last executing test programs: 11.106867326s ago: executing program 2 (id=76): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffff9c, r0, 0x41, 0x1ff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0', 0x1) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x41) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SIGNAL_MSI(0xffffffffffffffff, 0x4020aea5, &(0x7f0000000300)={0xfeeff000, 0x0, 0x40}) read(r3, &(0x7f0000004000), 0x2000) write(0xffffffffffffffff, &(0x7f0000001000)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x28) read(r3, &(0x7f0000004000), 0x2000) 10.654210514s ago: executing program 3 (id=77): r0 = creat(&(0x7f0000000380)='./file0\x00', 0x40) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f000059d000/0x2000)=nil, 0x2000, 0x2, 0x12, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x3e, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) write$qrtrtun(r0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=[0x4], 0x0, 0x0, 0x2e, 0x1}}, 0x40) 9.456739145s ago: executing program 3 (id=79): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0xe, 0x2100, &(0x7f00000004c0)="df034affffffffffff0000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) 9.423645538s ago: executing program 2 (id=80): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f0000000100)="d0e3f2aa0fbb240f78fa66b9800000c00f326635010000000f30f77d830fe529dbe4bad00466b86800000066ef", 0x2d}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x119402, 0x0) getpid() r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) dup(r1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r5, 0x4030ae7b, &(0x7f0000000000)={0x200, 0x10, 0xd2, 0x5, 0x80}) 9.122507574s ago: executing program 3 (id=81): r0 = socket(0x10, 0x3, 0x0) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SNDCTL_TMR_START(r3, 0x5402) r4 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) fsconfig$FSCONFIG_SET_FD(r4, 0x5, 0x0, 0x0, r2) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r5, 0x890b, 0x0) connect$x25(r5, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) fchdir(0xffffffffffffffff) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x404c080) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x11622}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x1c, 0x7d}, @IFLA_BR_HELLO_TIME={0x8, 0x2, 0x9}, @IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0x1ff}, @IFLA_BR_MCAST_HASH_ELASTICITY={0x8, 0x1a, 0x7}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) 7.836629368s ago: executing program 2 (id=82): r0 = dup(0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000010c0)={'ip_vti0\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x0, 'syzkaller0\x00', {0x102}, 0xd}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x48) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.832098617s ago: executing program 4 (id=83): fsopen(&(0x7f0000000980)='iso9660\x00', 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x7, 0x0, 0x0, 0x6d}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000e8fbd5df29badce4b0293077315e67facbb50dd29586b41cd273cf669bc54bd557a2f76a083cfddf088d10bff3a36c883c98670551d4f2414cf40b851b929f255951b655e8dca1b8c7332c7e8d11b2333ce9dc37111980b964f9f8b535b0c74c0e9b0069ad71b0ec99233aab269391a43729d9c91e211ff7a714fa1003a741492fda54fad4e15de908ccec5d0c87529230aa106547109a1232b807813edda58723c1363c237a226ed72f12e0ee87fcc13060bedfc1", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lirc_mode2=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./mysys\x00', 0x1ff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = getpid() sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x6b7e369c4a37b0ea) prctl$PR_SET_MM_MAP(0x26, 0xe, 0x0, 0x0) ioprio_set$pid(0x1, r3, 0x2007) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e20, @remote}, 0x10) r5 = socket(0xa, 0x1, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd700000000000010000001c0007800c00018008000100", @ANYRES32=r5, @ANYBLOB="0c00018808000100", @ANYRES32=r5, @ANYBLOB="0c0002"], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x2000c854) mount(0x0, &(0x7f0000000040)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x3, 0x0) 6.745066169s ago: executing program 3 (id=85): pipe(0x0) r0 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f00000005c0)='fd', 0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000400)={0x24, r1, 0x62c21a4ade68aba1, 0x0, 0x2, {{0x32}, {@val={0x8, 0x1, 0x60}, @val={0x8, 0x3, r3}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004895}, 0x40010) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3cd6d66d473e000000", @ANYRES16=r1, @ANYBLOB="100027bd7000ffdbdf252700000008000300", @ANYRES32=r4, @ANYBLOB="0c00990000000000740000000a0034000101010101010000"], 0x34}, 0x1, 0x0, 0x0, 0x20}, 0x800) r5 = io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1fb}) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYBLOB='\b\x00\x00'], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x20040000) sendmsg$NFT_BATCH(r6, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0x0, 0x0, 0x6000}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) dup2(0xffffffffffffffff, r5) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) 6.396265298s ago: executing program 1 (id=86): r0 = socket(0x10, 0x3, 0x0) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SNDCTL_TMR_START(r1, 0x5402) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) mq_open(&(0x7f0000000400)='!s\xc6(X\xc7_\xa4BM\xa0\xdc]q\xc6\xc0\xbd4yL\x0f\xb2(O\xd7\"D\x9e\xae\xd0Bf\xa2WICn)\xd62\t\b\x9cK\xc8Q\xf6\xa9\xb7pa\x8c\xb2\x1c\xe3\x94\"\xc3\x0e\xb2N\xac\xf9\x10\ra\xef\x05\xc6f\x92\xd1$\xbbh\xe9\x85\xd7<\x8er\x82\"\xc0D\xcb)\xfc\xdf\x88V\xd9\xee\xb8j\x1dO\xd5\xbf\x8cY\x14\xf0*`\xbe\x87\xbb\xfe\xdc\x89\xf5{\xd1\xa6\xf0\xe0\x17jj\xf7\x1dJ\x89\x93\x84\xbe\x05\x89\xc3\xa6>\x90\x9b\xee\x96\xba\x1a\f\xf0\xcd\xa3#\x1biJ\x8b\x19\x8e\xd5P\xeb\r\xc9I~#6x\xf9\r\x87\xac3[zt\xd0e\x10\xd8\x90v\xad2\xa3w\"}\x84\x95p\xfc\xf7F\xfe\x8c\xf5\xfc[\xd6\xaa\x90\x18\xc1 \xa5;\x92\xa2\xe6\x0f%\xf7\x9c\xb5\x0fQ\x0e|T\xf7\x8c\xa9g\xa0\xcdP\n\x9a\x88Q\x8d~&\xcev\x01\x8e\xd07\xb4\xba\xb3\xf7\xfb\xcf\x12i\tw\x9d\xa1d\x84\xe3\x7f\xaci=4\xad\x02\xe6\x7fz\xa2\x01CN\x9d\x93\x14\x8fq\xb2f\x88x,xHe\xd0\xe8o\x88K\x8f\x8c\xa6\xd8*f\xc8j\xd9\n\xa2Q0\xc0\xe1\x81k\xf2\xe1\xcf\xc6\x1d\xd1Z\xa5\xe7\xb6=\xdb\x06n\x9b\xda\x8ah\xd4\xaa\x8c\xe7d\xf9\\\xef\xb0+\x8d)n\xbe=\x1b\x9bu\x16U\x86Q\xcf\xf0\xfb\x0e\aSQ)\xfcf\x1e\x04\xebf0^(\x00\x11\x13\xe6\x1f\xde\x98\x05\x00\x00\x00\xd8\x04<@\x8c1\\\x93\xc4\v\xd8\x06\xb2\x87\x8a|\xe1\xde\xdb\xdcD\xa3\xeeYL\x90\x13\xa5[\x8f\xb9\xc3\xee \x8ey\x85\xde`\xda\x97n \xacy\xf2k\xcec1C\xf1\xbb\xa5E38kE\x84Z\xca@p\xa8N\n\x9a\xdd\x9eT\xe0b\xcd\xff\xf9\xec\x8c\xc2\x1eV\xc5\xa6\xeb\xe6\x977\x18\xc3\x01\xee\xe0c\x0f\xbb\n&[\xc2\xef\xe8\x9d\xce);r\xbd\a\x93\xce5l\x1c1\xd5$\a\x1fW\x1d(>t\x81\x9bH1\x11\xd9W\xc5\x91\x96\x1a5\x8d\xa4o\r\xec\xdc|]\xef\x81\xcd\x90\x05\xd1\xea\xc4q-\xf8\xe6ZG\xdcz\xa1n\x8e\x94\x89o\xbf\xf7O\v\xc2\x97%\xc1\x14\xa7F\xc3\x13\xae\xa1\xc7+\xd0S\xd7w\x87\xd2\xdc\xbf\x86>\xfa\xf9\xb9\xc8\xef\xb5!\xda \xaf\xbd8%\b\xd4\xfd\xc9\x00\x05p\xf7Y\x17\x90\x8f7B\xbfSO\xb55e\x8e\x83\x95', 0x40, 0x90, 0x0) ioctl(r2, 0x890b, 0x0) connect$x25(r2, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) fchdir(0xffffffffffffffff) openat2(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x404c080) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x11622}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x1c, 0x7d}, @IFLA_BR_HELLO_TIME={0x8, 0x2, 0x9}, @IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0x1ff}, @IFLA_BR_MCAST_HASH_ELASTICITY={0x8, 0x1a, 0x7}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) 6.269353122s ago: executing program 1 (id=87): ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000240)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\x00', @ANYRESOCT=r0, @ANYBLOB="2c7766c46e6f3d37d7e599b417161d2703989c4a5b25ec4ffe3da15f44d68683819dfc90b7235a2795eee08a7b97f7a436f344e33d0684fe49b558807639d48504b6bcb7b0f8c2ada730112820e5d8606aa873afb42d0e450294cf40942bd6031a0bb32c7820176e62e7135c7a8d1b9fcbf6dbd1e8a78461caeac30853d1970bf9a2502f7cc8e4a2b7c80252f0fad73c9be90dd2d6d672625efb89f39b631c44c67a0bf78800d9f1474024710b6278ff6038e4184996ba5794e0c6e7852a211eebf589d4a8828582f185aa6019afbd9eda42edc05a64", @ANYRESHEX=r1, @ANYBLOB=',\x00']) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newtaction={0x240, 0x30, 0x1, 0x70bd29, 0x25dfdbfb, {}, [{0x22c, 0x1, [@m_skbedit={0x40, 0x3ffd, 0x0, 0x0, {{0xc}, {0x14, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x10, 0xffff}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x6}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x1e8, 0x1e, 0x0, 0x0, {{0x8}, {0xe4, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS={0x44, 0x4, [{0x200, 0x12, 0xc, 0x6}, {0x8, 0x0, 0x9, 0x6}, {0x8, 0x3, 0x95, 0x7}, {0x6, 0x0, 0x8b, 0xc02}, {0x401, 0x8, 0xfb, 0x8}, {0x4, 0xff, 0x5}, {0x3, 0x7, 0x5, 0x1ff}, {0x4, 0xe, 0x1, 0x8}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xfffffff0, 0xffff, 0x8, 0x3}}, @TCA_ACT_BPF_OPS={0x24, 0x4, [{0x3ff, 0xf7, 0xd, 0x7}, {0x1, 0x8, 0x3c, 0x1ff}, {0x9, 0x4, 0xb, 0x4}, {0x6, 0x1, 0xb, 0x5a8f}]}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x8002, 0x6, 0x1, 0x4}, {0xc3b, 0x7, 0xfa, 0x100}, {0x79, 0x2e, 0x4, 0x6}, {0x5, 0x40, 0x7, 0x6}, {0x1, 0x5, 0x1, 0x3}, {0xd1, 0x40, 0xc, 0x5f10}, {0x8, 0x3, 0x30, 0x10000}]}]}, {0xdd, 0x6, "3e1551f433c60ec379cecb6f9bed8f84d19a5aad5a522503802da329c241653353310fe1d2745093855a174379fc819fe3b0fdead2765254e2124c175970dcd2546191eec14bc082f2998ecd8a958ed567717cf215ebb053c30e03a721a8034b55d41676574a0a4596fab7c8fcfed58cd723ea445d04e101d7c2f3c3039899e56cdc7212619cc5e614e863f1743bf5f341fb910620561f6888fdd510d7db38e497af8ebb20370af4151ceaa6aca365ed1db3096a9014a0267a929ae03d03ec0418570c07fd61fff026dccdd4e3070cc0af9b686737e2e4e551"}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x240}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f00000001c0)=@getchain={0x24, 0x66, 0x400, 0x6, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xf9c928fb2f4a0ee5}, {0x8, 0xa}, {0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x8004}, 0x40000) syz_usb_ep_write(0xffffffffffffffff, 0x83, 0x0, 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x4, 0x0, 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x4, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x2000}, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000440)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000180)=0xe8) fchown(0xffffffffffffffff, r2, 0x0) 5.824629187s ago: executing program 2 (id=88): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xc, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x60}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) 5.164893665s ago: executing program 2 (id=89): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x0) syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0xffffffc2, &(0x7f0000000040)=ANY=[]) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x890d000) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x1}, 0x38) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={0xffffffffffffffff, &(0x7f0000001600), &(0x7f0000001680)=""/227}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) 5.137089889s ago: executing program 1 (id=90): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffff9c, r0, 0x41, 0x1ff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0', 0x1) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x41) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SIGNAL_MSI(0xffffffffffffffff, 0x4020aea5, &(0x7f0000000300)={0xfeeff000, 0x0, 0x40}) read(r3, &(0x7f0000004000), 0x2000) write(0xffffffffffffffff, &(0x7f0000001000)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x2b) read(r3, &(0x7f0000004000), 0x2000) 4.393480814s ago: executing program 0 (id=91): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x6}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.341202982s ago: executing program 4 (id=92): r0 = socket(0x10, 0x3, 0x0) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SNDCTL_TMR_START(r2, 0x5402) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) mq_open(&(0x7f0000000400)='!s\xc6(X\xc7_\xa4BM\xa0\xdc]q\xc6\xc0\xbd4yL\x0f\xb2(O\xd7\"D\x9e\xae\xd0Bf\xa2WICn)\xd62\t\b\x9cK\xc8Q\xf6\xa9\xb7pa\x8c\xb2\x1c\xe3\x94\"\xc3\x0e\xb2N\xac\xf9\x10\ra\xef\x05\xc6f\x92\xd1$\xbbh\xe9\x85\xd7<\x8er\x82\"\xc0D\xcb)\xfc\xdf\x88V\xd9\xee\xb8j\x1dO\xd5\xbf\x8cY\x14\xf0*`\xbe\x87\xbb\xfe\xdc\x89\xf5{\xd1\xa6\xf0\xe0\x17jj\xf7\x1dJ\x89\x93\x84\xbe\x05\x89\xc3\xa6>\x90\x9b\xee\x96\xba\x1a\f\xf0\xcd\xa3#\x1biJ\x8b\x19\x8e\xd5P\xeb\r\xc9I~#6x\xf9\r\x87\xac3[zt\xd0e\x10\xd8\x90v\xad2\xa3w\"}\x84\x95p\xfc\xf7F\xfe\x8c\xf5\xfc[\xd6\xaa\x90\x18\xc1 \xa5;\x92\xa2\xe6\x0f%\xf7\x9c\xb5\x0fQ\x0e|T\xf7\x8c\xa9g\xa0\xcdP\n\x9a\x88Q\x8d~&\xcev\x01\x8e\xd07\xb4\xba\xb3\xf7\xfb\xcf\x12i\tw\x9d\xa1d\x84\xe3\x7f\xaci=4\xad\x02\xe6\x7fz\xa2\x01CN\x9d\x93\x14\x8fq\xb2f\x88x,xHe\xd0\xe8o\x88K\x8f\x8c\xa6\xd8*f\xc8j\xd9\n\xa2Q0\xc0\xe1\x81k\xf2\xe1\xcf\xc6\x1d\xd1Z\xa5\xe7\xb6=\xdb\x06n\x9b\xda\x8ah\xd4\xaa\x8c\xe7d\xf9\\\xef\xb0+\x8d)n\xbe=\x1b\x9bu\x16U\x86Q\xcf\xf0\xfb\x0e\aSQ)\xfcf\x1e\x04\xebf0^(\x00\x11\x13\xe6\x1f\xde\x98\x05\x00\x00\x00\xd8\x04<@\x8c1\\\x93\xc4\v\xd8\x06\xb2\x87\x8a|\xe1\xde\xdb\xdcD\xa3\xeeYL\x90\x13\xa5[\x8f\xb9\xc3\xee \x8ey\x85\xde`\xda\x97n \xacy\xf2k\xcec1C\xf1\xbb\xa5E38kE\x84Z\xca@p\xa8N\n\x9a\xdd\x9eT\xe0b\xcd\xff\xf9\xec\x8c\xc2\x1eV\xc5\xa6\xeb\xe6\x977\x18\xc3\x01\xee\xe0c\x0f\xbb\n&[\xc2\xef\xe8\x9d\xce);r\xbd\a\x93\xce5l\x1c1\xd5$\a\x1fW\x1d(>t\x81\x9bH1\x11\xd9W\xc5\x91\x96\x1a5\x8d\xa4o\r\xec\xdc|]\xef\x81\xcd\x90\x05\xd1\xea\xc4q-\xf8\xe6ZG\xdcz\xa1n\x8e\x94\x89o\xbf\xf7O\v\xc2\x97%\xc1\x14\xa7F\xc3\x13\xae\xa1\xc7+\xd0S\xd7w\x87\xd2\xdc\xbf\x86>\xfa\xf9\xb9\xc8\xef\xb5!