last executing test programs: 1m13.86567641s ago: executing program 0 (id=718): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, 0x0) 1m13.698023241s ago: executing program 0 (id=719): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) recvmmsg(r1, &(0x7f0000001140), 0x700, 0x2, 0x0) 1m12.955925602s ago: executing program 0 (id=724): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001"], 0x0, 0x3c}, 0x28) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x1c, 0x0, &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m12.791898807s ago: executing program 0 (id=728): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1e) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000003c0)='./dev\x00', &(0x7f00000001c0)='./file0/../file0\x00') 1m12.567044269s ago: executing program 0 (id=732): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44004) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000a40)={0xffffffffffffffff}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x20000023896) close_range(r0, 0xffffffffffffffff, 0x2) 1m12.121095847s ago: executing program 0 (id=738): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x39, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x670, 0x0, 0x0, 0x428, 0x428, 0x428, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28, 'socket\x00', 0x3}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x729) 1m11.335784645s ago: executing program 32 (id=738): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x39, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x670, 0x0, 0x0, 0x428, 0x428, 0x428, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28, 'socket\x00', 0x3}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x729) 42.818498557s ago: executing program 1 (id=965): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ed) getdents64(0xffffffffffffffff, &(0x7f0000000500)=""/1024, 0x400) 42.802913808s ago: executing program 1 (id=967): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000380)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x20208, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 41.637973532s ago: executing program 1 (id=969): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)={0x20, r0, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_KEY={0x4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x20}, 0x1, 0x0, 0x0, 0xc014}, 0x20000084) 41.319941283s ago: executing program 1 (id=973): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1e) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000003c0)='./dev\x00', &(0x7f00000001c0)='./file0/../file0\x00') 41.153478649s ago: executing program 1 (id=975): mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nfs/parameters/delay_retrans\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='1}[', 0x3) 40.642306494s ago: executing program 1 (id=982): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60) sendmmsg(0xffffffffffffffff, &(0x7f0000008000)=[{{&(0x7f0000000100)=@rc={0x1f, @any, 0x9}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000001800)="cd58", 0x2}], 0x1}}, {{&(0x7f0000000780)=@nl=@proc={0x10, 0x0, 0x25dfdbfb}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000000800)="111925cd14a803815165afdc3f2c21b1f94b546ea4629f131110151844368f064efcdb7dd59f900b55a108dfd18039633abaff99b12422b725f529a8b3363837d4776fd925dabbb59ccbbef6d8b988c12aefda3f9491b304f5b735e84677a319ebbd255db7a27d9c01c28d7a5840e62b5e202fcc2fc51333f0811268d62af606141c88173b966a6d6dbd", 0x8a}, {0x0, 0x5f}, {&(0x7f00000027c0)}], 0x3}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000005d80)}}], 0x3, 0x4008000) 39.85619096s ago: executing program 33 (id=982): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60) sendmmsg(0xffffffffffffffff, &(0x7f0000008000)=[{{&(0x7f0000000100)=@rc={0x1f, @any, 0x9}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000001800)="cd58", 0x2}], 0x1}}, {{&(0x7f0000000780)=@nl=@proc={0x10, 0x0, 0x25dfdbfb}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000000800)="111925cd14a803815165afdc3f2c21b1f94b546ea4629f131110151844368f064efcdb7dd59f900b55a108dfd18039633abaff99b12422b725f529a8b3363837d4776fd925dabbb59ccbbef6d8b988c12aefda3f9491b304f5b735e84677a319ebbd255db7a27d9c01c28d7a5840e62b5e202fcc2fc51333f0811268d62af606141c88173b966a6d6dbd", 0x8a}, {0x0, 0x5f}, {&(0x7f00000027c0)}], 0x3}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000005d80)}}], 0x3, 0x4008000) 4.66157864s ago: executing program 3 (id=1310): r0 = socket$unix(0x1, 0x2, 0x0) recvmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x10023, 0x0) 4.454373564s ago: executing program 3 (id=1315): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000680)=[@in={0x2, 0x4e24, @local}], 0x10) 4.362019723s ago: executing program 3 (id=1319): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r1, 0x1, 0xffffffff, 0x400000}, 0x14}, 0x1, 0x620b}, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) lseek(r4, 0x1, 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, 0x0, 0x20004056) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000140)=@framed={{0x18, 0x6, 0x0, 0x0, 0x7056}}, &(0x7f00000000c0)='GPL\x00', 0x6, 0x92, &(0x7f0000000300)=""/146}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000006800)=[{{0x0, 0x0, &(0x7f0000004dc0)=[{&(0x7f0000003d00)=""/4096, 0x1000}], 0x1}, 0x5}], 0x1, 0x141, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) 3.344872802s ago: executing program 6 (id=1327): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) r1 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 3.339634943s ago: executing program 3 (id=1328): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) read(r0, &(0x7f0000000240)=""/28, 0xffd2) 2.908705916s ago: executing program 6 (id=1332): mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/devices/0000:00:01.0/d3cold_allowed\x00', 0x1, 0x0) write$binfmt_elf32(r0, &(0x7f0000000100)=ANY=[], 0x3fb) 2.762424039s ago: executing program 5 (id=1335): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0x4, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200affd14000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 2.590285767s ago: executing program 6 (id=1336): clock_gettime(0x0, &(0x7f0000002780)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000002940)={{r0, r1+60000000}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000000040)={0xa0000004}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) fsopen(0x0, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r3, &(0x7f0000002880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002500)=""/60, 0x3c}, 0xb}, {{&(0x7f0000002540)=@phonet, 0x80, 0x0, 0x0, &(0x7f0000002800)=""/122, 0x7a}}], 0x2, 0x6000, &(0x7f0000002900)={0x0, 0x3938700}) sendmsg$nl_route_sched(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x40, 0x24, 0x605, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x10, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xd}]}}]}, 0x40}}, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r4, &(0x7f0000000300)="ab", 0x1, 0x4000000, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) r5 = syz_clone(0x15200, &(0x7f00000000c0)="d4a9543843724fa52c236db9bb08c78d7ec7a011faeb9f9c14ab", 0x1a, &(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000200)) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) 2.479225034s ago: executing program 4 (id=1337): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) setresuid(0x0, 0xee00, 0x0) ioctl$TCXONC(r0, 0x4b63, 0x3) 2.453714016s ago: executing program 2 (id=1338): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x7, 0x0, 'queue1\x00', 0x3}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000080)={0x0, 0x4, 0x1, 'queue0\x00', 0x10}) 2.297064048s ago: executing program 4 (id=1339): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) pread64(r1, &(0x7f0000000580)=""/224, 0xe0, 0x200000000000002) 2.272703824s ago: executing program 5 (id=1340): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4c050}, 0x8040) 2.218663599s ago: executing program 2 (id=1341): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x8000f28, 0x5) 2.141107295s ago: executing program 5 (id=1342): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) r1 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 2.138463426s ago: executing program 4 (id=1343): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='ipv4\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='tc', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='127.0.0.1\n', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='4420\n', 0x5) close(r4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/subsys0\x00') nanosleep(&(0x7f0000000480)={0x0, 0x1000000}, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) connect$inet(r5, &(0x7f0000000500)={0x2, 0x1144, @loopback}, 