283137][T13838] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 699.407961][T13838] lowmem_reserve[]: 0 0 0 0 0 [ 699.429701][T13838] Node 1 Normal free:3929032kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:2048kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:4752kB local_pcp:4752kB free_cma:0kB [ 699.788901][T13838] lowmem_reserve[]: 0 0 0 0 0 [ 699.815727][T13838] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 699.923911][T13838] Node 0 DMA32: 1772*4kB (UM) 1463*8kB (UME) 1296*16kB (UME) 458*32kB (UME) 763*64kB (UME) 389*128kB (UM) 159*256kB (UM) 77*512kB (UME) 28*1024kB (UME) 21*2048kB (UME) 175*4096kB (M) = 1021416kB [ 700.033406][T13838] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 700.097200][T13838] Node 1 Normal: 3*4kB (UM) 2*8kB (UM) 0*16kB 1*32kB (U) 1*64kB (M) 1*128kB (U) 1*256kB (M) 1*512kB (M) 2*1024kB (UM) 3*2048kB (U) 957*4096kB (M) = 3929084kB [ 700.165255][T13838] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 700.186637][T13881] syzkaller1: entered promiscuous mode [ 700.192894][T13881] syzkaller1: entered allmulticast mode [ 700.217962][ T29] audit: type=1400 audit(1786308378.023:906): avc: denied { ioctl } for pid=13879 comm="syz.3.2385" path="socket:[38111]" dev="sockfs" ino=38111 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 700.254482][T13838] Node 0 hugepages_total=6 hugepages_free=5 hugepages_surp=4 hugepages_size=2048kB [ 700.282674][T13838] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 700.398151][T13838] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 700.501974][T13889] syzkaller0: entered promiscuous mode [ 700.507913][T13889] syzkaller0: entered allmulticast mode [ 700.526919][T13838] 108300 total pagecache pages [ 700.555177][T13838] 0 pages in swap cache [ 700.591524][T13838] Free swap = 124996kB [ 700.611718][T13838] Total swap = 124996kB [ 700.634439][T13838] 2097051 pages RAM [ 700.653208][T13838] 0 pages HighMem/MovableOnly [ 700.673646][T13838] 432279 pages reserved [ 700.712092][T13838] 0 pages cma reserved [ 700.959771][T13897] comedi comedi3: comedi_config --init_data is deprecated [ 701.382254][ T29] audit: type=1400 audit(1786308379.213:907): avc: denied { name_bind } for pid=13910 comm="syz.0.2398" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 701.528840][ T29] audit: type=1400 audit(1786308379.253:908): avc: denied { write } for pid=13910 comm="syz.0.2398" name="functions" dev="configfs" ino=8070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 701.664290][ T29] audit: type=1400 audit(1786308379.253:909): avc: denied { write } for pid=13910 comm="syz.0.2398" name="extensions" dev="configfs" ino=38216 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 701.699994][T13919] syzkaller0: entered promiscuous mode [ 701.715464][T13919] syzkaller0: entered allmulticast mode [ 702.017552][T13924] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 703.237568][T13955] syzkaller0: entered promiscuous mode [ 703.300302][T13955] syzkaller0: entered allmulticast mode [ 703.342694][T13959] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 706.983276][T14011] NILFS (loop1): device size too small [ 707.060819][T14011] jffs2: notice: (14011) jffs2_build_xattr_subsystem: complete building xattr subsystem, 17 of xdatum (0 unchecked, 15 orphan) and 31 of xref (3 dead, 25 orphan) found. [ 707.525753][T14011] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 