\xda \xaf\xbd8%\b\xd4\xfd\xc9\x00\x05p\xf7Y\x17\x90\x8f7B\xbfSO\xb55e\x8e\x83\x95', 0x40, 0x90, 0x0) ioctl(r3, 0x890b, 0x0) connect$x25(r3, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) fchdir(0xffffffffffffffff) openat2(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x404c080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x11622}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x1c, 0x7d}, @IFLA_BR_HELLO_TIME={0x8, 0x2, 0x9}, @IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0x1ff}, @IFLA_BR_MCAST_HASH_ELASTICITY={0x8, 0x1a, 0x7}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) 4.328144383s ago: executing program 0 (id=93): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x7) syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 4.186568342s ago: executing program 1 (id=94): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdir(&(0x7f0000000240)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) 4.183181855s ago: executing program 3 (id=95): r0 = openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x20800) syz_io_uring_setup(0xf00, &(0x7f0000000040)={0x0, 0x595e, 0x10000, 0x0, 0x4e}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='exfat\x00', 0x8000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a6e65742c6966616365"], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x0) fanotify_init(0x1a, 0x800) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) r3 = fanotify_init(0x0, 0x0) fanotify_mark(r3, 0x1, 0x4800001a, r2, 0x0) fanotify_mark(r0, 0x4, 0x20, r2, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat(r0, &(0x7f0000000280)='./file0\x00', 0x320080, 0x88) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000000906010200000000000000000200fdff300007800c00018008000140e564a494a881cae8000001140017006261746164765f736c6176655f3000000c00028008000140640101010900020073797a31000000000500010007", @ANYRESDEC=0x0], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x40c0080) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000001c0), 0x0, 0x240047) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000ffe000/0x1000)=nil) r8 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) 3.149749274s ago: executing program 4 (id=96): syz_open_dev$vbi(&(0x7f0000000280), 0x3, 0x2) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'dummy0\x00'}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') read$eventfd(r4, 0x0, 0x0) 2.84872351s ago: executing program 1 (id=97): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f0000000100)="d0e3f2aa0fbb240f78fa66b9800000c00f326635010000000f30f77d830fe529dbe4bad00466b86800000066ef", 0x2d}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x119402, 0x0) getpid() r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) dup(r1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r6, 0x4030ae7b, &(0x7f0000000000)={0x200, 0x10, 0xd2, 0x5, 0x80}) 2.597687047s ago: executing program 3 (id=98): syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @random="008212924e1f", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @echo_reply={0x0, 0x0, 0x0, 0x65, 0x7}}}}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000700), 0x5cd600, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xfff2}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, 0x0, 0x30, 0x0, @void}, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x4000040) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000440)={0x1, 0xffffffffffffffff, 'id1\x00'}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r3, 0x89f4, &(0x7f0000000500)={'sit0\x00', &(0x7f00000004c0)={@multicast2, 0x0, 0x0, 0x10, 0x0, [{}]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) getegid() r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0x14, 0x0, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) ioctl$VIDIOC_S_FBUF(r6, 0x402c560b, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000140)="bbf6e3f524ec28b878e95edca4a2b40f8938430f84a67915d0380e55597ba1e0a02c550422c411476ef514aa2515c2284b95c83ad71abd152ce2591586ec", {0x3, 0x1, 0x38416761, 0x2, 0x5, 0x16db, 0x6, 0x1ff}}) syz_usb_connect$uac3(0x5, 0x9c, &(0x7f00000001c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x41e, 0x4064, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0x7e, 0x20, 0xf1, {0x8, 0xb, 0x1, 0x0, 0x1, 0x23, 0x30, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x5, 0xa, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x9c}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x8, 0x1, 0x5, {0xa, 0x25, 0x25, 0x9, 0x91, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x34}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x401, 0xa, 0x5, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x6, 0x6, 0x16, {0xa, 0x25, 0x25, 0x1, 0x8, 0x8}}}}}}}}]}}, &(0x7f0000000640)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x201, 0x7, 0x81, 0x9, 0x40, 0x37}, 0x0, 0x0, 0x6, [{0x8d, &(0x7f0000000380)=@string={0x8d, 0x3, "7f64bd858ec4c174fa9e5ada381c609dadb6fe607a96016afc5302596662de3cc1ec4e70a4aa9e0e28440131c9b6e0f4571d861b1f72a7ec603d38e2f42edcde520dee10a7a071752c99a1b3d22544e431ec0b17a8aaddcc9233fedef48a31ada990959c3dbc087ddccfb323eb4011b8aa0d49dec47f00bc766367f51f1f7631f39ca049a2cf5b0049747c"}}, {0x0, 0x0}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x423}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x48}}, {0xb, &(0x7f00000005c0)=@string={0xb, 0x3, "5a1c41342fec266888"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x1407}}]}) write(r6, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) syz_emit_ethernet(0x32, &(0x7f00000002c0)={@multicast, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0xfffd, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x17c1, 0x0, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}, '\x00\x00\x00\x00'}}}}}}, 0x0) getpeername$packet(r5, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f0000000300)=0x14) setsockopt$packet_drop_memb(r5, 0x107, 0x2, &(0x7f0000000340)={r7, 0x1, 0x6, @local}, 0x10) 2.326803373s ago: executing program 2 (id=99): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0x8, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) capset(0x0, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r2, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r2, &(0x7f00000002c0)=[{{&(0x7f0000000a00)={0xa, 0x4e23, 0x0, @loopback, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x20004004) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x7, 0x3000001, 0xbd4c341840b03bf2, 0xffffffffffffffff, 0x8000000) munlockall() r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x7) sched_setattr(r3, &(0x7f0000000080)={0x38, 0x5, 0x10000010, 0x1, 0x1, 0x9, 0x7fff, 0x6, 0x84b, 0xff}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000000380)={0x0, 0x1, 0x0, &(0x7f00000000c0), &(0x7f0000000140)=[0x2]}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) r5 = socket(0x40000000015, 0x5, 0x0) sendmsg$inet(r5, 0x0, 0x40) getsockopt(r5, 0x200000000114, 0x2715, &(0x7f0000000580)=""/102393, &(0x7f0000000400)=0x18ff9) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000808, 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x3) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x24e23, @empty}, 0x10) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000040)=0x433b, 0x4) sendto$inet(r6, &(0x7f0000000540)='v', 0x1, 0x4040, 0x0, 0x0) io_uring_setup(0x5594, &(0x7f0000000100)={0x0, 0x10000000, 0x1, 0x1, 0x21e}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r7, &(0x7f0000000440), 0x10) listen(r7, 0x0) 1.929723399s ago: executing program 0 (id=100): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xc, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x60}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) 1.722825426s ago: executing program 4 (id=101): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[], 0x0, 0x28}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x8, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r6}, 0xc) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r8, 0x84, 0x1, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000001c0)=ANY=[@ANYRESHEX=r2, @ANYRESHEX=0x0, @ANYRESHEX=r4, @ANYRES8=r8, @ANYRES16=r1, @ANYRES32=0x0], 0x78}, 0x1, 0x0, 0x0, 0x30}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f00000011c0)={r0}) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') 1.721004018s ago: executing program 0 (id=102): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="10000000"], 0x48) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e000100"], 0x50}}, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) r5 = gettid() tkill(r5, 0x16) r6 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f00000001c0)={0x2, 0x100, 0x3, {0x4, 0xfffffffe, 0x6, 0x870}}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c800"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) dup(r7) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000100)=@assoc_value, &(0x7f0000000000)=0x8) 1.390160126s ago: executing program 1 (id=103): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x18000000) 678.78538ms ago: executing program 0 (id=104): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffff9c, r0, 0x41, 0x1ff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0', 0x1) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x41) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SIGNAL_MSI(0xffffffffffffffff, 0x4020aea5, &(0x7f0000000300)={0xfeeff000, 0x0, 0x40}) read(r3, &(0x7f0000004000), 0x2000) write(0xffffffffffffffff, &(0x7f0000001000)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x2b) read(r3, &(0x7f0000004000), 0x2000) 677.670795ms ago: executing program 4 (id=105): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x6}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 294.878318ms ago: executing program 4 (id=106): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'team_slave_0\x00', &(0x7f00000003c0)=@ethtool_perm_addr={0x20, 0x7, "2ed2414e6ce393"}}) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'ip6_vti0\x00', 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000400)='ns\x00') ioctl$XFS_IOC_GETPARENTS(r1, 0xc028583e, &(0x7f0000000300)={{[0x9, 0x2, 0x5, 0x7]}, 0x0, 0x3, 0xabdd, 0x0, &(0x7f0000000180)=[{{@align=0x80000001, {0x9, 0x5, 0x1}}, 0x7, 0x0, '%\')\x00'}]}) syz_usb_connect$uac2(0x0, 0x8f, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x2a39, 0x3fb0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7d, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_RUN(r1, 0xae80, 0x0) timer_create(0x8, 0x0, &(0x7f0000000000)) 0s ago: executing program 0 (id=107): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x6, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) capset(0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004004) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x12141, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, 0x0, 0xd) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, 0x0, 0x0) kernel console output (not intermixed with test programs): [ 56.269623][ T29] audit: type=1400 audit(1787215045.777:111): avc: denied { write } for pid=5448 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.326689][ T29] audit: type=1400 audit(1787215045.827:112): avc: denied { write } for pid=5459 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.838086][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 56.838102][ T29] audit: type=1400 audit(1787215046.337:116): avc: denied { write } for pid=5487 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.023965][ T29] audit: type=1400 audit(1787215046.527:117): avc: denied { write } for pid=5490 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.068411][ T29] audit: type=1400 audit(1787215046.567:118): avc: denied { write } for pid=5501 