0x10) sendto$inet(r5, &(0x7f0000000600)="000080008000"/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r5, &(0x7f0000000700)="040048004800"/72, 0x48, 0x0, 0x0, 0x0) shutdown(r5, 0x2) close(r5) 2.070723671s ago: executing program 2 (id=1344): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001"], 0x0, 0x3c}, 0x28) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x1c, &(0x7f0000000240)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b706000005000000850000002e000000bf0920000000000035090100000000009500000000000000b7020000000000007b9a", @ANYBLOB="f2405bd281a5c1ac3ba85016051bd3e4437b37e0748abd07baef0bcd64d868a93f50", @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9820000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.070532623s ago: executing program 3 (id=1345): bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008040) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000000000000) 1.978807885s ago: executing program 5 (id=1346): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/devices/0000:00:01.0/d3cold_allowed\x00', 0x1, 0x0) write$binfmt_elf32(r0, &(0x7f0000000100)=ANY=[], 0x3fb) 1.97096483s ago: executing program 3 (id=1347): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x8, "2200001600000000"}}, 0xe) nanosleep(0x0, 0x0) write$UHID_INPUT2(r0, 0x0, 0x0) nanosleep(0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300), 0x6) nanosleep(0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x2) syz_open_dev$evdev(0x0, 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x2) 1.932542881s ago: executing program 2 (id=1348): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0xae7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x127}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) r9 = syz_open_pts(0xffffffffffffffff, 0x400000) ioctl$TIOCMBIC(r9, 0x5417, &(0x7f0000000000)=0x8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r10 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r10, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x9840) r11 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001bc0)=ANY=[@ANYRES64, @ANYRES32, @ANYBLOB="0000000100008000ae101a80"], 0x44}, 0x1, 0x0, 0x0, 0x44}, 0x48008) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_ublk_setup_queues(r8, r7, &(0x7f0000000180)={0x0, 0x3e0e, 0x400, 0x0, 0x28e}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8bf, 0x40, 0x2, 0x9a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x200, 0x0, 0x3b2, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766c, 0x800, 0x0, 0x16a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x400, 0x3, 0x201}}], 0x4, &(0x7f0000001f40)={0x2e, 0x44, 0x0, r8, 0xc0107523, 0x0, 0x0, 0x0, 0x0, {0x10}, 0x0, r6, '\x00', {0x3, 0xb59, 0x100104, 0x0}}, 0x0) 1.926456323s ago: executing program 4 (id=1349): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8008, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r0, 0x0) r1 = socket(0x2b, 0x80801, 0x1) bind$packet(r1, &(0x7f0000000000)={0x11, 0xc, 0x0, 0x1, 0xfc, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, 0x14) 1.690260408s ago: executing program 5 (id=1350): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0x4, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200affd14000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 372.50078ms ago: executing program 6 (id=1351): ioctl$OCFS2_IOC_UNRESVSP(0xffffffffffffffff, 0x40305829, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x20000, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) write(r0, &(0x7f00000001c0)="240000001a005f0400f9f407000904018020000000000000000000000800020000000045", 0x24) 365.242225ms ago: executing program 2 (id=1352): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4c050}, 0x8040) 270.382683ms ago: executing program 4 (id=1353): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) pread64(r1, &(0x7f0000000580)=""/224, 0xe0, 0x200000000000002) 135.307098ms ago: executing program 6 (id=1354): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r0, 0x3, 0x2) 105.004177ms ago: executing program 4 (id=1355): mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @local}, 0x10) ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2284, 0x0) shutdown(r1, 0x2) 34.999101ms ago: executing program 2 (id=1356): r0 = eventfd2(0x4, 0x800) io_setup(0x6, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x10, r0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}]) io_cancel(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x0) 743.174µs ago: executing program 6 (id=1357): bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008040) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000000000000) 0s ago: executing program 5 (id=1358): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x4) socketpair$unix(0x1, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): .438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 122.233301][ T5332] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 122.385553][ T5332] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice= 1.00 [ 122.387304][ T5332] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.389593][ T5332] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 122.389616][ T5332] usb 5-1: Product: syz [ 122.389630][ T5332] usb 5-1: Manufacturer: syz [ 122.391183][ T6956] pim6reg: entered allmulticast mode [ 122.452614][ T5332] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 122.582430][ T31] audit: type=1400 audit(1789685079.820:512): avc: denied { connect } for pid=6958 comm="syz.0.442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 122.586163][ T31] audit: type=1400 audit(1789685079.830:513): avc: denied { name_connect } for pid=6958 comm="syz.0.442" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 122.635178][ T5332] gspca_m5602: Failed to find a sensor [ 122.635193][ T5332] ALi m5602 5-1:1.0: ALi m5602 webcam failed [ 122.637623][ T5332] usb 5-1: USB disconnect, device number 6 [ 122.710904][ T6962] FAULT_INJECTION: forcing a failure. [ 122.710904][ T6962] name failslab, interval 1, probability 0, space 0, times 0 [ 122.710936][ T6962] CPU: 1 UID: 0 PID: 6962 Comm: syz.1.443 Not tainted syzkaller #0 PREEMPT(full) [ 122.710959][ T6962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 122.710971][ T6962] Call Trace: [ 122.710977][ T6962] [ 122.710986][ T6962] dump_stack_lvl+0x100/0x190 [ 122.711022][ T6962] should_fail_ex.cold+0x5/0xa [ 122.711053][ T6962] should_failslab+0xc2/0x120 [ 122.711081][ T6962] kmem_cache_alloc_noprof+0x92/0x6a0 [ 122.711103][ T6962] ? lockdep_hardirqs_on+0x7d/0x110 [ 122.711134][ T6962] ? vm_area_dup+0x27/0x9d0 [ 122.711168][ T6962] vm_area_dup+0x27/0x9d0 [ 122.711196][ T6962] __split_vma+0x19c/0x1de0 [ 122.711231][ T6962] ? __pfx___split_vma+0x10/0x10 [ 122.711258][ T6962] ? mas_next_slot+0xc05/0x13a0 [ 122.711303][ T6962] vms_gather_munmap_vmas+0x3a5/0x1720 [ 122.711339][ T6962] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 122.711368][ T6962] ? mtree_range_walk+0x72b/0xb70 [ 122.711405][ T6962] ? mas_walk+0x260/0x310 [ 122.711435][ T6962] __mmap_region+0x4cc/0x32e0 [ 122.711466][ T6962] ? find_held_lock+0x2b/0x80 [ 122.711494][ T6962] ? ima_match_policy+0x8b8/0x23e0 [ 122.711523][ T6962] ? __pfx___mmap_region+0x10/0x10 [ 122.711552][ T6962] ? __lock_acquire+0x5c0/0x1f40 [ 122.711595][ T6962] ? __lock_acquire+0x5c0/0x1f40 [ 122.711618][ T6962] ? find_held_lock+0x2b/0x80 [ 122.711659][ T6962] ? __lock_acquire+0x5c0/0x1f40 [ 122.711683][ T6962] ? do_raw_spin_unlock+0x145/0x1e0 [ 122.711712][ T6962] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 122.711741][ T6962] ? rcu_is_watching+0x13/0xc0 [ 122.711771][ T6962] ? trace_hrtimer_start+0x77/0x220 [ 122.711802][ T6962] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 122.711880][ T6962] mmap_region+0x3db/0x6d0 [ 122.711903][ T6962] ? __pfx_mmap_region+0x10/0x10 [ 122.711921][ T6962] ? shmem_get_unmapped_area+0x141/0x960 [ 122.711950][ T6962] ? selinux_mmap_addr+0x2b/0x110 [ 122.711969][ T6962] ? bpf_lsm_mmap_addr+0x9/0x30 [ 122.711993][ T6962] ? security_mmap_addr+0x71/0x1e0 [ 122.712017][ T6962] ? __get_unmapped_area+0x255/0x3e0 [ 122.712044][ T6962] do_mmap+0x12c7/0x1c30 [ 122.712073][ T6962] ? lock_acquire+0x1d1/0x380 [ 122.712093][ T6962] ? __pfx_do_mmap+0x10/0x10 [ 122.712118][ T6962] ? selinux_mmap_file+0x154/0x1c0 [ 122.712150][ T6962] ? __pfx_down_write_killable+0x10/0x10 [ 122.712185][ T6962] vm_mmap_pgoff+0x28d/0x470 [ 122.712212][ T6962] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 122.712239][ T6962] ? __pfx_do_futex+0x10/0x10 [ 122.712271][ T6962] ksys_mmap_pgoff+0xe4/0x610 [ 122.712296][ T6962] ? __x64_sys_futex+0x358/0x4d0 [ 122.712323][ T6962] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 122.712350][ T6962] ? xfd_validate_state+0x129/0x190 [ 122.712377][ T6962] __x64_sys_mmap+0x125/0x190 [ 122.712403][ T6962] do_syscall_64+0x123/0x790 [ 122.712433][ T6962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.712458][ T6962] RIP: 0033:0x7f50f799e159 [ 122.712476][ T6962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.712498][ T6962] RSP: 002b:00007f50f8878028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 122.712519][ T6962] RAX: ffffffffffffffda RBX: 00007f50f7c25fa0 RCX: 00007f50f799e159 [ 122.712534][ T6962] RDX: 000000000200000f RSI: 0000000000000039 RDI: 000000110c230000 [ 122.712548][ T6962] RBP: 00007f50f7a3506b R08: ffffffffffffffff R09: 0000000000000000 [ 122.712563][ T6962] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 122.712576][ T6962] R13: 00007f50f7c26038 R14: 00007f50f7c25fa0 R15: 00007ffe41712798 [ 122.712611][ T6962] [ 122.792601][ T6962] xt_CONNSECMARK: invalid mode: 0 [ 122.815045][ T31] audit: type=1400 audit(1789685080.060:514): avc: denied { write } for pid=6958 comm="syz.0.442" lport=60517 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 122.818503][ T31] audit: type=1400 audit(1789685080.060:515): avc: denied { setopt } for pid=6958 comm="syz.0.442" lport=60517 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 123.185044][ T31] audit: type=1400 audit(1789685080.430:516): avc: denied { bind } for pid=6968 comm="syz.1.446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 123.280005][ T31] audit: type=1400 audit(1789685080.520:517): avc: denied { mount } for pid=6968 comm="syz.1.446" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 123.461165][ T31] audit: type=1400 audit(1789685080.630:518): avc: denied { ioctl } for pid=6968 comm="syz.1.446" path="socket:[12783]" dev="sockfs" ino=12783 ioctlcmd=0x940e scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 124.326864][ T31] audit: type=1400 audit(1789685081.570:519): avc: denied { unmount } for pid=5604 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 126.781755][ T5786] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 126.993274][ T5713] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 127.163355][ T5713] usb 1-1: Using ep0 maxpacket: 16 [ 127.167117][ T5713] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 127.195545][ T5713] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 127.195590][ T5713] usb 1-1: config 0 interface 0 altsetting 64 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 127.195616][ T5713] usb 1-1: config 0 interface 0 has no altsetting 0 [ 127.195645][ T5713] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.202241][ T5713] usb 1-1: config 0 descriptor?? [ 127.245149][ T5786] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 127.246047][ T5786] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 127.246081][ T5786] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 127.246115][ T5786] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.251130][ T5786] usb 3-1: config 0 descriptor?? [ 127.255071][ T5786] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 127.289073][ T31] kauditd_printk_skb: 11 callbacks suppressed [ 127.289088][ T31] audit: type=1400 audit(1789685084.530:531): avc: denied { kexec_image_load } for pid=7055 comm="syz.4.479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 127.331960][ T5713] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 127.345926][ T7058] netlink: 16 bytes leftover after parsing attributes in process `syz.4.480'. [ 127.345947][ T7058] netlink: 32 bytes leftover after parsing attributes in process `syz.4.480'. [ 127.456226][ T31] audit: type=1400 audit(1789685084.700:532): avc: denied { nlmsg_write } for pid=7061 comm="syz.3.482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 127.690026][ T7074] pim6reg: entered allmulticast mode [ 127.774342][ T31] audit: type=1400 audit(1789685085.020:533): avc: denied { create } for pid=7079 comm="syz.1.489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 127.818673][ T31] audit: type=1400 audit(1789685085.060:534): avc: denied { write } for pid=7079 comm="syz.1.489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 128.123266][ T5786] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 128.180977][ T5713] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 128.253822][ T5786] usb 5-1: device descriptor read/64, error -71 [ 128.377285][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 128.377370][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 128.493367][ T5786] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 128.613267][ T5713] usb 4-1: device descriptor read/64, error -71 [ 128.623738][ T5786] usb 5-1: device descriptor read/64, error -71 [ 128.733530][ T5786] usb usb5-port1: attempt power cycle [ 128.853591][ T5713] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 128.983519][ T5713] usb 4-1: device descriptor read/64, error -71 [ 129.096295][ T5713] usb usb4-port1: attempt power cycle [ 129.136037][ T5786] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 129.209800][ T5786] usb 5-1: device descriptor read/8, error -71 [ 129.463258][ T5713] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 129.485701][ T5713] usb 4-1: device descriptor read/8, error -71 [ 129.700736][ T9] usb 3-1: USB disconnect, device number 11 [ 129.727591][ T5713] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 129.745576][ T5713] usb 4-1: device descriptor read/8, error -71 [ 129.869008][ T5713] usb usb4-port1: unable to enumerate USB device [ 129.883017][ T5332] usb 1-1: USB disconnect, device number 7 [ 129.924435][ T5786] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 129.952150][ T5786] usb 5-1: device descriptor read/8, error -71 [ 130.040714][ T31] audit: type=1400 audit(1789685087.280:535): avc: denied { connect } for pid=7111 comm="syz.0.501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 130.071316][ T5786] usb usb5-port1: unable to enumerate USB device [ 130.198270][ T7122] FAULT_INJECTION: forcing a failure. [ 130.198270][ T7122] name failslab, interval 1, probability 0, space 0, times 0 [ 130.198300][ T7122] CPU: 0 UID: 0 PID: 7122 Comm: syz.2.505 Not tainted syzkaller #0 PREEMPT(full) [ 130.198322][ T7122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 130.198333][ T7122] Call Trace: [ 130.198339][ T7122] [ 130.198347][ T7122] dump_stack_lvl+0x100/0x190 [ 130.198390][ T7122] should_fail_ex.cold+0x5/0xa [ 130.198420][ T7122] should_failslab+0xc2/0x120 [ 130.198448][ T7122] kmem_cache_alloc_noprof+0x92/0x6a0 [ 130.198474][ T7122] ? vm_area_dup+0x27/0x9d0 [ 130.198509][ T7122] vm_area_dup+0x27/0x9d0 [ 130.198539][ T7122] __split_vma+0x19c/0x1de0 [ 130.198573][ T7122] ? __pfx___split_vma+0x10/0x10 [ 130.198603][ T7122] ? mas_next_slot+0xc05/0x13a0 [ 130.198647][ T7122] vms_gather_munmap_vmas+0x3a5/0x1720 [ 130.198683][ T7122] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 130.198709][ T7122] ? mtree_range_walk+0x72b/0xb70 [ 130.198740][ T7122] ? mas_walk+0x260/0x310 [ 130.198768][ T7122] __mmap_region+0x4cc/0x32e0 [ 130.198800][ T7122] ? find_held_lock+0x2b/0x80 [ 130.198827][ T7122] ? ima_match_policy+0x8b8/0x23e0 [ 130.198852][ T7122] ? __pfx___mmap_region+0x10/0x10 [ 130.198880][ T7122] ? __lock_acquire+0x5c0/0x1f40 [ 130.198916][ T7122] ? __lock_acquire+0x5c0/0x1f40 [ 130.198938][ T7122] ? find_held_lock+0x2b/0x80 [ 130.198976][ T7122] ? __lock_acquire+0x5c0/0x1f40 [ 130.198997][ T7122] ? do_raw_spin_unlock+0x145/0x1e0 [ 130.199020][ T7122] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 130.199046][ T7122] ? rcu_is_watching+0x13/0xc0 [ 130.199071][ T7122] ? trace_hrtimer_start+0x77/0x220 [ 130.199100][ T7122] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 130.199175][ T7122] mmap_region+0x3db/0x6d0 [ 130.199197][ T7122] ? __pfx_mmap_region+0x10/0x10 [ 130.199216][ T7122] ? shmem_get_unmapped_area+0x141/0x960 [ 130.199243][ T7122] ? selinux_mmap_addr+0x2b/0x110 [ 130.199260][ T7122] ? bpf_lsm_mmap_addr+0x9/0x30 [ 130.199285][ T7122] ? security_mmap_addr+0x71/0x1e0 [ 130.199308][ T7122] ? __get_unmapped_area+0x255/0x3e0 [ 130.199334][ T7122] do_mmap+0x12c7/0x1c30 [ 130.199362][ T7122] ? lock_acquire+0x1d1/0x380 [ 130.199393][ T7122] ? __pfx_do_mmap+0x10/0x10 [ 130.199417][ T7122] ? selinux_mmap_file+0x154/0x1c0 [ 130.199448][ T7122] ? __pfx_down_write_killable+0x10/0x10 [ 130.199482][ T7122] vm_mmap_pgoff+0x28d/0x470 [ 130.199508][ T7122] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 130.199534][ T7122] ? __pfx_do_futex+0x10/0x10 [ 130.199562][ T7122] ksys_mmap_pgoff+0xe4/0x610 [ 130.199585][ T7122] ? __x64_sys_futex+0x358/0x4d0 [ 130.199611][ T7122] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 130.199634][ T7122] ? xfd_validate_state+0x129/0x190 [ 130.199660][ T7122] __x64_sys_mmap+0x125/0x190 [ 130.199685][ T7122] do_syscall_64+0x123/0x790 [ 130.199713][ T7122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.199733][ T7122] RIP: 0033:0x7fc348b9e159 [ 130.199750][ T7122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.199768][ T7122] RSP: 