708.293354][ T29] audit: type=1400 audit(1786308386.123:910): avc: denied { mount } for pid=14005 comm="syz.1.2432" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 708.409977][ T29] audit: type=1400 audit(1786308386.243:911): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 708.614039][T14024] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2437'. [ 708.669128][T14024] gretap1: entered promiscuous mode [ 709.788188][T14050] syzkaller0: entered promiscuous mode [ 709.801326][T14050] syzkaller0: entered allmulticast mode [ 709.948678][ T29] audit: type=1400 audit(1786308387.783:912): avc: denied { create } for pid=14052 comm="syz.3.2448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 711.254168][T14071] rt1719 0-0049: probe with driver rt1719 failed with error -5 [ 711.279906][T14071] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 715.140363][T14098] syzkaller0: entered promiscuous mode [ 715.151358][T14098] syzkaller0: entered allmulticast mode [ 715.528107][T14109] binder: BINDER_SET_CONTEXT_MGR already set [ 715.536075][T14109] binder: 14099:14109 ioctl 4018620d 200000001000 returned -16 [ 716.027625][T14107] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 716.034180][T14107] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 716.138574][T14107] vhci_hcd vhci_hcd.0: Device attached [ 716.144490][T14108] vhci_hcd: connection closed [ 716.421959][ T6292] vhci_hcd vhci_hcd.4: stop threads [ 716.472548][ T6292] vhci_hcd vhci_hcd.4: release socket [ 716.494177][ T6292] vhci_hcd vhci_hcd.4: disconnect device [ 716.500097][ T5771] usb 41-1: new low-speed USB device number 5 using vhci_hcd [ 716.526740][ T5771] usb 41-1: enqueue for inactive port 0 [ 716.626019][ T5771] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 718.973150][T14154] syzkaller0: entered promiscuous mode [ 719.010128][T14160] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 719.035699][T14160] binder: 14153:14160 ioctl c0306201 200000000040 returned -14 [ 719.047422][T14154] syzkaller0: entered allmulticast mode [ 719.188552][T14164] binder: BINDER_SET_CONTEXT_MGR already set [ 719.194771][T14164] binder: 14156:14164 ioctl 4018620d 200000001000 returned -16 [ 720.018606][ T29] audit: type=1804 audit(1786308397.853:913): pid=14176 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.2481" name="/newroot/509/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=39286 res=1 errno=0 [ 720.072926][T14176] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 720.137187][ T29] audit: type=1800 audit(1786308397.903:914): pid=14176 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.2481" name="iface_name" dev="configfs" ino=39286 res=0 errno=0 [ 721.544800][T14200] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2491'. [ 723.700180][T14219] binder: BINDER_SET_CONTEXT_MGR already set [ 723.706448][T14219] binder: 14209:14219 ioctl 4018620d 200000001000 returned -16 [ 724.150299][ T29] audit: type=1804 audit(1786308401.983:915): pid=14223 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.2496" name="/newroot/486/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=39348 res=1 errno=0 [ 724.153990][T14223] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 724.178606][ T29] audit: type=1800 audit(1786308401.983:916): pid=14223 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2496" name="iface_name" dev="configfs" ino=39348 