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.244636][ T29] audit: type=1400 audit(1787215046.747:119): avc: denied { write } for pid=5504 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.292400][ T29] audit: type=1400 audit(1787215046.797:120): avc: denied { write } for pid=5515 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.465081][ T29] audit: type=1400 audit(1787215046.967:121): avc: denied { write } for pid=5518 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.512897][ T29] audit: type=1400 audit(1787215047.017:122): avc: denied { write } for pid=5529 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.687930][ T29] audit: type=1400 audit(1787215047.187:123): avc: denied { write } for pid=5532 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.738893][ T29] audit: type=1400 audit(1787215047.237:124): avc: denied { write } for pid=5543 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.908121][ T29] audit: type=1400 audit(1787215047.407:125): avc: denied { write } for pid=5546 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.241' (ED25519) to the list of known hosts. [ 62.524485][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 62.524500][ T29] audit: type=1400 audit(1787215052.027:129): avc: denied { mounton } for pid=5582 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 62.554704][ T29] audit: type=1400 audit(1787215052.057:130): avc: denied { mount } for pid=5582 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.557927][ T5582] cgroup: Unknown subsys name 'net' [ 62.584558][ T29] audit: type=1400 audit(1787215052.087:131): avc: denied { unmount } for pid=5582 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.702049][ T5582] cgroup: Unknown subsys name 'cpuset' [ 62.709932][ T5582] cgroup: Unknown subsys name 'rlimit' [ 62.858832][ T29] audit: type=1400 audit(1787215052.357:132): avc: denied { setattr } for pid=5582 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 62.902563][ T29] audit: type=1400 audit(1787215052.357:133): avc: denied { create } for pid=5582 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.923773][ T29] audit: type=1400 audit(1787215052.357:134): avc: denied { write } for pid=5582 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.945384][ T29] audit: type=1400 audit(1787215052.357:135): avc: denied { read } for pid=5582 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.954447][ T5585] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 62.975408][ T29] audit: type=1400 audit(1787215052.477:136): avc: denied { relabelto } for pid=5585 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 63.001102][ T29] audit: type=1400 audit(1787215052.477:137): avc: denied { write } for pid=5585 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 63.027872][ T29] audit: type=1400 audit(1787215052.507:138): avc: denied { read } for pid=5582 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 63.951881][ T5582] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.394743][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 68.394759][ T29] audit: type=1400 audit(1787215057.897:141): avc: denied { create } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 68.431124][ T29] audit: type=1400 audit(1787215057.897:142): avc: denied { create } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 68.452955][ T29] audit: type=1400 audit(1787215057.897:143): avc: denied { read write } for pid=5593 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 68.477397][ T29] audit: type=1400 audit(1787215057.897:144): avc: denied { open } for pid=5593 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 68.510382][ T29] audit: type=1400 audit(1787215057.957:145): avc: denied { ioctl } for pid=5593 comm="syz-executor" path="socket:[4674]" dev="sockfs" ino=4674 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 68.541193][ T5603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.560302][ T5613] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.568766][ T5613] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.577761][ T5613] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.586395][ T5613] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.592176][ T5612] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.594814][ T5613] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.602227][ T5612] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.614395][ T5614] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.616359][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.623388][ T5613] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.631070][ T5612] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.638963][ T5613] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.645510][ T5616] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.657193][ T5614] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.660172][ T5616] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.667394][ T5613] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.672834][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.679453][ T5614] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.688527][ T5616] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.701672][ T5614] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.701993][ T5612] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.709483][ T5614] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.717068][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.730310][ T5617] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 68.739804][ T29] audit: type=1400 audit(1787215058.237:146): avc: denied { read } for pid=5594 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 68.774770][ T29] audit: type=1400 audit(1787215058.247:148): avc: denied { mounton } for pid=5596 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 68.800744][ T29] audit: type=1400 audit(1787215058.237:147): avc: denied { open } for pid=5594 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 68.846975][ T29] audit: type=1400 audit(1787215058.277:149): avc: denied { module_request } for pid=5595 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 68.870745][ T29] audit: type=1400 audit(1787215058.377:150): avc: denied { sys_module } for pid=5594 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 70.065588][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.072981][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.080449][ T5594] bridge_slave_0: entered allmulticast mode [ 70.087704][ T5594] bridge_slave_0: entered promiscuous mode [ 70.114926][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.122213][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.129762][ T5606] bridge_slave_0: entered allmulticast mode [ 70.136481][ T5606] bridge_slave_0: entered promiscuous mode [ 70.143502][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.150601][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.157704][ T5594] bridge_slave_1: entered allmulticast mode [ 70.164572][ T5594] bridge_slave_1: entered promiscuous mode [ 70.191674][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.198761][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.205930][ T5606] bridge_slave_1: entered allmulticast mode [ 70.212649][ T5606] bridge_slave_1: entered promiscuous mode [ 70.266056][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.273229][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.280495][ T5593] bridge_slave_0: entered allmulticast mode [ 70.287205][ T5593] bridge_slave_0: entered promiscuous mode [ 70.300031][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.311793][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.328144][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.335819][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.343748][ T5593] bridge_slave_1: entered allmulticast mode [ 70.350670][ T5593] bridge_slave_1: entered promiscuous mode [ 70.364534][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.375255][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.391085][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.398290][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.405533][ T5595] bridge_slave_0: entered allmulticast mode [ 70.412300][ T5595] bridge_slave_0: entered promiscuous mode [ 70.444179][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.451791][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.458925][ T5595] bridge_slave_1: entered allmulticast mode [ 70.466430][ T5595] bridge_slave_1: entered promiscuous mode [ 70.479346][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.486564][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.493932][ T5596] bridge_slave_0: entered allmulticast mode [ 70.500849][ T5596] bridge_slave_0: entered promiscuous mode [ 70.515058][ T5594] team0: Port device team_slave_0 added [ 70.529165][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.540436][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.549842][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.556990][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.564387][ T5596] bridge_slave_1: entered allmulticast mode [ 70.571239][ T5596] bridge_slave_1: entered promiscuous mode [ 70.579641][ T5606] team0: Port device team_slave_0 added [ 70.586789][ T5594] team0: Port device team_slave_1 added [ 70.619032][ T5606] team0: Port device team_slave_1 added [ 70.633773][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.644380][ T5593] team0: Port device team_slave_0 added [ 70.671107][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.688159][ T5593] team0: Port device team_slave_1 added [ 70.696172][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.712831][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.720077][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.746121][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.771726][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.785634][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.790516][ T5612] Bluetooth: hci4: command tx timeout [ 70.793009][ T5617] Bluetooth: hci2: command tx timeout [ 70.798690][ T5603] Bluetooth: hci1: command tx timeout [ 70.804196][ T5617] Bluetooth: hci0: command tx timeout [ 70.804343][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.809928][ T50] Bluetooth: hci3: command tx timeout [ 70.815481][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.858129][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.865145][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.891150][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.903827][ T5595] team0: Port device team_slave_0 added [ 70.911006][ T5595] team0: Port device team_slave_1 added [ 70.930692][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.937712][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.963681][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.987528][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.994569][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.021041][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.050231][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.057267][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.083893][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.096418][ T5596] team0: Port device team_slave_0 added [ 71.112173][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.119067][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.120514][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.132455][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.158476][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.175786][ T5596] team0: Port device team_slave_1 added [ 71.186354][ T5594] hsr_slave_0: entered promiscuous mode [ 71.192789][ T5594] hsr_slave_1: entered promiscuous mode [ 71.200935][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.207931][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.234101][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.274843][ T5606] hsr_slave_0: entered promiscuous mode [ 71.280999][ T5606] hsr_slave_1: entered promiscuous mode [ 71.286954][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 71.292790][ T5606] Cannot create hsr debugfs directory [ 71.339531][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.346575][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.372547][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.398325][ T5595] hsr_slave_0: entered promiscuous mode [ 71.404529][ T5595] hsr_slave_1: entered promiscuous mode [ 71.410719][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 71.416541][ T5595] Cannot create hsr debugfs directory [ 71.425460][ T5593] hsr_slave_0: entered promiscuous mode [ 71.432040][ T5593] hsr_slave_1: entered promiscuous mode [ 