002b:00007fc346df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 130.199787][ T7122] RAX: ffffffffffffffda RBX: 00007fc348e25fa0 RCX: 00007fc348b9e159 [ 130.199800][ T7122] RDX: 000000000200000f RSI: 0000000000000039 RDI: 000000110c230000 [ 130.199812][ T7122] RBP: 00007fc348c3506b R08: ffffffffffffffff R09: 0000000000000000 [ 130.199824][ T7122] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 130.199835][ T7122] R13: 00007fc348e26038 R14: 00007fc348e25fa0 R15: 00007ffdff609428 [ 130.199861][ T7122] [ 130.202137][ T7122] xt_CONNSECMARK: invalid mode: 0 [ 130.873238][ T5332] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 131.397129][ T5332] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 131.398727][ T5332] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.398760][ T5332] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 131.398791][ T5332] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.405391][ T5332] usb 3-1: config 0 descriptor?? [ 131.418018][ T5332] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 131.827884][ T7157] FAULT_INJECTION: forcing a failure. [ 131.827884][ T7157] name failslab, interval 1, probability 0, space 0, times 0 [ 131.827914][ T7157] CPU: 1 UID: 0 PID: 7157 Comm: syz.4.518 Not tainted syzkaller #0 PREEMPT(full) [ 131.827936][ T7157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 131.827947][ T7157] Call Trace: [ 131.827954][ T7157] [ 131.827962][ T7157] dump_stack_lvl+0x100/0x190 [ 131.827997][ T7157] should_fail_ex.cold+0x5/0xa [ 131.828028][ T7157] should_failslab+0xc2/0x120 [ 131.828057][ T7157] kmem_cache_alloc_noprof+0x92/0x6a0 [ 131.828080][ T7157] ? mas_preallocate+0xc22/0xee0 [ 131.828114][ T7157] mas_preallocate+0xc22/0xee0 [ 131.828145][ T7157] ? __pfx_mas_preallocate+0x10/0x10 [ 131.828181][ T7157] ? anon_vma_name+0x5a/0x250 [ 131.828213][ T7157] __split_vma+0x2f8/0x1de0 [ 131.828247][ T7157] ? __pfx___split_vma+0x10/0x10 [ 131.828274][ T7157] ? mas_next_slot+0xc05/0x13a0 [ 131.828317][ T7157] vms_gather_munmap_vmas+0x3a5/0x1720 [ 131.828351][ T7157] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 131.828379][ T7157] ? mtree_range_walk+0x72b/0xb70 [ 131.828413][ T7157] ? mas_walk+0x260/0x310 [ 131.828443][ T7157] __mmap_region+0x4cc/0x32e0 [ 131.828473][ T7157] ? find_held_lock+0x2b/0x80 [ 131.828500][ T7157] ? ima_match_policy+0x8b8/0x23e0 [ 131.828528][ T7157] ? __pfx___mmap_region+0x10/0x10 [ 131.828557][ T7157] ? __lock_acquire+0x5c0/0x1f40 [ 131.828594][ T7157] ? __lock_acquire+0x5c0/0x1f40 [ 131.828632][ T7157] ? __lock_acquire+0x5c0/0x1f40 [ 131.828654][ T7157] ? __lock_acquire+0x5c0/0x1f40 [ 131.828681][ T7157] ? lock_acquire+0x1d1/0x380 [ 131.828700][ T7157] ? finish_task_switch.isra.0+0x948/0x10d0 [ 131.828725][ T7157] ? find_held_lock+0x2b/0x80 [ 131.828751][ T7157] ? finish_task_switch.isra.0+0x948/0x10d0 [ 131.828772][ T7157] ? finish_task_switch.isra.0+0x948/0x10d0 [ 131.828844][ T7157] mmap_region+0x3db/0x6d0 [ 131.828869][ T7157] ? __pfx_mmap_region+0x10/0x10 [ 131.828891][ T7157] ? shmem_get_unmapped_area+0x141/0x960 [ 131.828921][ T7157] ? selinux_mmap_addr+0x2b/0x110 [ 131.828942][ T7157] ? bpf_lsm_mmap_addr+0x9/0x30 [ 131.828970][ T7157] ? security_mmap_addr+0x71/0x1e0 [ 131.828994][ T7157] ? __get_unmapped_area+0x255/0x3e0 [ 131.829021][ T7157] do_mmap+0x12c7/0x1c30 [ 131.829049][ T7157] ? lock_acquire+0x1d1/0x380 [ 131.829070][ T7157] ? __pfx_do_mmap+0x10/0x10 [ 131.829094][ T7157] ? selinux_mmap_file+0x154/0x1c0 [ 131.829126][ T7157] ? __pfx_down_write_killable+0x10/0x10 [ 131.829162][ T7157] vm_mmap_pgoff+0x28d/0x470 [ 131.829191][ T7157] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 131.829218][ T7157] ? __pfx_do_futex+0x10/0x10 [ 131.829250][ T7157] ksys_mmap_pgoff+0xe4/0x610 [ 131.829273][ T7157] ? __x64_sys_futex+0x358/0x4d0 [ 131.829301][ T7157] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 131.829324][ T7157] ? xfd_validate_state+0x129/0x190 [ 131.829350][ T7157] __x64_sys_mmap+0x125/0x190 [ 131.829376][ T7157] do_syscall_64+0x123/0x790 [ 131.829405][ T7157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.829425][ T7157] RIP: 0033:0x7f0e7b39e159 [ 131.829442][ T7157] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.829459][ T7157] RSP: 002b:00007f0e7c33d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 131.829479][ T7157] RAX: ffffffffffffffda RBX: 00007f0e7b625fa0 RCX: 00007f0e7b39e159 [ 131.829492][ T7157] RDX: 000000000200000f RSI: 0000000000000039 RDI: 000000110c230000 [ 131.829503][ T7157] RBP: 00007f0e7b43506b R08: ffffffffffffffff R09: 0000000000000000 [ 131.829516][ T7157] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 131.829527][ T7157] R13: 00007f0e7b626038 R14: 00007f0e7b625fa0 R15: 00007ffe30def5c8 [ 131.829554][ T7157] [ 131.841181][ T7157] xt_CONNSECMARK: invalid mode: 0 [ 131.933464][ T31] audit: type=1400 audit(1789685089.180:536): avc: denied { mount } for pid=7161 comm="syz.1.523" name="/" dev="ramfs" ino=13820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 131.935544][ T31] audit: type=1804 audit(1789685089.180:537): pid=7162 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.1.523" name="bus" dev="ramfs" ino=13821 res=1 errno=0 [ 132.540136][ T31] audit: type=1400 audit(1789685089.780:538): avc: denied { mounton } for pid=7173 comm="syz.3.526" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 132.540250][ T7174] tmpfs: Bad value for 'mpol' [ 132.574638][ T5332] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 132.724208][ T5332] usb 5-1: device descriptor read/64, error -71 [ 132.973239][ T5332] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 133.103203][ T5332] usb 5-1: device descriptor read/64, error -71 [ 133.224867][ T5332] usb usb5-port1: attempt power cycle [ 134.467573][ T5690] usb 3-1: USB disconnect, device number 12 [ 134.503550][ T5332] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 134.524308][ T5332] usb 5-1: device descriptor read/8, error -71 [ 134.763243][ T5332] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 134.786307][ T5332] usb 5-1: device descriptor read/8, error -71 [ 134.893425][ T5332] usb usb5-port1: unable to enumerate USB device [ 135.272274][ T31] audit: type=1804 audit(1789685092.510:539): pid=7232 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.1.550" name="bus" dev="ramfs" ino=13157 res=1 errno=0 [ 135.276128][ T7230] netlink: 'syz.4.549': attribute type 39 has an invalid length. [ 136.903230][ T31] audit: type=1400 audit(1789685094.130:540): avc: denied { mount } for pid=7247 comm="syz.2.556" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 136.903281][ T31] audit: type=1400 audit(1789685094.130:541): avc: denied { watch } for pid=7247 comm="syz.2.556" path="/103/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 136.911724][ T31] audit: type=1400 audit(1789685094.150:542): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 136.939553][ T7251] syz.0.557 uses obsolete (PF_INET,SOCK_PACKET) [ 137.058986][ T7252] ipvlan0: entered promiscuous mode [ 137.437232][ T31] audit: type=1400 audit(1789685094.680:543): avc: denied { read write } for pid=7253 comm="syz.2.558" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 137.437642][ T31] audit: type=1400 audit(1789685094.680:544): avc: denied { open } for pid=7253 comm="syz.2.558" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 137.748515][ T5332] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 138.329802][ T31] audit: type=1400 audit(1789685095.570:545): avc: denied { mount } for pid=7267 comm="syz.4.566" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 138.330522][ T31] audit: type=1400 audit(1789685095.570:546): avc: denied { search } for pid=7267 comm="syz.4.566" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.330647][ T31] audit: type=1400 audit(1789685095.570:547): avc: denied { search } for pid=7267 comm="syz.4.566" name="nvmet" dev="configfs" ino=3398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.330827][ T31] audit: type=1400 audit(1789685095.570:548): avc: denied { search } for pid=7267 comm="syz.4.566" name="subsystems" dev="configfs" ino=3399 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.332447][ T31] audit: type=1400 audit(1789685095.570:549): avc: denied { search } for pid=7267 comm="syz.4.566" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.332564][ T31] audit: type=1400 audit(1789685095.570:550): avc: denied { search } for pid=7267 comm="syz.4.566" name="nvmet" dev="configfs" ino=3398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.332687][ T31] audit: type=1400 audit(1789685095.570:551): avc: denied { search } for pid=7267 comm="syz.4.566" name="ports" dev="configfs" ino=3400 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.332998][ T31] audit: type=1400 audit(1789685095.570:552): avc: denied { search } for pid=7267 comm="syz.4.566" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.333117][ T31] audit: type=1400 audit(1789685095.570:553): avc: denied { search } for pid=7267 comm="syz.4.566" name="nvmet" dev="configfs" ino=3398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.334123][ T7270] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 138.335273][ T7270] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 138.336319][ T7270] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 138.337214][ T7270] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 138.343269][ T31] audit: type=1400 audit(1789685095.580:554): avc: denied { search } for pid=7267 comm="syz.4.566" name="ports" dev="configfs" ino=3400 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.413271][ T5332] usb 4-1: device descriptor read/64, error -71 [ 138.747840][ T5332] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 138.826467][ T7282] random: crng reseeded on system resumption [ 138.913465][ T5332] usb 4-1: device descriptor read/64, error -71 [ 139.112188][ T5332] usb usb4-port1: attempt power cycle [ 139.178950][ T7285] macvlan2: entered promiscuous mode [ 139.178971][ T7285] bridge0: entered promiscuous mode [ 139.321756][ T7287] FAULT_INJECTION: forcing a failure. [ 139.321756][ T7287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 139.321786][ T7287] CPU: 0 UID: 0 PID: 7287 Comm: syz.0.572 Not tainted syzkaller #0 PREEMPT(full) [ 139.321809][ T7287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 139.321820][ T7287] Call Trace: [ 139.321827][ T7287] [ 139.321835][ T7287] dump_stack_lvl+0x100/0x190 [ 139.321871][ T7287] should_fail_ex.cold+0x5/0xa [ 139.321900][ T7287] _copy_from_user+0x2e/0xd0 [ 139.321925][ T7287] bpf_vlog_reverse_ubuf+0xda/0x470 [ 139.321966][ T7287] bpf_vlog_finalize+0x20f/0x360 [ 139.321998][ T7287] bpf_log_attr_finalize+0x86/0x1a0 [ 139.322018][ T7287] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 139.322045][ T7287] btf_new_fd+0x3903/0x5bc0 [ 139.322077][ T7287] ? avc_has_perm_noaudit+0x145/0x3b0 [ 139.322118][ T7287] ? __pfx_btf_new_fd+0x10/0x10 [ 139.322149][ T7287] ? rcu_is_watching+0x13/0xc0 [ 139.322179][ T7287] ? cap_capable+0x107/0x430 [ 139.322210][ T7287] ? security_capable+0x80/0x260 [ 139.322240][ T7287] ? ns_capable+0xd2/0xf0 [ 139.322261][ T7287] __sys_bpf+0x13ef/0x4a30 [ 139.322280][ T7287] ? plist_check_list+0x1b8/0x280 [ 139.322307][ T7287] ? __pfx___sys_bpf+0x10/0x10 [ 139.322324][ T7287] ? find_held_lock+0x2b/0x80 [ 139.322350][ T7287] ? futex_wake+0x4ea/0x5e0 [ 139.322383][ T7287] ? futex_private_hash_put.part.0+0xdc/0x180 [ 139.322410][ T7287] ? futex_private_hash_put+0x24/0x30 [ 139.322440][ T7287] ? __pfx_futex_wake+0x10/0x10 [ 139.322480][ T7287] ? ksys_write+0x190/0x250 [ 139.322503][ T7287] ? ksys_write+0x190/0x250 [ 139.322542][ T7287] ? __x64_sys_futex+0x34f/0x4d0 [ 139.322572][ T7287] ? __x64_sys_futex+0x358/0x4d0 [ 139.322604][ T7287] ? xfd_validate_state+0x129/0x190 [ 139.322630][ T7287] ? __x64_sys_bpf+0xce/0x140 [ 139.322650][ T7287] __x64_sys_bpf+0xce/0x140 [ 139.322671][ T7287] ? do_syscall_64+0xae/0x790 [ 139.322696][ T7287] do_syscall_64+0x123/0x790 [ 139.322731][ T7287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.322753][ T7287] RIP: 0033:0x7fb193d9e159 [ 139.322769][ T7287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.322791][ T7287] RSP: 002b:00007fb194ca6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 139.322815][ T7287] RAX: ffffffffffffffda RBX: 00007fb194025fa0 RCX: 00007fb193d9e159 [ 139.322830][ T7287] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 139.322844][ T7287] RBP: 00007fb193e3506b R08: 0000000000000000 R09: 0000000000000000 [ 139.322858][ T7287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.322871][ T7287] R13: 00007fb194026038 R14: 00007fb194025fa0 R15: 00007ffdab65a8b8 [ 139.322900][ T7287] [ 139.773207][ T5332] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 139.796602][ T5332] usb 4-1: device descriptor read/8, error -71 [ 140.183201][ T5332] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 140.204475][ T5332] usb 4-1: device descriptor read/8, error -71 [ 140.324543][ T5332] usb usb4-port1: unable to enumerate USB device [ 141.113507][ T7323] netlink: 12 bytes leftover after parsing attributes in process `syz.3.585'. [ 141.383103][ T7333] netlink: 32 bytes leftover after parsing attributes in process `syz.1.588'. [ 141.501491][ T7336] FAULT_INJECTION: forcing a failure. [ 141.501491][ T7336] name failslab, interval 1, probability 0, space 0, times 0 [ 141.501519][ T7336] CPU: 0 UID: 0 PID: 7336 Comm: syz.1.592 Not tainted syzkaller #0 PREEMPT(full) [ 141.501540][ T7336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 141.501550][ T7336] Call Trace: [ 141.501556][ T7336] [ 141.501563][ T7336] dump_stack_lvl+0x100/0x190 [ 141.501595][ T7336] should_fail_ex.cold+0x5/0xa [ 141.501621][ T7336] should_failslab+0xc2/0x120 [ 141.501647][ T7336] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 141.501668][ T7336] ? sock_alloc_inode+0x26/0x2c0 [ 141.501704][ T7336] ? __pfx_sock_alloc_inode+0x10/0x10 [ 141.501732][ T7336] sock_alloc_inode+0x26/0x2c0 [ 141.501756][ T7336] ? __pfx_sock_alloc_inode+0x10/0x10 [ 141.501780][ T7336] alloc_inode+0x68/0x250 [ 141.501797][ T7336] sock_alloc+0x44/0x280 [ 141.501820][ T7336] ? security_socket_create+0x7f/0x250 [ 141.501851][ T7336] __sock_create+0xc2/0x860 [ 141.501879][ T7336] __sys_socket+0x14d/0x260 [ 141.501893][ T7336] ? __pfx___sys_socket+0x10/0x10 [ 141.501917][ T7336] __x64_sys_socket+0x72/0xb0 [ 141.501933][ T7336] ? lockdep_hardirqs_on+0x7d/0x110 [ 141.501964][ T7336] do_syscall_64+0x123/0x790 [ 141.501994][ T7336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.502015][ T7336] RIP: 0033:0x7f50f799e159 [ 141.502037][ T7336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.502056][ T7336] RSP: 002b:00007f50f8878028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 141.502078][ T7336] RAX: ffffffffffffffda RBX: 00007f50f7c25fa0 RCX: 00007f50f799e159 [ 141.502090][ T7336] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 141.502102][ T7336] RBP: 00007f50f7a3506b R08: 0000000000000000 R09: 0000000000000000 [ 141.502112][ T7336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.502123][ T7336] R13: 00007f50f7c26038 R14: 00007f50f7c25fa0 R15: 00007ffe41712798 [ 141.502148][ T7336] [ 141.502167][ T7336] socket: no more sockets [ 142.477107][ T7357] ipvlan0: entered promiscuous mode [ 142.494714][ T5697] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 142.572553][ T7365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.602'. [ 142.663628][ T5697] usb 1-1: Using ep0 maxpacket: 16 [ 142.664708][ T5697] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 142.666265][ T5697] usb 1-1: config 0 interface 0 altsetting 64 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 142.666298][ T5697] usb 1-1: config 0 interface 0 has no altsetting 0 [ 142.666328][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.681320][ T5697] usb 1-1: config 0 descriptor?? [ 142.705714][ T5697] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 143.011707][ T7374] xt_bpf: check failed: parse error [ 144.638708][ T31] kauditd_printk_skb: 26 callbacks suppressed [ 144.638759][ T31] audit: type=1400 audit(1789685101.800:581): avc: denied { setopt } for pid=7382 comm="syz.3.607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 145.579255][ T5697] usb 1-1: USB disconnect, device number 8 [ 146.052232][ T31] audit: type=1400 audit(1789685103.290:582): avc: denied { read write } for pid=7414 comm="syz.0.617" name="sg0" dev="devtmpfs" ino=1145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 146.052359][ T31] audit: type=1400 audit(1789685103.290:583): avc: denied { open } for pid=7414 comm="syz.0.617" path="/dev/sg0" dev="devtmpfs" ino=1145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 146.123526][ T31] audit: type=1400 audit(1789685103.360:584): avc: denied { ioctl } for pid=7414 comm="syz.0.617" path="/dev/sg0" dev="devtmpfs" ino=1145 ioctlcmd=0x2286 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 146.238426][ T31] audit: type=1400 audit(1789685103.480:585): avc: denied { write } for pid=7417 comm="syz.0.620" lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 146.239451][ T31] audit: type=1400 audit(1789685103.480:586): avc: denied { name_connect } for pid=7417 comm="syz.0.620" dest=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 149.646178][ T7486] xt_CONNSECMARK: invalid mode: 0 [ 149.936261][ T7494] random: crng reseeded on system resumption [ 151.087385][ T31] audit: type=1400 audit(1789685108.340:587): avc: denied { relabelfrom } for pid=7513 comm="syz.1.656" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 151.090744][ T31] audit: type=1400 audit(1789685108.340:588): avc: denied { relabelto } for pid=7513 comm="syz.1.656" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 