res=0 errno=0 [ 724.267858][T14228] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2497'. [ 724.276904][T14228] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2497'. [ 724.286334][T14228] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2497'. [ 724.295215][T14228] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2497'. [ 724.306017][T14228] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2497'. [ 724.634610][T14232] syzkaller0: entered promiscuous mode [ 724.640656][T14232] syzkaller0: entered allmulticast mode [ 724.693881][T14235] hub 8-0:1.0: USB hub found [ 724.700789][T14235] hub 8-0:1.0: 1 port detected [ 725.351097][T14246] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2504'. [ 725.396024][ T29] audit: type=1400 audit(1786308403.223:917): avc: denied { write } for pid=14247 comm="syz.0.2507" name="ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 726.135970][ T29] audit: type=1400 audit(1786308403.223:918): avc: denied { open } for pid=14247 comm="syz.0.2507" path="/dev/ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 727.200814][T14259] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 727.662308][T14270] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2513'. [ 727.692053][ T29] audit: type=1400 audit(1786308405.503:919): avc: denied { map } for pid=14271 comm="syz.4.2514" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 727.888119][T14277] syzkaller0: entered promiscuous mode [ 727.927471][T14277] syzkaller0: entered allmulticast mode [ 729.506112][T14294] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2521'. [ 729.756632][T14299] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 729.785918][T14299] binder: 14296:14299 ioctl c0306201 200000000040 returned -14 [ 730.581382][T14302] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 730.600709][ T29] audit: type=1804 audit(1786308408.413:920): pid=14302 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.2525" name="/newroot/519/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=39484 res=1 errno=0 [ 730.706443][ T29] audit: type=1800 audit(1786308408.413:921): pid=14302 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.2525" name="iface_name" dev="configfs" ino=39484 res=0 errno=0 [ 731.190861][ T9] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 731.337242][ T9] usb 2-1: device descriptor read/64, error -71 [ 731.432958][T14318] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2530'. [ 731.446522][T14317] syzkaller0: entered promiscuous mode [ 731.481717][T14317] syzkaller0: entered allmulticast mode [ 731.605972][ T9] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 731.809262][ T9] usb 2-1: device descriptor read/64, error -71 [ 731.968634][ T9] usb usb2-port1: attempt power cycle [ 732.080278][ T187] Process accounting resumed [ 732.477068][ T9] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 733.105990][ T9] usb 2-1: device descriptor read/8, error -71 [ 733.377620][T14345] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 733.400159][T14345] binder: 14337:14345 ioctl c0306201 200000000040 returned -14 [ 733.653144][T14348] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 734.043451][ T29] audit: type=1804 audit(1786308411.873:922): pid=14344 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.2536" name="/newroot/493/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=40174 res=1 errno=0 [ 