71.438043][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 71.443830][ T5593] Cannot create hsr debugfs directory [ 71.451156][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.458204][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.484657][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.611393][ T5596] hsr_slave_0: entered promiscuous mode [ 71.617709][ T5596] hsr_slave_1: entered promiscuous mode [ 71.624154][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 71.629951][ T5596] Cannot create hsr debugfs directory [ 71.888018][ T5606] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 71.900884][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.909991][ T5606] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 71.918337][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.926268][ T5606] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 71.935947][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.943679][ T5606] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 71.952623][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.014044][ T5594] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 72.028139][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.043891][ T5594] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 72.054345][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.062836][ T5594] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 72.072745][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.080549][ T5594] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 72.089095][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.144711][ T5595] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.154375][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.162127][ T5595] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.171938][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.180065][ T5595] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.188915][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.200507][ T5595] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.209075][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.237512][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.297353][ T5593] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.306694][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.315035][ T5593] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.324026][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.334923][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.346560][ T5593] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.357329][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.365509][ T5593] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.373946][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.420909][ T439] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.428417][ T439] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.453979][ T439] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.461345][ T439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.528313][ T5596] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.536820][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.544661][ T5596] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.554333][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.564451][ T5596] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.573602][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.581696][ T5596] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.590567][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.646368][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.661187][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.697954][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.723405][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.750950][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.758043][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.777694][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.784897][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.805486][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.818997][ T439] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.826181][ T439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.838196][ T439] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.845350][ T439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.869559][ T5612] Bluetooth: hci3: command tx timeout [ 72.875534][ T5603] Bluetooth: hci2: command tx timeout [ 72.875606][ T5617] Bluetooth: hci1: command tx timeout [ 72.884435][ T50] Bluetooth: hci0: command tx timeout [ 72.887208][ T5609] Bluetooth: hci4: command tx timeout [ 72.948176][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.992634][ T170] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.999847][ T170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.043112][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.050283][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.121265][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.198249][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.227760][ T1107] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.234954][ T1107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.280373][ T1107] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.287575][ T1107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.311880][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.847733][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.888702][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.983785][ T5606] veth0_vlan: entered promiscuous mode [ 74.039221][ T5606] veth1_vlan: entered promiscuous mode [ 74.057812][ T5595] veth0_vlan: entered promiscuous mode [ 74.084955][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.104838][ T5594] veth0_vlan: entered promiscuous mode [ 74.122289][ T5595] veth1_vlan: entered promiscuous mode [ 74.165298][ T5594] veth1_vlan: entered promiscuous mode [ 74.187815][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.206936][ T5606] veth0_macvtap: entered promiscuous mode [ 74.226352][ T5606] veth1_macvtap: entered promiscuous mode [ 74.245102][ T5595] veth0_macvtap: entered promiscuous mode [ 74.252422][ T5593] veth0_vlan: entered promiscuous mode [ 74.276140][ T5595] veth1_macvtap: entered promiscuous mode [ 74.285774][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.294863][ T5593] veth1_vlan: entered promiscuous mode [ 74.311830][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.328473][ T5594] veth0_macvtap: entered promiscuous mode [ 74.339153][ T5594] veth1_macvtap: entered promiscuous mode [ 74.364902][ T5596] veth0_vlan: entered promiscuous mode [ 74.402041][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.413452][ T5596] veth1_vlan: entered promiscuous mode [ 74.427113][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.443087][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.475681][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.485283][ T5593] veth0_macvtap: entered promiscuous mode [ 74.522496][ T170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.533223][ T170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.536812][ T5593] veth1_macvtap: entered promiscuous mode [ 74.550244][ T62] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.621289][ T439] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.637467][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.637573][ T439] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.649412][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.678781][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.686641][ T5596] veth0_macvtap: entered promiscuous mode [ 74.699037][ T5596] veth1_macvtap: entered promiscuous mode [ 74.703263][ T29] audit: type=1400 audit(1787215064.197:151): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.se0Fsw/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 74.730578][ T29] audit: type=1400 audit(1787215064.197:152): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 74.765788][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.771593][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.781357][ T29] audit: type=1400 audit(1787215064.217:153): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.se0Fsw/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 74.783597][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.809475][ T29] audit: type=1400 audit(1787215064.217:154): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 74.816778][ T170] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.845434][ T29] audit: type=1400 audit(1787215064.217:155): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.se0Fsw/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 74.878101][ T29] audit: type=1400 audit(1787215064.217:156): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.se0Fsw/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7983 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 74.878993][ T5606] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 74.923464][ T29] audit: type=1400 audit(1787215064.217:157): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 74.930739][ T170] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.946637][ T29] audit: type=1400 audit(1787215064.267:158): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 74.958868][ T5609] Bluetooth: hci4: command tx timeout [ 74.977727][ T50] Bluetooth: hci1: command tx timeout [ 74.981545][ T5609] Bluetooth: hci0: command tx timeout [ 74.992073][ T5617] Bluetooth: hci3: command tx timeout [ 74.997751][ T5617] Bluetooth: hci2: command tx timeout [ 74.998426][ T29] audit: type=1400 audit(1787215064.267:159): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="gadgetfs" ino=6827 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 75.034895][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.054619][ T29] audit: type=1400 audit(1787215064.277:160): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 75.088808][ T62] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.118186][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.132924][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.168926][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.177338][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.223422][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.233753][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.245406][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.253526][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.394505][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.403743][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.418244][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.455134][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.465075][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.491418][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.580332][ T5797] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 75.592019][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.620672][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.793779][ T5799] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 75.977671][ T5801] netlink: 'syz.3.4': attribute type 10 has an invalid length. [ 76.202190][ T439] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.236424][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.274050][ T5799] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.282525][ T5799] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.303421][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.350726][ T5799] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.357962][ T5799] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.365879][ T5799] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.373039][ T5799] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.419088][ T5799] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 76.432150][ T170] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.453061][ T5801] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.461486][ T5801] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.501206][ T5801] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.508366][ T5801] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.515905][ T5801] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.523141][ T5801] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.575816][ T5801] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 76.651872][ T62] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.822915][ T5812] netlink: 'syz.4.6': attribute type 10 has an invalid length. [ 76.891857][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.929696][ T35] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.022748][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.030191][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.037726][ T5617] Bluetooth: hci1: command tx timeout [ 77.045414][ T5609] Bluetooth: hci3: command tx timeout [ 77.050886][ T5609] Bluetooth: hci4: command tx timeout [ 77.054198][ T5612] Bluetooth: hci2: command tx timeout [ 77.056362][ T5617] Bluetooth: hci0: command tx timeout [ 77.110261][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.117610][ T5812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.125549][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.132901][ T5812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.230290][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 77.272536][ T5820] netlink: 'syz.3.8': attribute type 10 has an invalid length. [ 77.506270][ T5812] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 77.529558][ T170] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.566977][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.574160][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.662887][ T9] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 77.737706][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 77.801376][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.864416][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 77.924118][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 77.950762][ T9] usb 1-1: Product: syz [ 77.967726][ T5617] Bluetooth: Wrong link type (-57) [ 77.969531][ T9] usb 1-1: Manufacturer: syz [ 78.684510][ T9] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 78.812722][ T3331] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.104893][ T9] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 79.184109][ T3331] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.252937][ T9] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 79.411097][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.640454][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.931525][ T29] kauditd_printk_skb: 36 callbacks suppressed [ 79.931536][ T29] audit: type=1400 audit(1787215069.437:197): avc: denied { create } for pid=5833 comm="syz.4.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 79.964014][ T9] usb 1-1: USB disconnect, device number 2 [ 79.971999][ T1152] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.045056][ T5836] netlink: 'syz.4.10': attribute type 1 has an invalid length. [ 80.073877][ T9] garmin_gps 1-1:1.0: device disconnected [ 80.131055][ T29] audit: type=1400 audit(1787215069.527:198): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 80.173447][ T5834] misc userio: Begin command sent, but we're already running [ 80.184717][ T5836] netlink: 232 bytes leftover after parsing attributes in process `syz.4.10'. [ 80.210637][ T29] audit: type=1400 audit(1787215069.637:199): avc: denied { read } for pid=5833 comm="syz.4.10" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 80.248985][ T5836] netlink: 'syz.4.10': attribute type 1 has an invalid length. [ 80.283486][ T29] audit: type=1400 audit(1787215069.637:200): avc: denied { open } for pid=5833 comm="syz.4.10" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 80.306946][ T29] audit: type=1400 audit(1787215069.637:201): avc: denied { ioctl } for pid=5833 comm="syz.4.10" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 80.614789][ T29] audit: type=1400 audit(1787215070.117:202): avc: denied { create } for pid=5848 comm="syz.4.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.739820][ T5738] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 80.753688][ T29] audit: type=1400 audit(1787215070.157:203): avc: denied { ioctl } for pid=5841 comm="syz.2.11" path="/dev/video0" dev="devtmpfs" ino=931 ioctlcmd=0x5608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 81.396648][ T29] audit: type=1400 audit(1787215070.317:204): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 81.439437][ T5738] usb 4-1: Using ep0 maxpacket: 16 [ 81.512766][ T5738] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 81.566127][ T5738] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 81.602497][ T5738] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 81.672040][ T5738] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 81.740957][ T29] audit: type=1400 audit(1787215071.237:205): avc: denied { write } for pid=5853 comm="syz.0.14" path="socket:[8825]" dev="sockfs" ino=8825 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 81.823666][ T5738] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 81.823754][ T5738] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 81.823790][ T5738] usb 4-1: config 0 has no interface number 0 [ 81.823823][ T5738] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 81.823847][ T5738] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 81.823865][ T5738] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 81.823890][ T5738] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 81.823913][ T5738] usb 4-1: too many endpoints for config 0 interface 125 altsetting 190: 32, using maximum allowed: 30 [ 81.823939][ T5738] usb 4-1: config 0 interface 125 altsetting 190 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 81.824221][ T5738] usb 4-1: config 0 interface 125 has no altsetting 0 [ 81.824288][ T5738] usb 4-1: config 0 interface 125 has no altsetting 2 [ 81.840438][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.217373][ T5738] usb 4-1: Product: syz [ 82.237360][ T5738] usb 4-1: Manufacturer: syz [ 82.252818][ T5738] usb 4-1: SerialNumber: syz [ 82.273775][ T5738] usb 4-1: config 0 descriptor?? [ 82.312694][ T5738] usb 4-1: selecting invalid altsetting 2 [ 82.346326][ T29] audit: type=1400 audit(1787215071.847:206): avc: denied { create } for pid=5856 comm="syz.4.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 82.664757][ T5868] netlink: 'syz.0.17': attribute type 10 has an invalid length. [ 82.675528][ T5868] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.683368][ T5868] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.866291][ T5847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.031828][ T5847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.351252][ T5738] get_1284_register timeout [ 83.377933][ C1] usb 4-1: async_complete: urb error -104 [ 83.685221][ T5880] netlink: 'syz.1.19': attribute type 10 has an invalid length. [ 83.695648][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.704102][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.816034][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.823551][ T5880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.831111][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.838401][ T5880] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.942653][ T5880] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 84.266208][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 84.358375][ T5894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.364562][ T5893] netlink: 'syz.2.22': attribute type 10 has an invalid length. [ 84.368146][ T5894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.377892][ T5893] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.390692][ T5893] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.439654][ T5893] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.447091][ T5893] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.455032][ T5893] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.462402][ T5893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.480448][ T5738] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 84.482717][ T9] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 84.519581][ T5893] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 84.623957][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.664091][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 84.679650][ T5892] mmap: syz.3.12 (5892) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 84.699581][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 84.717015][ T5694] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 84.749434][ T5738] usb 5-1: Using ep0 maxpacket: 32 [ 84.757037][ T5738] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 84.776036][ T5738] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.776125][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 84.801206][ T9] usb 1-1: Product: syz [ 84.802945][ T5738] usb 5-1: config 0 descriptor?? [ 84.814830][ T9] usb 1-1: Manufacturer: syz [ 84.822859][ T5738] as10x_usb: device has been detected [ 84.835505][ T5738] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 84.874611][ T9] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 84.874960][ T5738] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 84.900542][ T5694] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 84.917600][ T5694] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.940219][ T9] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 84.959398][ T5694] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 84.976440][ T5694] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 84.987953][ T9] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 84.999243][ T5694] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 85.017620][ T5694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.054717][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 85.054753][ T29] audit: type=1400 audit(1787215074.557:221): avc: denied { firmware_load } for pid=5738 comm="kworker/1:6" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 85.108362][ T5738] as10x_usb: error during firmware upload part1 [ 85.131378][ T5738] Registered device nBox DVB-T Dongle [ 85.141558][ T5738] usb 5-1: USB disconnect, device number 2 [ 85.234023][ T5738] Unregistered device nBox DVB-T Dongle [ 85.238102][ T5738] as10x_usb: device has been disconnected [ 85.278489][ T5708] usb 1-1: USB disconnect, device number 3 [ 85.298141][ T5708] garmin_gps 1-1:1.0: device disconnected [ 85.569894][ T29] audit: type=1400 audit(1787215074.997:222): avc: denied { ioctl } for pid=5898 comm="syz.2.25" path="socket:[8909]" dev="sockfs" ino=8909 ioctlcmd=0xf505 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 85.796708][ T5896] netlink: 12 bytes leftover after parsing attributes in process `syz.1.24'. [ 85.806108][ T29] audit: type=1400 audit(1787215074.997:223): avc: denied { create } for pid=5898 comm="syz.2.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 85.858364][ T5738] usb 4-1: USB disconnect, device number 2 [ 85.896495][ T5708] usb 2-1: USB disconnect, device number 2 [ 86.233870][ T5908] netlink: 'syz.4.26': attribute type 10 has an invalid length. [ 86.245145][ T5908] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.252964][ T5908] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.466294][ T5909] netlink: 'syz.3.27': attribute type 10 has an invalid length. [ 86.519994][ T187] cfg80211: failed to load regulatory.db [ 86.810611][ T29] audit: type=1400 audit(1787215076.317:224): avc: denied { mmap_zero } for pid=5913 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 87.240003][ T5708] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 87.826456][ T5708] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 87.885756][ T5708] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.933459][ T5708] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.009326][ T5708] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 89.051031][ T5708] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 89.076258][ T5708] usb 3-1: Product: syz [ 89.077197][ T29] audit: type=1400 audit(1787215078.577:225): avc: denied { create } for pid=5924 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 89.087438][ T5708] usb 3-1: Manufacturer: syz [ 89.123695][ T5708] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 89.215876][ T5708] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 89.227695][ T5708] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 89.950466][ T29] audit: type=1400 audit(1787215078.577:226): avc: denied { ioctl } for pid=5924 comm="syz.0.32" path="socket:[8969]" dev="sockfs" ino=8969 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 89.975742][ T29] audit: type=1400 audit(1787215078.607:227): avc: denied { bind } for pid=5924 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 89.995771][ T29] audit: type=1400 audit(1787215078.607:228): avc: denied { write } for pid=5924 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 90.007358][ T5708] usb 3-1: USB disconnect, device number 2 [ 90.015227][ T29] audit: type=1400 audit(1787215078.617:229): avc: denied { read write } for pid=5925 comm="syz.3.31" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 90.044399][ T29] audit: type=1400 