151.186028][ T7514] syzkaller0: entered promiscuous mode [ 151.186052][ T7514] syzkaller0: entered allmulticast mode [ 152.260905][ T7530] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input8 [ 152.389760][ T31] audit: type=1400 audit(1789685109.630:589): avc: denied { read } for pid=4951 comm="acpid" name="mouse1" dev="devtmpfs" ino=2856 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 152.390220][ T31] audit: type=1400 audit(1789685109.630:590): avc: denied { open } for pid=4951 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=2856 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 152.390700][ T31] audit: type=1400 audit(1789685109.630:591): avc: denied { ioctl } for pid=4951 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=2856 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 152.664320][ T31] audit: type=1400 audit(1789685109.910:592): avc: denied { mount } for pid=7537 comm="syz.4.667" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 152.667659][ T31] audit: type=1400 audit(1789685109.910:593): avc: denied { search } for pid=7537 comm="syz.4.667" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 152.667865][ T31] audit: type=1400 audit(1789685109.910:594): avc: denied { read } for pid=7537 comm="syz.4.667" name="trace" dev="tracefs" ino=1243 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 152.668123][ T31] audit: type=1400 audit(1789685109.910:595): avc: denied { open } for pid=7537 comm="syz.4.667" path="/146/trace/trace" dev="tracefs" ino=1243 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 152.820676][ T31] audit: type=1400 audit(1789685110.060:596): avc: denied { create } for pid=7539 comm="syz.3.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 155.562550][ T7577] netlink: 'syz.2.679': attribute type 1 has an invalid length. [ 155.875576][ T7577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.014697][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 159.014713][ T31] audit: type=1400 audit(1789685116.250:600): avc: denied { write } for pid=7630 comm="syz.3.696" name="usb_gadget" dev="configfs" ino=3619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.014754][ T31] audit: type=1400 audit(1789685116.250:601): avc: denied { add_name } for pid=7630 comm="syz.3.696" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.032338][ T31] audit: type=1400 audit(1789685116.270:602): avc: denied { create } for pid=7630 comm="syz.3.696" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 159.059167][ T31] audit: type=1400 audit(1789685116.300:603): avc: denied { write } for pid=7630 comm="syz.3.696" name="strings" dev="configfs" ino=14875 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.069566][ T31] audit: type=1400 audit(1789685116.310:604): avc: denied { write } for pid=7630 comm="syz.3.696" name="configs" dev="configfs" ino=14874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.081138][ T31] audit: type=1400 audit(1789685116.320:605): avc: denied { write } for pid=7630 comm="syz.3.696" name="strings" dev="configfs" ino=14880 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.093312][ T31] audit: type=1400 audit(1789685116.330:606): avc: denied { write } for pid=7630 comm="syz.3.696" name="functions" dev="configfs" ino=14873 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.194128][ T31] audit: type=1400 audit(1789685116.440:607): avc: denied { read } for pid=7630 comm="syz.3.696" name="subclass" dev="configfs" ino=14889 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 159.250520][ T31] audit: type=1400 audit(1789685116.490:608): avc: denied { shutdown } for pid=7636 comm="syz.4.698" laddr=::1 lport=39717 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 159.263863][ T31] audit: type=1400 audit(1789685116.490:609): avc: denied { write } for pid=7630 comm="syz.3.696" name="c.1" dev="configfs" ino=14879 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.685290][ T5732] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 159.845394][ T5732] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 159.849208][ T5732] usb 1-1: Dual-Role OTG device on HNP port [ 159.849568][ T5732] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.907265][ T5732] gspca_main: spca501-2.14.0 probing 0000:0000 [ 159.914869][ T5732] gspca_spca501: reg write: error -32 [ 159.914884][ T5732] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 159.914946][ T5732] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 159.989645][ T5732] input: HID 0000:0000 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/0003:0000:0000.0003/input/input9 [ 160.790053][ T5732] hid-generic 0003:0000:0000.0003: input,hidraw0: USB HID v1.01 Keyboard [HID 0000:0000] on usb-dummy_hcd.0-1/input0 [ 160.894551][ T7673] xt_CONNSECMARK: invalid mode: 0 [ 161.265898][ T7684] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 161.266664][ T7684] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 161.267166][ T7684] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 161.267625][ T7684] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 161.869372][ T7622] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 162.660839][ T7726] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 162.661786][ T7726] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 162.687251][ T7726] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 162.691467][ T7726] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 163.160192][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.772746][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.902858][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.146967][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 164.146988][ T31] audit: type=1400 audit(1789685121.340:616): avc: denied { read } for pid=7754 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 164.147036][ T31] audit: type=1400 audit(1789685121.340:617): avc: denied { open } for pid=7754 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 164.147539][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 164.149355][ T5609] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 164.150114][ T5609] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 164.152562][ T5609] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 164.153236][ T5609] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 164.176982][ T31] audit: type=1400 audit(1789685121.420:618): avc: denied { mounton } for pid=7754 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 164.401123][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.714017][ T43] bridge_slave_1: left allmulticast mode [ 164.714059][ T43] bridge_slave_1: left promiscuous mode [ 164.715945][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.720709][ T43] bridge_slave_0: left allmulticast mode [ 164.720732][ T43] bridge_slave_0: left promiscuous mode [ 164.720892][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.781730][ T43] pim6reg: left allmulticast mode [ 164.850177][ T7772] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 164.851021][ T7772] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 164.851770][ T7772] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 164.852294][ T7772] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 165.829241][ T7733] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 165.999771][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 166.062935][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 166.085417][ T43] bond0 (unregistering): Released all slaves [ 166.099328][ T31] audit: type=1400 audit(1789685123.340:619): avc: denied { create } for pid=7779 comm="syz.1.747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 166.216228][ T5603] Bluetooth: hci1: command tx timeout [ 166.451750][ T31] audit: type=1400 audit(1789685123.690:620): avc: denied { read } for pid=7790 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.452023][ T31] audit: type=1400 audit(1789685123.690:621): avc: denied { read open } for pid=7790 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.477114][ T31] audit: type=1400 audit(1789685123.700:622): avc: denied { getattr } for pid=7790 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.563167][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 167.940103][ T31] audit: type=1400 audit(1789685125.180:623): avc: denied { bind } for pid=7779 comm="syz.1.747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 168.295427][ T5603] Bluetooth: hci1: command tx timeout [ 168.536403][ T7814] Can't find ip_set type hash:ne [ 168.588516][ T31] audit: type=1400 audit(1789685125.830:624): avc: denied { write } for pid=7788 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 168.588545][ T31] audit: type=1400 audit(1789685125.830:625): avc: denied { add_name } for pid=7788 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 