734.076438][T14344] ================================================================== [ 734.084537][T14344] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 734.091475][T14344] Read of size 1 at addr ffff88805462fdc0 by task syz.0.2536/14344 [ 734.099370][T14344] [ 734.101686][T14344] CPU: 0 UID: 0 PID: 14344 Comm: syz.0.2536 Tainted: G L syzkaller #0 PREEMPT(full) [ 734.101707][T14344] Tainted: [L]=SOFTLOCKUP [ 734.101712][T14344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 734.101721][T14344] Call Trace: [ 734.101726][T14344] [ 734.101732][T14344] dump_stack_lvl+0x100/0x190 [ 734.101753][T14344] print_report+0x13d/0x4b0 [ 734.101774][T14344] ? __virt_addr_valid+0x239/0x430 [ 734.101797][T14344] ? string+0x471/0x4d0 [ 734.101814][T14344] kasan_report+0xdf/0x1c0 [ 734.101835][T14344] ? string+0x471/0x4d0 [ 734.101851][T14344] string+0x471/0x4d0 [ 734.101867][T14344] ? __pfx_string+0x10/0x10 [ 734.101881][T14344] ? find_held_lock+0x2b/0x80 [ 734.101895][T14344] ? debug_mutex_remove_waiter+0xa0/0x320 [ 734.101920][T14344] vsnprintf+0x422/0x1300 [ 734.101939][T14344] ? __pfx_vsnprintf+0x10/0x10 [ 734.101959][T14344] scnprintf+0xdb/0x150 [ 734.101976][T14344] ? __pfx_scnprintf+0x10/0x10 [ 734.101994][T14344] ? down_read+0x13b/0x4c0 [ 734.102014][T14344] ? __pfx_down_read+0x10/0x10 [ 734.102034][T14344] ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10 [ 734.102051][T14344] f_midi2_opts_iface_name_show+0x6e/0xa0 [ 734.102067][T14344] configfs_read_iter+0x426/0x6f0 [ 734.102087][T14344] __kernel_read+0x397/0xad0 [ 734.102109][T14344] ? __pfx___kernel_read+0x10/0x10 [ 734.102136][T14344] integrity_kernel_read+0x7e/0xb0 [ 734.102158][T14344] ? __pfx_integrity_kernel_read+0x10/0x10 [ 734.102177][T14344] ? __pfx_stack_trace_save+0x10/0x10 [ 734.102193][T14344] ? ima_calc_file_hash_tfm+0x236/0x350 [ 734.102209][T14344] ima_calc_file_hash_tfm+0x25e/0x350 [ 734.102226][T14344] ? __pfx_ima_calc_file_hash_tfm+0x10/0x10 [ 734.102241][T14344] ? __kasan_slab_free+0x5f/0x80 [ 734.102268][T14344] ? ima_alloc_tfm+0x21a/0x2e0 [ 734.102284][T14344] ima_calc_file_hash+0x1e3/0x380 [ 734.102299][T14344] ima_collect_measurement+0x94f/0xb30 [ 734.102318][T14344] ? __pfx_ima_collect_measurement+0x10/0x10 [ 734.102339][T14344] ? process_measurement+0x5ab/0x2350 [ 734.102354][T14344] ? is_bad_inode+0xd/0x40 [ 734.102366][T14344] ? xattr_resolve_name+0x27d/0x3f0 [ 734.102382][T14344] ? vfs_getxattr_alloc+0xec/0x350 [ 734.102400][T14344] ? ima_get_hash_algo+0x241/0x400 [ 734.102421][T14344] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 734.102450][T14344] ? process_measurement+0xdfe/0x2350 [ 734.102464][T14344] process_measurement+0xdfe/0x2350 [ 734.102481][T14344] ? __pfx_process_measurement+0x10/0x10 [ 734.102507][T14344] ? __configfs_open_file+0x6ca/0x9c0 [ 734.102525][T14344] ima_file_check+0xc3/0x110 [ 734.102539][T14344] ? __pfx_ima_file_check+0x10/0x10 [ 734.102556][T14344] security_file_post_open+0xc4/0x210 [ 734.102579][T14344] path_openat+0x985/0x4280 [ 734.102596][T14344] ? rcu_is_watching+0x12/0xc0 [ 734.102617][T14344] ? trace_sched_exit_tp+0x120/0x160 [ 734.102640][T14344] ? __schedule+0x126e/0x6730 [ 734.102654][T14344] ? __pfx_path_openat+0x10/0x10 [ 734.102672][T14344] do_file_open+0x20e/0x430 [ 734.102687][T14344] ? __pfx_do_file_open+0x10/0x10 [ 734.102702][T14344] ? __pfx___schedule+0x10/0x10 [ 734.102723][T14344] ? _raw_spin_unlock+0x3e/0x50 [ 734.102738][T14344] ? alloc_fd+0x471/0x7a0 [ 734.102755][T14344] do_sys_openat2+0x10f/0x1e0 [ 734.102772][T14344] ? __pfx_do_sys_openat2+0x10/0x10 [ 734.102796][T14344] __x64_sys_open+0xfe/0x1d0 [ 734.102813][T14344] ? __pfx___x64_sys_open+0x10/0x10 [ 734.102834][T14344] do_syscall_64+0x115/0x870 [ 734.102852][T14344] ? clear_bhb_loop+0x70/0xc0 [ 734.102868][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.102882][T14344] RIP: 0033:0x7f697099e0d9 [ 734.102895][T14344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 734.102909][T14344] RSP: 002b:00007f697190a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 734.102924][T14344] RAX: ffffffffffffffda RBX: 00007f6970c26090 RCX: 00007f697099e0d9 [ 734.102935][T14344] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0 [ 734.102945][T14344] RBP: 00007f6970a35024 R08: 0000000000000000 R09: 0000000000000000 [ 734.102954][T14344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 734.102963][T14344] R13: 00007f6970c26128 R14: 00007f6970c26090 R15: 00007ffdbb316c48 [ 734.102977][T14344] [ 734.102982][T14344] [ 734.520206][T14344] Allocated by task 14302: [ 734.524603][T14344] kasan_save_stack+0x30/0x50 [ 734.529285][T14344] kasan_save_track+0x14/0x30 [ 734.533946][T14344] __kasan_kmalloc+0xaa/0xb0 [ 734.538515][T14344] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 734.544919][T14344] kstrndup+0x64/0x120 [ 734.548968][T14344] f_midi2_opts_str_store.constprop.0+0xbf/0x240 [ 734.555287][T14344] configfs_write_iter+0x302/0x4e0 [ 734.560391][T14344] vfs_write+0x6ac/0x1050 [ 734.564699][T14344] ksys_write+0x12a/0x250 [ 734.569020][T14344] do_syscall_64+0x115/0x870 [ 734.573593][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.579466][T14344] [ 734.581766][T14344] Freed by task 14349: [ 734.585805][T14344] kasan_save_stack+0x30/0x50 [ 734.590465][T14344] kasan_save_track+0x14/0x30 [ 734.595121][T14344] kasan_save_free_info+0x3b/0x70 [ 734.600122][T14344] __kasan_slab_free+0x5f/0x80 [ 734.604867][T14344] kfree+0x22b/0x6c0 [ 734.608737][T14344] f_midi2_opts_str_store.constprop.0+0xf0/0x240 [ 734.615041][T14344] configfs_write_iter+0x302/0x4e0 [ 734.620231][T14344] vfs_write+0x6ac/0x1050 [ 734.624538][T14344] ksys_write+0x12a/0x250 [ 734.628860][T14344] do_syscall_64+0x115/0x870 [ 734.633433][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.639325][T14344] [ 734.641628][T14344] The buggy address belongs to the object at ffff88805462fdc0 [ 734.641628][T14344] which belongs to the cache kmalloc-32 of size 32 [ 734.655504][T14344] The buggy address is located 0 bytes inside of [ 734.655504][T14344] freed 32-byte region [ffff88805462fdc0, ffff88805462fde0) [ 734.669030][T14344] [ 734.671335][T14344] The buggy address belongs to the physical page: [ 734.677726][T14344] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805462f540 pfn:0x5462f [ 734.687853][T14344] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 734.695899][T14344] page_type: f5(slab) [ 734.699947][T14344] raw: 00fff00000000200 ffff88813fe21780 ffffea00011c54d0 ffffea0000d16b50 [ 734.708509][T14344] raw: ffff88805462f540 000000080040003a 00000000f5000000 0000000000000000 [ 734.717065][T14344] page dumped because: kasan: bad access detected [ 734.723468][T14344] page_owner tracks the page as allocated [ 734.729175][T14344] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5752, tgid 5752 (modprobe), ts 