audit(1787215078.617:230): avc: denied { open } for pid=5925 comm="syz.3.31" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 90.118528][ T5708] garmin_gps 3-1:1.0: device disconnected [ 90.785883][ T5944] netlink: 'syz.2.37': attribute type 1 has an invalid length. [ 90.924529][ T5931] o2cb: This node has not been configured. [ 90.931887][ T29] audit: type=1400 audit(1787215080.427:231): avc: denied { write } for pid=5929 comm="syz.1.34" name="/" dev="ocfs2_dlmfs" ino=8983 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 90.970224][ T5931] o2cb: Cluster check failed. Fix errors before retrying. [ 90.989855][ T5931] (syz.1.34,5931,0):user_dlm_register:674 ERROR: status = -22 [ 90.998550][ T29] audit: type=1400 audit(1787215080.427:232): avc: denied { add_name } for pid=5929 comm="syz.1.34" name="mydev" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 91.029452][ T5931] (syz.1.34,5931,0):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "mydev" [ 91.041365][ T983] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 91.049343][ T29] audit: type=1400 audit(1787215080.427:233): avc: denied { create } for pid=5929 comm="syz.1.34" name="mydev" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 91.108578][ T29] audit: type=1400 audit(1787215080.427:234): avc: denied { associate } for pid=5929 comm="syz.1.34" name="mydev" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 91.170319][ T29] audit: type=1400 audit(1787215080.537:235): avc: denied { name_bind } for pid=5948 comm="syz.3.39" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 91.195437][ T29] audit: type=1400 audit(1787215080.537:236): avc: denied { node_bind } for pid=5948 comm="syz.3.39" saddr=::1 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 91.230438][ T5952] netlink: 'syz.3.40': attribute type 10 has an invalid length. [ 91.249477][ T983] usb 3-1: Using ep0 maxpacket: 8 [ 91.258451][ T983] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 91.276662][ T983] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 91.292727][ T983] usb 3-1: config 0 has no interface number 0 [ 91.300334][ T983] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 91.356912][ T983] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 91.402192][ T983] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 91.462110][ T983] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 91.539502][ T983] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.625854][ T983] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.679178][ T983] usb 3-1: config 0 descriptor?? [ 91.754006][ T983] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 92.648977][ T29] audit: type=1400 audit(1787215081.527:237): avc: denied { mount } for pid=5958 comm="syz.1.44" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 92.739111][ T5944] ldusb 3-1:0.55: Couldn't submit interrupt_in_urb -90 [ 92.754573][ T983] usb 3-1: USB disconnect, device number 3 [ 92.761720][ T29] audit: type=1400 audit(1787215081.567:238): avc: denied { create } for pid=5958 comm="syz.1.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 92.921644][ T983] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 92.933083][ T29] audit: type=1400 audit(1787215081.567:239): avc: denied { setopt } for pid=5958 comm="syz.1.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 93.147858][ T29] audit: type=1400 audit(1787215081.567:240): avc: denied { bind } for pid=5958 comm="syz.1.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 93.229935][ T5973] bond1: (slave vlan2): making interface the new active one [ 93.238554][ T5973] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 93.548981][ T5983] netlink: 'syz.4.48': attribute type 10 has an invalid length. [ 93.570675][ T5982] nbd: socks must be embedded in a SOCK_ITEM attr [ 93.602534][ T5982] block nbd0: shutting down sockets [ 93.983595][ T5989] Zero length message leads to an empty skb [ 94.011600][ T5990] nbd: socks must be embedded in a SOCK_ITEM attr [ 94.125417][ T5990] block nbd0: shutting down sockets [ 94.669475][ T5694] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 94.839992][ T5694] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 94.871386][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.891410][ T187] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 94.902112][ T5694] usb 3-1: Product: syz [ 94.906417][ T5694] usb 3-1: Manufacturer: syz [ 94.912309][ T5694] usb 3-1: SerialNumber: syz [ 94.921396][ T5694] usb 3-1: config 0 descriptor?? [ 95.061415][ T187] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 95.083456][ T187] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.117853][ T187] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 95.169741][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 95.247620][ T5694] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 95.258241][ T187] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 95.283760][ T187] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 95.659298][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 95.749298][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 95.949305][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 96.274331][ T187] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.694330][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 96.694346][ T29] audit: type=1400 audit(1787215086.197:246): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 96.699979][ T5722] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 96.736173][ T6000] netlink: 12 bytes leftover after parsing attributes in process `syz.3.54'. [ 96.767386][ T5738] usb 4-1: USB disconnect, device number 3 [ 96.886164][ T983] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 96.900454][ T5722] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 96.916768][ T5722] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.925749][ T5722] usb 5-1: Product: syz [ 96.930067][ T5722] usb 5-1: Manufacturer: syz [ 96.934715][ T5722] usb 5-1: SerialNumber: syz [ 97.050953][ T983] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 97.084532][ T983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.094224][ T983] usb 2-1: Product: syz [ 97.098480][ T983] usb 2-1: Manufacturer: syz [ 97.105258][ T983] usb 2-1: SerialNumber: syz [ 97.297777][ T983] usb 2-1: config 0 descriptor?? [ 97.336662][ T5992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.361342][ T5992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.388048][ T187] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 97.587133][ T983] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 97.776005][ T5694] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 97.905129][ T5694] usb 3-1: USB disconnect, device number 4 [ 98.222713][ T6025] nbd: socks must be embedded in a SOCK_ITEM attr [ 98.248662][ T6025] block nbd0: shutting down sockets [ 98.330998][ T5610] usb 5-1: USB disconnect, device number 3 [ 98.549498][ T187] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 98.557704][ T187] ath9k_htc: Failed to initialize the device [ 98.565826][ T5610] usb 5-1: ath9k_htc: USB layer deinitialized [ 98.721632][ T5708] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 98.756385][ T5738] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 98.920158][ T5708] usb 1-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 98.946123][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.954734][ T5738] usb 4-1: Using ep0 maxpacket: 8 [ 98.966901][ T5738] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 98.987536][ T5708] usb 1-1: Product: syz [ 98.992399][ T5708] usb 1-1: Manufacturer: syz [ 99.002680][ T5738] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.011079][ T5708] usb 1-1: SerialNumber: syz [ 99.024965][ T6036] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 99.026225][ T29] audit: type=1400 audit(1787215088.527:247): avc: denied { mount } for pid=6035 comm="syz.4.65" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 99.068359][ T5708] usb 1-1: config 0 descriptor?? [ 99.075273][ T5738] pvrusb2: Hardware description: Terratec Grabster AV400 [ 99.090189][ T5738] pvrusb2: ********** [ 99.096993][ T5708] gspca_main: spca508-2.14.0 probing 041e:4018 [ 99.104263][ T5738] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 99.126645][ T5738] pvrusb2: Important functionality might not be entirely working. [ 99.126760][ T6037] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 99.145997][ T29] audit: type=1400 audit(1787215088.657:248): avc: denied { search } for pid=6035 comm="syz.4.65" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.176127][ T5738] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 99.188856][ T5738] pvrusb2: ********** [ 99.193273][ T29] audit: type=1400 audit(1787215088.657:249): avc: denied { search } for pid=6035 comm="syz.4.65" name="options" dev="tracefs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.218339][ T29] audit: type=1400 audit(1787215088.657:250): avc: denied { write } for pid=6035 comm="syz.4.65" name="context-info" dev="tracefs" ino=147 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 99.241511][ T29] audit: type=1400 audit(1787215088.657:251): avc: denied { open } for pid=6035 comm="syz.4.65" path="/14/debug/tracing/options/context-info" dev="tracefs" ino=147 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 99.276678][ T29] audit: type=1400 audit(1787215088.657:252): avc: denied { read } for pid=6035 comm="syz.4.65" name="trace_pipe" dev="tracefs" ino=126 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 99.300788][ T29] audit: type=1400 audit(1787215088.727:253): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 99.325808][ T2353] pvrusb2: Invalid write control endpoint [ 99.332085][ T5708] gspca_spca508: reg_read err -32 [ 99.343638][ T5708] gspca_spca508: reg_read err -32 [ 99.350762][ T983] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 99.363263][ T983] usb 2-1: USB disconnect, device number 3 [ 99.372972][ T5708] gspca_spca508: reg_read err -32 [ 99.379102][ T5708] gspca_spca508: reg_read err -32 [ 99.413400][ T5708] gspca_spca508: reg_read err -32 [ 99.501972][ T2353] pvrusb2: Invalid write control endpoint [ 99.521472][ T2353] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 99.561791][ T2353] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 99.584210][ T2353] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 99.605364][ T2353] pvrusb2: Device being rendered inoperable [ 99.627774][ T2353] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 99.642967][ T2353] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 99.672273][ T29] audit: type=1400 audit(1787215089.177:254): avc: denied { execute } for pid=6027 comm="syz.3.62" name="file2" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 99.672561][ T6028] process 'syz.3.62' launched './file2' with NULL argv: empty string added [ 99.700203][ T2353] pvrusb2: Attached sub-driver cx25840 [ 99.722776][ T29] audit: type=1400 audit(1787215089.217:255): avc: denied { execute_no_trans } for pid=6027 comm="syz.3.62" path="/13/file2" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 99.738255][ T6028] ima: policy update completed [ 99.749081][ T2353] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 99.762473][ T2353] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 99.920126][ T5610] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 99.934497][ T6047] warning: `syz.2.68' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 100.158691][ T5708] gspca_spca508: reg write: error -110 [ 100.199825][ T5708] spca508 1-1:0.0: probe with driver spca508 failed with error -110 [ 100.409738][ T5708] usb 4-1: USB disconnect, device number 4 [ 100.853263][ T5738] usb 1-1: USB disconnect, device number 4 [ 100.965519][ T5610] usb 5-1: Using ep0 maxpacket: 16 [ 101.027618][ T6053] netlink: 'syz.1.70': attribute type 10 has an invalid length. [ 101.036417][ T6053] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.045338][ T6053] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.162190][ T5610] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 101.265605][ T5610] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 101.281613][ T5610] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 101.290679][ T5610] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 101.313386][ T5610] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 101.327367][ T5610] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 101.357039][ T5610] usb 5-1: config 0 has no interface number 0 [ 101.377249][ T5610] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 101.511377][ T5610] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 101.538665][ T5610] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 101.580802][ T5610] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 101.617727][ T5610] usb 5-1: too many endpoints for config 0 interface 125 altsetting 190: 32, using maximum allowed: 30 [ 102.574147][ T5610] usb 5-1: config 0 interface 125 altsetting 190 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 102.604692][ T29] kauditd_printk_skb: 20 callbacks suppressed [ 102.604707][ T29] audit: type=1800 audit(1787215092.107:276): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14873 res=0 errno=0 [ 102.611212][ T5610] usb 5-1: config 0 interface 125 has no altsetting 0 [ 102.692070][ T29] audit: type=1800 audit(1787215092.197:277): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14996 res=0 errno=0 [ 102.724709][ T5610] usb 5-1: config 0 interface 125 has no altsetting 2 [ 102.741201][ T5610] usb 5-1: string descriptor 0 read error: -71 [ 102.760243][ T5610] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.768332][ T29] audit: type=1800 audit(1787215092.267:278): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31629 res=0 errno=0 [ 102.791374][ T5694] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 102.880448][ T5610] usb 5-1: config 0 descriptor?? [ 102.901438][ T29] audit: type=1800 audit(1787215092.317:279): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15365 res=0 errno=0 [ 102.924825][ T5610] usb 5-1: can't set config #0, error -71 [ 103.030750][ T5610] usb 5-1: USB disconnect, device number 4 [ 103.057281][ T5694] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 103.249568][ T29] audit: type=1400 audit(1787215092.357:280): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 103.304016][ T5694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.330393][ T5694] usb 1-1: Product: syz [ 103.337512][ T29] audit: type=1800 audit(1787215092.387:281): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15365 res=0 errno=0 [ 103.344787][ T5694] usb 1-1: Manufacturer: syz [ 103.385636][ T5694] usb 1-1: SerialNumber: syz [ 103.406925][ T29] audit: type=1800 audit(1787215092.387:282): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31652 res=0 errno=0 [ 104.314116][ T29] audit: type=1800 audit(1787215092.387:283): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=118426 res=0 errno=0 [ 104.335720][ T29] audit: type=1800 audit(1787215092.397:284): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=118455 res=0 errno=0 [ 104.353958][ T5722] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 104.359201][ T29] audit: type=1800 audit(1787215092.397:285): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=118433 res=0 errno=0 [ 104.486148][ T6071] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 104.600931][ T5610] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 104.659985][ T6077] Illegal XDP return value 4294967294 on prog (id 9) dev N/A, expect packet loss! [ 106.544080][ T5694] usb 1-1: USB disconnect, device number 5 [ 106.554429][ T5722] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 106.563137][ T5722] ath9k_htc: Failed to initialize the device [ 106.682048][ T6085] netlink: 'syz.3.81': attribute type 10 has an invalid length. [ 106.936056][ T5694] usb 1-1: ath9k_htc: USB layer deinitialized [ 106.946740][ T5610] usb 5-1: device not accepting address 5, error -71 [ 107.562959][ T5738] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 107.625166][ T6095] netlink: 'syz.1.86': attribute type 10 has an invalid length. [ 107.720980][ T29] kauditd_printk_skb: 21 callbacks suppressed [ 107.720998][ T29] audit: type=1800 audit(1787215097.217:307): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14996 res=0 errno=0 [ 107.779445][ T5738] usb 4-1: Using ep0 maxpacket: 32 [ 107.802154][ T5738] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 107.814489][ T5738] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.832735][ T29] audit: type=1800 audit(1787215097.327:308): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=118935 res=0 errno=0 [ 107.858504][ T5738] usb 4-1: config 0 descriptor?? [ 107.888814][ T5738] as10x_usb: device has been detected [ 107.906364][ T29] audit: type=1800 audit(1787215097.337:309): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=118964 res=0 errno=0 [ 107.929325][ T5738] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 107.973994][ T5738] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 107.994306][ T29] audit: type=1800 audit(1787215097.337:310): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=118942 res=0 errno=0 [ 108.061851][ T5738] as10x_usb: error during firmware upload part1 [ 108.080545][ T5738] Registered device nBox DVB-T Dongle [ 108.083167][ T29] audit: type=1800 audit(1787215097.337:311): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=118943 res=0 errno=0 [ 108.186095][ T29] audit: type=1800 audit(1787215097.357:312): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=118944 res=0 errno=0 [ 108.329823][ T6104] netlink: 'syz.0.84': attribute type 10 has an invalid length. [ 108.592043][ T29] audit: type=1800 audit(1787215097.387:313): pid=5607 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=118984 res=0 errno=0 [ 108.617230][ T5722] usb 4-1: USB disconnect, device number 5 [ 108.644182][ T29] audit: type=1800 audit(1787215097.397:314): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=119003 res=0 errno=0 [ 108.675035][ T5722] Unregistered device nBox DVB-T Dongle [ 108.675450][ T29] audit: type=1800 audit(1787215097.497:315): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14873 res=0 errno=0 [ 108.706822][ T5722] as10x_usb: device has been disconnected [ 108.725283][ T29] audit: type=1800 audit(1787215097.497:316): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=119017 res=0 errno=0 [ 109.539943][ T6107] nbd: socks must be embedded in a SOCK_ITEM attr [ 109.549431][ T6107] block nbd0: shutting down sockets [ 109.611708][ T6116] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 109.829527][ T5794] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 109.874210][ T6124] netlink: 'syz.4.92': attribute type 10 has an invalid length. [ 110.124653][ T5794] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 110.167606][ T5794] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.436270][ T5794] usb 3-1: Product: syz [ 110.450805][ T5794] usb 3-1: Manufacturer: syz [ 110.469854][ T5794] usb 3-1: SerialNumber: syz [ 110.520270][ T6127] exFAT-fs (nullb0): invalid boot record signature [ 110.552913][ T983] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 110.675600][ T6127] exFAT-fs (nullb0): failed to read boot sector [ 110.712367][ T6127] exFAT-fs (nullb0): failed to recognize exfat type [ 110.720096][ T5722] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 110.772001][ T6127] netlink: 20 bytes leftover after parsing attributes in process `syz.3.95'. [ 110.900295][ T5722] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 110.932223][ T5722] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.956962][ T5722] usb 1-1: Product: syz [ 111.098348][ T5840] usb 3-1: USB disconnect, device number 5 [ 111.134749][ T5722] usb 1-1: Manufacturer: syz [ 111.157275][ T5722] usb 1-1: SerialNumber: syz [ 111.210695][ T5694] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 111.464377][ T5722] usb 1-1: USB disconnect, device number 6 [ 111.759844][ T983] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 111.777371][ T983] ath9k_htc: Failed to initialize the device [ 111.803814][ T5840] usb 3-1: ath9k_htc: USB layer deinitialized [ 111.819389][ T5794] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 111.999447][ T5794] usb 4-1: Using ep0 maxpacket: 16 [ 112.116232][ T5794] usb 4-1: unable to get BOS descriptor or descriptor too short [ 112.143734][ T5794] usb 4-1: New USB device found, idVendor=041e, idProduct=4064, bcdDevice= 0.40 [ 112.189893][ T5794] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.236113][ T5794] usb 4-1: Product: У [ 112.364316][ T5694] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 112.378784][ T5694] ath9k_htc: Failed to initialize the device [ 112.388945][ T5722] usb 1-1: ath9k_htc: USB layer deinitialized [ 112.400834][ T5794] usb 4-1: SerialNumber: H [ 113.008049][ T29] kauditd_printk_skb: 45 callbacks suppressed [ 113.008085][ T29] audit: type=1800 audit(1787215102.507:362): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15365 res=0 errno=0 [ 113.049734][ T29] audit: type=1800 audit(1787215102.547:363): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14873 res=0 errno=0 [ 113.126813][ T29] audit: type=1800 audit(1787215102.577:364): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15119 res=0 errno=0 [ 113.170438][ T29] audit: type=1400 audit(1787215102.587:365): avc: denied { getopt } for pid=6145 comm="syz.2.99" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 113.325303][ T6137] vhci_hcd vhci_hcd.0: remove, state 4 [ 113.369389][ T29] audit: type=1800 audit(1787215102.587:366): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=14996 res=0 errno=0 [ 113.403108][ T6137] usb usb34: USB disconnect, device number 1 [ 113.448791][ T29] audit: type=1800 audit(1787215102.717:367): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31479 res=0 errno=0 [ 113.449342][ T5694] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 113.561820][ T29] audit: type=1800 audit(1787215102.717:368): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=119780 res=0 errno=0 [ 113.609692][ T29] audit: type=1800 audit(1787215102.727:369): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=119811 res=0 errno=0 [ 113.702141][ T6169] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 113.712571][ T29] audit: type=1800 audit(1787215102.797:370): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31502 res=0 errno=0 [ 113.755488][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 113.762956][ T3331] vhci_hcd vhci_hcd.0: release socket [ 113.780826][ T5694] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 113.788000][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 113.798873][ T29] audit: type=1800 audit(1787215102.797:371): pid=5597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=119787 res=0 errno=0 [ 113.817329][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 113.847142][ T5694] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.850907][ T3331] vhci_hcd vhci_hcd.0: release socket [ 113.873609][ T5694] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 113.924811][ T5694] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 113.925714][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 113.945020][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 113.956893][ T3331] vhci_hcd vhci_hcd.0: release socket [ 113.968158][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 113.977596][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 113.983573][ T3331] vhci_hcd vhci_hcd.0: release socket [ 113.989333][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 113.998447][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.008612][ T3331] vhci_hcd vhci_hcd.0: release socket [ 114.018415][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 114.028981][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.034351][ T3331] vhci_hcd vhci_hcd.0: release socket [ 114.047075][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 114.059351][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.067382][ T3331] vhci_hcd vhci_hcd.0: release socket [ 114.081452][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 114.091477][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.097623][ T3331] vhci_hcd vhci_hcd.0: release socket [ 114.107368][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 114.120110][ T6137] vhci_hcd vhci_hcd.0: USB bus 34 deregistered [ 114.159400][ T5738] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 114.171274][ T5694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.183677][ T6137] vhci_hcd vhci_hcd.0: remove, state 4 [ 114.204011][ T5694] usb 2-1: config 0 descriptor?? [ 114.204621][ T6137] usb usb33: USB disconnect, device number 1 [ 114.466693][ T5738] usb 5-1: unable to get BOS descriptor or descriptor too short [ 114.634093][ T5738] usb 5-1: New USB device found, idVendor=2a39, idProduct=3fb0, bcdDevice= 0.40 [ 114.667641][ T5738] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 114.683844][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.689171][ T3331] vhci_hcd vhci_hcd.0: release socket [ 114.697187][ T6137] vhci_hcd vhci_hcd.0: USB bus 33 deregistered [ 114.717999][ T3331] vhci_hcd vhci_hcd.0: disconnect device [ 114.728336][ T5738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.739397][ T5738] usb 5-1: Product: syz [ 114.759451][ T5738] usb 5-1: Manufacturer: syz [ 114.760971][ T3331] vhci_hcd vhci_hcd.0: stop threads [ 114.766715][ T5738] usb 5-1: SerialNumber: syz [ 114.817893][ T3331] ================================================================== [ 114.825988][ T3331] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection.cold+0x2f1/0x37c [ 114.834940][ T3331] Read of size 8 at addr ffff88802ad40780 by task kworker/u8:9/3331 [ 114.842906][ T3331] [ 114.845235][ T3331] CPU: 0 UID: 0 PID: 3331 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) [ 114.845261][ T3331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 114.845272][ T3331] Workqueue: usbip_event event_handler [ 114.845294][ T3331] Call Trace: [ 114.845302][ T3331] [ 114.845308][ T3331] dump_stack_lvl+0x100/0x190 [ 114.845324][ T3331] print_report+0x13d/0x4b0 [ 114.845340][ T3331] ? __virt_addr_valid+0x239/0x430 [ 114.845355][ T3331] ? vhci_shutdown_connection.cold+0x2f1/0x37c [ 114.845377][ T3331] kasan_report+0xdf/0x1c0 [ 114.845403][ T3331] ? vhci_shutdown_connection.cold+0x2f1/0x37c [ 114.845429][ T3331] vhci_shutdown_connection.cold+0x2f1/0x37c [ 114.845454][ T3331] event_handler+0x216/0x570 [ 114.845464][ T3331] process_one_work+0xa23/0x1940 [ 114.845479][ T3331] ? __pfx_process_one_work+0x10/0x10 [ 114.845496][ T3331] ? __pfx_event_handler+0x10/0x10 [ 114.845508][ T3331] worker_thread+0x5ef/0xe50 [ 114.845529][ T3331] ? __pfx_worker_thread+0x10/0x10 [ 114.845549][ T3331] ? kthread+0x13a/0x450 [ 114.845566][ T3331] ? __pfx_worker_thread+0x10/0x10 [ 114.845584][ T3331] kthread+0x373/0x450 [ 114.845599][ T3331] ? __pfx_kthread+0x10/0x10 [ 114.845611][ T3331] ret_from_fork+0x730/0xd60 [ 114.845628][ T3331] ? __pfx_ret_from_fork+0x10/0x10 [ 114.845644][ T3331] ? __switch_to+0x800/0x10f0 [ 114.845656][ T3331] ? __pfx_kthread+0x10/0x10 [ 114.845673][ T3331] ret_from_fork_asm+0x1a/0x30 [ 114.845702][ T3331] [ 114.845707][ T3331] [ 114.990502][ T3331] Allocated by task 1: [ 114.994634][ T3331] kasan_save_stack+0x30/0x50 [ 114.999299][ T3331] kasan_save_track+0x14/0x30 [ 115.003990][ T3331] __kasan_kmalloc+0xaa/0xb0 [ 115.008576][ T3331] __kmalloc_noprof+0x324/0x820 [ 115.013421][ T3331] __usb_create_hcd+0x5e/0xac0 [ 115.018192][ T3331] vhci_hcd_probe+0xf3/0x4e0 [ 115.022784][ T3331] platform_probe+0x106/0x1d0 [ 115.027460][ T3331] really_probe+0x241/0xa60 [ 115.029282][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 115.031950][ T3331] __driver_probe_device+0x210/0x460 [ 115.045380][ T3331] driver_probe_device+0x4a/0x140 [ 115.050409][ T3331] __device_attach_driver+0x1df/0x320 [ 115.055772][ T3331] bus_for_each_drv+0x159/0x1e0 [ 115.060613][ T3331] __device_attach+0x1e4/0x4d0 [ 115.065375][ T3331] device_initial_probe+0xaf/0xd0 [ 115.070376][ T3331] bus_probe_device+0x64/0x160 [ 115.075125][ T3331] device_add+0x121d/0x1970 [ 115.079620][ T3331] platform_device_add+0x35a/0x800 [ 115.084722][ T3331] platform_device_register_full+0x507/0x720 [ 115.090694][ T3331] vhci_hcd_init+0x1a1/0x2f0 [ 115.095288][ T3331] do_one_initcall+0x11c/0x6f0 [ 115.100047][ T3331] kernel_init_freeable+0x6ea/0x7b0 [ 115.105229][ T3331] kernel_init+0x21/0x1e0 [ 115.109561][ T3331] ret_from_fork+0x730/0xd60 [ 115.114159][ T3331] ret_from_fork_asm+0x1a/0x30 [ 115.118927][ T3331] [ 115.121263][ T3331] Freed by task 6137: [ 115.125243][ T3331] kasan_save_stack+0x30/0x50 [ 115.129909][ T3331] kasan_save_track+0x14/0x30 [ 115.134591][ T3331] kasan_save_free_info+0x3b/0x70 [ 115.139599][ T3331] __kasan_slab_free+0x5f/0x80 [ 115.144382][ T3331] kfree+0x22b/0x6c0 [ 115.148323][ T3331] usb_put_hcd+0x149/0x1f0 [ 115.152768][ T3331] vhci_hcd_remove+0x107/0x1b0 [ 115.157535][ T3331] platform_remove+0x5f/0x80 [ 115.162122][ T3331] device_remove+0xcb/0x180 [ 115.166607][ T3331] device_release_driver_internal+0x44e/0x620 [ 115.172673][ T3331] unbind_store+0xf8/0x110 [ 115.177096][ T3331] drv_attr_store+0x74/0xb0 [ 115.181597][ T3331] sysfs_kf_write+0xf2/0x150 [ 115.186190][ T3331] kernfs_fop_write_iter+0x3e0/0x5f0 [ 115.191478][ T3331] vfs_write+0x6af/0x1050 [ 115.195789][ T3331] ksys_write+0x12a/0x250 [ 115.200110][ T3331] do_syscall_64+0x123/0x790 [ 115.204691][ T3331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.210575][ T3331] [ 115.212886][ T3331] Last potentially related work creation: [ 115.218581][ T3331] kasan_save_stack+0x30/0x50 [ 115.223249][ T3331] kasan_record_aux_stack+0xa7/0xc0 [ 115.228448][ T3331] insert_work+0x36/0x230 [ 115.232760][ T3331] __queue_work+0x9bc/0x12b0 [ 115.237345][ T3331] queue_work_on+0x1a9/0x1e0 [ 115.241920][ T3331] usb_hcd_giveback_urb+0x330/0x4a0 [ 115.247113][ T3331] unlink1+0x418/0x510 [ 115.251182][ T3331] usb_hcd_unlink_urb+0x131/0x210 [ 115.256199][ T3331] usb_kill_urb+0x121/0x320 [ 115.260786][ T3331] hub_quiesce+0x1e9/0x320 [ 115.265192][ T3331] hub_suspend+0x4ab/0x9e0 [ 115.269590][ T3331] usb_suspend_both+0x288/0x950 [ 115.274429][ T3331] usb_runtime_suspend+0x49/0x120 [ 115.279452][ T3331] __rpm_callback+0xc8/0x620 [ 115.284020][ T3331] rpm_callback+0x11f/0x150 [ 115.288509][ T3331] rpm_suspend+0x2f4/0x1220 [ 115.292986][ T3331] __pm_runtime_suspend+0xba/0x1a0 [ 115.298075][ T3331] usb_new_device.part.0+0x1653/0x1686 [ 115.303526][ T3331] register_root_hub+0x4e6/0x639 [ 115.308458][ T3331] usb_add_hcd.cold+0xccd/0x1158 [ 115.313376][ T3331] vhci_hcd_probe+0x14b/0x4e0 [ 115.318028][ T3331] platform_probe+0x106/0x1d0 [ 115.322700][ T3331] really_probe+0x241/0xa60 [ 115.327191][ T3331] __driver_probe_device+0x210/0x460 [ 115.332471][ T3331] driver_probe_device+0x4a/0x140 [ 115.337484][ T3331] __device_attach_driver+0x1df/0x320 [ 115.342844][ T3331] bus_for_each_drv+0x159/0x1e0 [ 115.347853][ T3331] __device_attach+0x1e4/0x4d0 [ 115.352604][ T3331] device_initial_probe+0xaf/0xd0 [ 115.357617][ T3331] bus_probe_device+0x64/0x160 [ 115.362380][ T3331] device_add+0x121d/0x1970 [ 115.366875][ T3331] platform_device_add+0x35a/0x800 [ 115.371976][ T3331] platform_device_register_full+0x507/0x720 [ 115.377942][ T3331] vhci_hcd_init+0x1a1/0x2f0 [ 115.382618][ T3331] do_one_initcall+0x11c/0x6f0 [ 115.387382][ T3331] kernel_init_freeable+0x6ea/0x7b0 [ 115.392564][ T3331] kernel_init+0x21/0x1e0 [ 115.396893][ T3331] ret_from_fork+0x730/0xd60 [ 115.401488][ T3331] ret_from_fork_asm+0x1a/0x30 [ 115.406251][ T3331] [ 115.408662][ T3331] Second to last potentially related work creation: [ 115.415230][ T3331] kasan_save_stack+0x30/0x50 [ 115.419908][ T3331] kasan_record_aux_stack+0xa7/0xc0 [ 115.425104][ T3331] insert_work+0x36/0x230 [ 115.429429][ T3331] __queue_work+0x9bc/0x12b0 [ 115.434010][ T3331] queue_work_on+0x1a9/0x1e0 [ 115.438594][ T3331] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 115.443793][ T3331] usb_hcd_submit_urb+0xab7/0x2150 [ 115.449040][ T3331] usb_submit_urb+0x827/0x19b0 [ 115.454095][ T3331] usb_start_wait_urb+0x10e/0x580 [ 115.459127][ T3331] usb_control_msg+0x328/0x4b0 [ 115.463888][ T3331] hub_ext_port_status+0x152/0x600 [ 115.469006][ T3331] hub_activate+0x6e5/0x1c40 [ 115.473608][ T3331] process_one_work+0xa23/0x1940 [ 115.478645][ T3331] worker_thread+0x5ef/0xe50 [ 115.483238][ T3331] kthread+0x373/0x450 [ 115.487417][ T3331] ret_from_fork+0x730/0xd60 [ 115.492030][ T3331] ret_from_fork_asm+0x1a/0x30 [ 115.496812][ T3331] [ 115.499110][ T3331] The buggy address belongs to the object at ffff88802ad40000 [ 115.499110][ T3331] which belongs to the cache kmalloc-8k of size 8192 [ 115.513227][ T3331] The buggy address is located 1920 bytes inside of [ 115.513227][ T3331] freed 8192-byte region [ffff88802ad40000, ffff88802ad42000) [ 115.527178][ T3331] [ 115.529488][ T3331] The buggy address belongs to the physical page: [ 115.535881][ T3331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ad40 [ 115.544643][ T3331] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 115.553118][ T3331] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 115.560651][ T3331] page_type: f5(slab) [ 115.564628][ T3331] raw: 00fff00000000040 ffff88801c022280 dead000000000122 0000000000000000 [ 115.573198][ T3331] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 115.581774][ T3331] head: 00fff00000000040 ffff88801c022280 dead000000000122 0000000000000000 [ 115.590541][ T3331] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 115.599234][ T3331] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 115.607974][ T3331] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 115.616716][ T3331] page dumped because: kasan: bad access detected [ 115.623128][ T3331] page_owner tracks the page as allocated [ 115.628848][ T3331] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8163951942, free_ts 0 [ 115.648557][ T3331] post_alloc_hook+0xfd/0x120 [ 115.649587][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 115.653219][ T3331] get_page_from_freelist+0xf46/0x3500 [ 115.666894][ T3331] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 115.672788][ T3331] new_slab+0xa2/0x660 [ 115.676866][ T3331] refill_objects+0xe3/0x410 [ 115.681446][ T3331] __pcs_replace_empty_main+0x372/0x680 [ 115.686976][ T3331] __kmalloc_cache_noprof+0x47b/0x6b0 [ 115.692336][ T3331] dummy_hcd_init+0x3ce/0xc00 [ 115.697018][ T3331] do_one_initcall+0x11c/0x6f0 [ 115.701788][ T3331] kernel_init_freeable+0x6ea/0x7b0 [ 115.706965][ T3331] kernel_init+0x21/0x1e0 [ 115.711282][ T3331] ret_from_fork+0x730/0xd60 [ 115.715858][ T3331] ret_from_fork_asm+0x1a/0x30 [ 115.720615][ T3331] page_owner free stack trace missing [ 115.726012][ T3331] [ 115.728321][ T3331] Memory state around the buggy address: [ 115.733935][ T3331] ffff88802ad40680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.741981][ T3331] ffff88802ad40700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.750033][ T3331] >ffff88802ad40780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.758095][ T3331] ^ [ 115.762143][ T3331] ffff88802ad40800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.770201][ T3331] ffff88802ad40880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.778326][ T3331] ================================================================== [ 115.815797][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.829014][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.834631][ T5794] gspca_main: ov519-2.14.0 probing 041e:4064 [ 115.836517][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.849892][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.857626][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.865097][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.872484][ T5738] usb 5-1: unit 4 not found! [ 115.877214][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.882234][ T5794] ov519 4-1:1.0: reg_w 5a failed -71 [ 115.885929][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.897494][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 115.905020][ T5694] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 116.012082][ T5694] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 116.037026][ T5694] usb 2-1: USB disconnect, device number 4 [ 116.047762][ T3331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 116.055001][ T3331] CPU: 0 UID: 0 PID: 3331 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) [ 116.064471][ T3331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 116.074620][ T3331] Workqueue: usbip_event event_handler [ 116.080095][ T3331] Call Trace: [ 116.083375][ T3331] [ 116.086299][ T3331] dump_stack_lvl+0x100/0x190 [ 116.090986][ T3331] vpanic+0x553/0x970 [ 116.094978][ T3331] ? __pfx_vpanic+0x10/0x10 [ 116.099476][ T3331] ? vhci_shutdown_connection.cold+0x2f1/0x37c [ 116.105632][ T3331] panic+0xd1/0xe0 [ 116.109342][ T3331] ? __pfx_panic+0x10/0x10 [ 116.113748][ T3331] ? vhci_shutdown_connection.cold+0x2f1/0x37c [ 116.119902][ T3331] ? preempt_schedule_common+0x3c/0xb0 [ 116.125344][ T3331] check_panic_on_warn.cold+0x19/0x34 [ 116.130711][ T3331] end_report.part.0+0x3a/0x90 [ 116.135460][ T3331] kasan_report.cold+0xe/0x18 [ 116.140129][ T3331] ? vhci_shutdown_connection.cold+0x2f1/0x37c [ 116.146305][ T3331] vhci_shutdown_connection.cold+0x2f1/0x37c [ 116.152294][ T3331] event_handler+0x216/0x570 [ 116.156881][ T3331] process_one_work+0xa23/0x1940 [ 116.161819][ T3331] ? __pfx_process_one_work+0x10/0x10 [ 116.167202][ T3331] ? __pfx_event_handler+0x10/0x10 [ 116.172307][ T3331] worker_thread+0x5ef/0xe50 [ 116.176893][ T3331] ? __pfx_worker_thread+0x10/0x10 [ 116.181997][ T3331] ? kthread+0x13a/0x450 [ 116.186248][ T3331] ? __pfx_worker_thread+0x10/0x10 [ 116.191366][ T3331] kthread+0x373/0x450 [ 116.195425][ T3331] ? __pfx_kthread+0x10/0x10 [ 116.200010][ T3331] ret_from_fork+0x730/0xd60 [ 116.204583][ T3331] ? __pfx_ret_from_fork+0x10/0x10 [ 116.209678][ T3331] ? __switch_to+0x800/0x10f0 [ 116.214335][ T3331] ? __pfx_kthread+0x10/0x10 [ 116.218917][ T3331] ret_from_fork_asm+0x1a/0x30 [ 116.223669][ T3331] [ 116.226884][ T3331] Kernel Offset: disabled [ 116.231197][ T3331] Rebooting in 86400 seconds..