69911581390, free_ts 69911040236 [ 734.748690][T14344] post_alloc_hook+0xfd/0x120 [ 734.753352][T14344] get_page_from_freelist+0xf48/0x3530 [ 734.758809][T14344] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 734.764688][T14344] new_slab+0xa2/0x640 [ 734.768742][T14344] refill_objects+0xe3/0x410 [ 734.773315][T14344] __pcs_replace_empty_main+0x376/0x680 [ 734.778839][T14344] __kmalloc_cache_noprof+0x479/0x6c0 [ 734.784188][T14344] kmem_cache_free+0x412/0x6b0 [ 734.788930][T14344] tear_down_vmas+0x2a5/0x600 [ 734.793592][T14344] exit_mmap+0x469/0xa00 [ 734.797915][T14344] __mmput+0x12a/0x410 [ 734.801968][T14344] mmput+0x67/0x80 [ 734.805670][T14344] do_exit+0x8b1/0x2ae0 [ 734.809804][T14344] do_group_exit+0xd5/0x2a0 [ 734.814283][T14344] __x64_sys_exit_group+0x3e/0x50 [ 734.819285][T14344] x64_sys_call+0x102c/0x1530 [ 734.823957][T14344] page last free pid 5752 tgid 5752 stack trace: [ 734.830256][T14344] __free_frozen_pages+0x79f/0x1090 [ 734.835442][T14344] tlb_finish_mmu+0x27d/0x810 [ 734.840104][T14344] exit_mmap+0x454/0xa00 [ 734.844419][T14344] __mmput+0x12a/0x410 [ 734.848478][T14344] mmput+0x67/0x80 [ 734.852180][T14344] do_exit+0x8b1/0x2ae0 [ 734.856325][T14344] do_group_exit+0xd5/0x2a0 [ 734.860806][T14344] __x64_sys_exit_group+0x3e/0x50 [ 734.865894][T14344] x64_sys_call+0x102c/0x1530 [ 734.870576][T14344] do_syscall_64+0x115/0x870 [ 734.875149][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.881022][T14344] [ 734.883324][T14344] Memory state around the buggy address: [ 734.888936][T14344] ffff88805462fc80: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 734.897064][T14344] ffff88805462fd00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 734.905103][T14344] >ffff88805462fd80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 734.913155][T14344] ^ [ 734.919283][T14344] ffff88805462fe00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 734.927335][T14344] ffff88805462fe80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 734.935470][T14344] ================================================================== [ 734.999680][ T9] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 735.057439][T14344] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 735.064681][T14344] CPU: 1 UID: 0 PID: 14344 Comm: syz.0.2536 Tainted: G L syzkaller #0 PREEMPT(full) [ 735.075630][T14344] Tainted: [L]=SOFTLOCKUP [ 735.079956][T14344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 735.090020][T14344] Call Trace: [ 735.093308][T14344] [ 735.096237][T14344] dump_stack_lvl+0x100/0x190 [ 735.100930][T14344] vpanic+0x552/0x970 [ 735.104929][T14344] ? __pfx_vpanic+0x10/0x10 [ 735.109445][T14344] ? string+0x471/0x4d0 [ 735.113614][T14344] panic+0xd1/0xe0 [ 735.117340][T14344] ? __pfx_panic+0x10/0x10 [ 735.121757][T14344] ? string+0x471/0x4d0 [ 735.125920][T14344] ? preempt_schedule_common+0x42/0xc0 [ 735.131365][T14344] check_panic_on_warn.cold+0x19/0x34 [ 735.136728][T14344] end_report.part.0+0x3a/0x90 [ 735.141495][T14344] kasan_report.cold+0xe/0x18 [ 735.146180][T14344] ? string+0x471/0x4d0 [ 735.150341][T14344] string+0x471/0x4d0 [ 735.154337][T14344] ? __pfx_string+0x10/0x10 [ 735.158823][T14344] ? find_held_lock+0x2b/0x80 [ 735.163490][T14344] ? debug_mutex_remove_waiter+0xa0/0x320 [ 735.169294][T14344] vsnprintf+0x422/0x1300 [ 735.173615][T14344] ? __pfx_vsnprintf+0x10/0x10 [ 735.178372][T14344] scnprintf+0xdb/0x150 [ 735.182521][T14344] ? __pfx_scnprintf+0x10/0x10 [ 735.187277][T14344] ? down_read+0x13b/0x4c0 [ 735.191693][T14344] ? __pfx_down_read+0x10/0x10 [ 735.196463][T14344] ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10 [ 735.202860][T14344] f_midi2_opts_iface_name_show+0x6e/0xa0 [ 735.208559][T14344] configfs_read_iter+0x426/0x6f0 [ 735.213581][T14344] __kernel_read+0x397/0xad0 [ 735.218166][T14344] ? __pfx___kernel_read+0x10/0x10 [ 735.223289][T14344] integrity_kernel_read+0x7e/0xb0 [ 735.228389][T14344] ? __pfx_integrity_kernel_read+0x10/0x10 [ 735.234266][T14344] ? __pfx_stack_trace_save+0x10/0x10 [ 735.239618][T14344] ? ima_calc_file_hash_tfm+0x236/0x350 [ 735.245506][T14344] ima_calc_file_hash_tfm+0x25e/0x350 [ 735.250869][T14344] ? __pfx_ima_calc_file_hash_tfm+0x10/0x10 [ 735.256752][T14344] ? __kasan_slab_free+0x5f/0x80 [ 735.261710][T14344] ? ima_alloc_tfm+0x21a/0x2e0 [ 735.266542][T14344] ima_calc_file_hash+0x1e3/0x380 [ 735.271551][T14344] ima_collect_measurement+0x94f/0xb30 [ 735.277035][T14344] ? __pfx_ima_collect_measurement+0x10/0x10 [ 735.283004][T14344] ? process_measurement+0x5ab/0x2350 [ 735.288358][T14344] ? is_bad_inode+0xd/0x40 [ 735.292759][T14344] ? xattr_resolve_name+0x27d/0x3f0 [ 735.297940][T14344] ? vfs_getxattr_alloc+0xec/0x350 [ 735.303034][T14344] ? ima_get_hash_algo+0x241/0x400 [ 735.308133][T14344] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 735.313582][T14344] ? process_measurement+0xdfe/0x2350 [ 735.318933][T14344] process_measurement+0xdfe/0x2350 [ 735.324136][T14344] ? __pfx_process_measurement+0x10/0x10 [ 735.329823][T14344] ? __configfs_open_file+0x6ca/0x9c0 [ 735.335202][T14344] ima_file_check+0xc3/0x110 [ 735.340301][T14344] ? __pfx_ima_file_check+0x10/0x10 [ 735.345488][T14344] security_file_post_open+0xc4/0x210 [ 735.351490][T14344] path_openat+0x985/0x4280 [ 735.356014][T14344] ? rcu_is_watching+0x12/0xc0 [ 735.360773][T14344] ? trace_sched_exit_tp+0x120/0x160 [ 735.366075][T14344] ? __schedule+0x126e/0x6730 [ 735.370738][T14344] ? __pfx_path_openat+0x10/0x10 [ 735.375937][T14344] do_file_open+0x20e/0x430 [ 735.380457][T14344] ? __pfx_do_file_open+0x10/0x10 [ 735.385490][T14344] ? __pfx___schedule+0x10/0x10 [ 735.390357][T14344] ? _raw_spin_unlock+0x3e/0x50 [ 735.395228][T14344] ? alloc_fd+0x471/0x7a0 [ 735.399561][T14344] do_sys_openat2+0x10f/0x1e0 [ 735.404234][T14344] ? __pfx_do_sys_openat2+0x10/0x10 [ 735.409425][T14344] __x64_sys_open+0xfe/0x1d0 [ 735.414174][T14344] ? __pfx___x64_sys_open+0x10/0x10 [ 735.419376][T14344] do_syscall_64+0x115/0x870 [ 735.423957][T14344] ? clear_bhb_loop+0x70/0xc0 [ 735.428614][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.434486][T14344] RIP: 0033:0x7f697099e0d9 [ 735.438880][T14344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 735.459436][T14344] RSP: 002b:00007f697190a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 735.467849][T14344] RAX: ffffffffffffffda RBX: 00007f6970c26090 RCX: 00007f697099e0d9 [ 735.475828][T14344] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0 [ 735.483780][T14344] RBP: 00007f6970a35024 R08: 0000000000000000 R09: 0000000000000000 [ 735.491745][T14344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 735.499695][T14344] R13: 00007f6970c26128 R14: 00007f6970c26090 R15: 00007ffdbb316c48 [ 735.507670][T14344] [ 735.510900][T14344] Kernel Offset: disabled [ 735.515202][T14344] Rebooting in 86400 seconds..