168.820285][ T43] hsr_slave_0: left promiscuous mode [ 168.842432][ T43] hsr_slave_1: left promiscuous mode [ 168.855065][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.855108][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.861022][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 168.861038][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 168.920792][ T43] veth1_macvtap: left promiscuous mode [ 168.920845][ T43] veth0_macvtap: left promiscuous mode [ 168.920993][ T43] veth1_vlan: left promiscuous mode [ 168.921507][ T43] veth0_vlan: left promiscuous mode [ 170.373384][ T5603] Bluetooth: hci1: command tx timeout [ 170.524503][ T31] kauditd_printk_skb: 11 callbacks suppressed [ 170.524521][ T31] audit: type=1400 audit(1789685127.770:637): avc: denied { create } for pid=7859 comm="syz.3.767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 170.532644][ T31] audit: type=1400 audit(1789685127.770:638): avc: denied { setopt } for pid=7859 comm="syz.3.767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 172.487126][ T5603] Bluetooth: hci1: command tx timeout [ 172.897982][ T7869] Can't find ip_set type hash:ne [ 172.902187][ T43] team0 (unregistering): Port device team_slave_1 removed [ 172.949184][ T43] team0 (unregistering): Port device team_slave_0 removed [ 173.260927][ T7883] intel_ish_ipc 0000:00:01.0: ISH: Failed to get PCI regions [ 173.260949][ T7883] intel_ish_ipc 0000:00:01.0: probe with driver intel_ish_ipc failed with error -22 [ 173.289305][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1 [ 175.374386][ T7907] netlink: 24 bytes leftover after parsing attributes in process `syz.3.779'. [ 175.719367][ T7754] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.719469][ T7754] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.719606][ T7754] bridge_slave_0: entered allmulticast mode [ 175.725170][ T7754] bridge_slave_0: entered promiscuous mode [ 175.740025][ T7754] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.741923][ T7754] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.742019][ T7754] bridge_slave_1: entered allmulticast mode [ 175.745414][ T7754] bridge_slave_1: entered promiscuous mode [ 175.837721][ T7754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 175.840136][ T7754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 175.918450][ T31] audit: type=1400 audit(1789685133.160:639): avc: denied { write } for pid=7911 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.934533][ T5732] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 175.947143][ T7754] team0: Port device team_slave_0 added [ 175.960729][ T7754] team0: Port device team_slave_1 added [ 176.048078][ T7754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 176.048114][ T7754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 176.048136][ T7754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 176.051994][ T7754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 176.052008][ T7754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 176.052029][ T7754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 176.083645][ T5732] usb 3-1: Using ep0 maxpacket: 32 [ 176.087146][ T5732] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 176.088128][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.096257][ T5732] usb 3-1: config 0 descriptor?? [ 176.166941][ T5732] as10x_usb: device has been detected [ 176.171496][ T5732] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 176.231031][ T31] audit: type=1400 audit(1789685133.450:640): avc: denied { write } for pid=7950 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 176.235393][ T7949] netlink: 104 bytes leftover after parsing attributes in process `syz.1.791'. [ 176.324797][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2 [ 176.342090][ T7754] hsr_slave_0: entered promiscuous mode [ 176.355480][ T7754] hsr_slave_1: entered promiscuous mode [ 176.356024][ T7754] debugfs: 'hsr0' already exists in 'hsr' [ 176.356042][ T7754] Cannot create hsr debugfs directory [ 176.361697][ T5732] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 176.588162][ T5732] as10x_usb: error during firmware upload part1 [ 176.613209][ T5732] Registered device nBox DVB-T Dongle [ 176.718243][ T5732] usb 3-1: USB disconnect, device number 13 [ 177.040119][ T5732] Unregistered device nBox DVB-T Dongle [ 177.050434][ T5732] as10x_usb: device has been disconnected [ 177.361364][ T31] audit: type=1400 audit(1789685134.600:641): avc: denied { ioctl } for pid=7977 comm="syz.3.800" path="/dev/input/event2" dev="devtmpfs" ino=916 ioctlcmd=0x4503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 177.520002][ T7754] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 177.544121][ T7754] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 177.544878][ T7754] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 177.560482][ T7754] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 177.566408][ T7754] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 177.597627][ T7754] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 177.608898][ T7754] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 177.650381][ T7754] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 177.668725][ T31] audit: type=1400 audit(1789685134.910:642): avc: denied { write } for pid=7963 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.805111][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 177.900944][ T31] audit: type=1400 audit(1789685135.140:643): avc: denied { write } for pid=8007 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.918314][ T7754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 177.955426][ T7754] 8021q: adding VLAN 0 to HW filter on device team0 [ 177.965953][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.966029][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 177.976280][ T9] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 177.977290][ T9] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 177.977312][ T9] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 177.977329][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 177.977363][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 177.977387][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 177.981037][ T9] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 177.981058][ T9] usb 4-1: Product: syz [ 177.981072][ T9] usb 4-1: Manufacturer: syz [ 178.197718][ T138] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.197810][ T138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.335923][ T9] cdc_wdm 4-1:1.0: skipping garbage [ 178.335942][ T9] cdc_wdm 4-1:1.0: skipping garbage [ 178.340301][ T9] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 178.340319][ T9] cdc_wdm 4-1:1.0: Unknown control protocol [ 178.390757][ T5261] 8021q: adding VLAN 0 to HW filter on device eth3 [ 178.561982][ T31] audit: type=1400 audit(1789685135.800:644): avc: denied { read write } for pid=7986 comm="syz.3.803" name="cdc-wdm0" dev="devtmpfs" ino=2891 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 178.562274][ T31] audit: type=1400 audit(1789685135.800:645): avc: denied { open } for pid=7986 comm="syz.3.803" path="/dev/cdc-wdm0" dev="devtmpfs" ino=2891 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 178.622173][ T31] audit: type=1400 audit(1789685135.870:646): avc: denied { create } for pid=8027 comm="syz.2.812" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 178.648473][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.648557][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.648765][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.648783][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.648972][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.648989][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.649114][ T5786] usb 4-1: USB disconnect, device number 11 [ 178.649175][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 178.649191][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 178.649204][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 178.887884][ T31] audit: type=1400 audit(1789685136.130:647): avc: denied { write } for pid=8036 comm="syz.1.815" name="naa.5001405000000001" dev="configfs" ino=16023 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 178.999975][ T31] audit: type=1400 audit(1789685136.240:648): avc: denied { ioctl } for pid=7986 comm="syz.3.803" path="socket:[16646]" dev="sockfs" ino=16646 ioctlcmd=0x8931 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 179.133432][ T9] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 179.275735][ T7754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 179.285224][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 179.286166][ T9] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 179.287007][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.296439][ T9] usb 3-1: config 0 descriptor?? [ 179.316829][ T9] as10x_usb: device has been detected [ 179.317349][ T9] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 179.362149][ T9] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 179.403428][ T9] as10x_usb: error during firmware upload part1 [ 179.403907][ T9] Registered device nBox DVB-T Dongle [ 179.515988][ T9] usb 3-1: USB disconnect, device number 14 [ 179.526607][ T5261] 8021q: adding VLAN 0 to HW filter on device eth4 [ 179.767808][ T9] Unregistered device nBox DVB-T Dongle [ 179.776895][ T9] as10x_usb: device has been disconnected [ 179.797956][ T7754] veth0_vlan: entered promiscuous mode [ 179.852482][ T7754] veth1_vlan: entered promiscuous mode [ 179.937016][ T7754] veth0_macvtap: entered promiscuous mode [ 179.950913][ T7754] veth1_macvtap: entered promiscuous mode [ 179.982207][ T7754] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 180.012147][ T7754] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 180.104368][ T45] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.184126][ T45] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.184461][ T45] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.184489][ T45] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.352668][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.352688][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.521280][ T45] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.521300][ T45] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.633200][ T5786] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 180.723469][ T5732] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 180.785062][ T5786] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 180.786217][ T5786] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 180.786262][ T5786] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 180.786281][ T5786] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 180.786319][ T5786] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 180.786343][ T5786] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 180.790594][ T5786] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 180.790639][ T5786] usb 3-1: Product: syz [ 180.790660][ T5786] usb 3-1: Manufacturer: syz [ 180.796408][ T5786] cdc_wdm 3-1:1.0: skipping garbage [ 180.796440][ T5786] cdc_wdm 3-1:1.0: skipping garbage [ 180.805382][ T5786] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 180.805399][ T5786] cdc_wdm 3-1:1.0: Unknown control protocol [ 180.873439][ T5732] usb 5-1: Using ep0 maxpacket: 16 [ 180.874220][ T5732] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 180.877999][ T5732] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.878045][ T5732] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.878067][ T5732] usb 5-1: config 0 interface 0 has no altsetting 0 [ 180.878092][ T5732] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.887380][ T5732] usb 5-1: config 0 descriptor?? [ 180.971337][ T31] kauditd_printk_skb: 13 callbacks suppressed [ 180.971352][ T31] audit: type=1400 audit(1789685138.210:662): avc: denied { write } for pid=8133 comm="syz.5.846" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 181.013497][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 181.056078][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 181.056103][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 181.056330][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 181.056348][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 181.056531][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 181.056548][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 181.056740][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 181.056757][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 181.056859][ T5786] usb 3-1: USB disconnect, device number 15 [ 181.056940][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 181.056956][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 181.056971][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 181.152074][ T31] audit: type=1400 audit(1789685138.390:663): avc: denied { bind } for pid=8140 comm="syz.5.848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 181.159156][ T8141] tipc: Failed to remove unknown binding: 66,0,0/0:1587272030/1587272031 [ 181.160144][ T8141] tipc: Failed to remove unknown binding: 66,0,0/0:1587272030/1587272031 [ 181.213318][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 181.216184][ T9] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 181.219128][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.246557][ T9] usb 4-1: config 0 descriptor?? [ 181.266842][ T9] as10x_usb: device has been detected [ 181.267430][ T9] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 181.299474][ T9] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 181.313524][ T9] as10x_usb: error during firmware upload part1 [ 181.313960][ T9] Registered device nBox DVB-T Dongle [ 181.352243][ T5732] usbhid 5-1:0.0: can't add hid device: -71 [ 181.352353][ T5732] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 181.359265][ T5732] usb 5-1: USB disconnect, device number 15 [ 181.472416][ T5720] usb 4-1: USB disconnect, device number 12 [ 181.662053][ T31] audit: type=1400 audit(1789685138.900:664): avc: denied { read } for pid=8165 comm="syz.5.859" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 181.662101][ T31] audit: type=1400 audit(1789685138.900:665): avc: denied { open } for pid=8165 comm="syz.5.859" path="/9/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 181.662146][ T31] audit: type=1400 audit(1789685138.900:666): avc: denied { ioctl } for pid=8165 comm="syz.5.859" path="/9/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xfd11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 181.706612][ T5720] Unregistered device nBox DVB-T Dongle [ 181.716869][ T5720] as10x_usb: device has been disconnected [ 181.863405][ T8176] netlink: 52 bytes leftover after parsing attributes in process `syz.1.865'. [ 182.226406][ T8198] netlink: 200 bytes leftover after parsing attributes in process `syz.4.875'. [ 182.226428][ T8198] netlink: 44 bytes leftover after parsing attributes in process `syz.4.875'. [ 183.381070][ T8219] netlink: 'syz.2.884': attribute type 21 has an invalid length. [ 183.381986][ T8219] IPv6: NLM_F_CREATE should be specified when creating new route [ 184.735033][ T31] audit: type=1400 audit(1789685141.970:667): avc: denied { cmd } for pid=8247 comm="iou-wrk-8249" path="/dev/ublk-control" dev="devtmpfs" ino=695 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 184.993429][ T31] audit: type=1400 audit(1789685142.180:668): avc: denied { map } for pid=8247 comm="syz.5.895" path="/dev/ublkc4" dev="devtmpfs" ino=2922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 185.775253][ T8261] netlink: 352 bytes leftover after parsing attributes in process `syz.3.898'. [ 185.775274][ T8261] netlink: 44 bytes leftover after parsing attributes in process `syz.3.898'. [ 186.111867][ T31] audit: type=1400 audit(1789685143.350:669): avc: denied { create } for pid=8277 comm="syz.1.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 186.142591][ T31] audit: type=1400 audit(1789685143.380:670): avc: denied { bind } for pid=8277 comm="syz.1.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 186.186491][ T31] audit: type=1400 audit(1789685143.430:671): avc: denied { write } for pid=8277 comm="syz.1.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 186.292233][ T8284] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 186.306288][ T8284] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 186.307197][ T8284] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 186.307750][ T8284] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 186.769247][ T8300] lo: Caught tx_queue_len zero misconfig [ 186.843091][ T31] audit: type=1400 audit(1789685144.080:672): avc: denied { getopt } for pid=8301 comm="syz.5.914" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 186.916602][ T8304] FAULT_INJECTION: forcing a failure. [ 186.916602][ T8304] name failslab, interval 1, probability 0, space 0, times 0 [ 186.916636][ T8304] CPU: 1 UID: 0 PID: 8304 Comm: syz.3.915 Not tainted syzkaller #0 PREEMPT(full) [ 186.916659][ T8304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 186.916671][ T8304] Call Trace: [ 186.916678][ T8304] [ 186.916686][ T8304] dump_stack_lvl+0x100/0x190 [ 186.916717][ T8304] should_fail_ex.cold+0x5/0xa [ 186.916745][ T8304] should_failslab+0xc2/0x120 [ 186.916769][ T8304] kmem_cache_alloc_noprof+0x92/0x6a0 [ 186.916791][ T8304] ? __kernfs_new_node+0xd2/0xa10 [ 186.916824][ T8304] __kernfs_new_node+0xd2/0xa10 [ 186.916857][ T8304] ? __pfx___kernfs_new_node+0x10/0x10 [ 186.916888][ T8304] ? lock_acquire+0x1d1/0x380 [ 186.916908][ T8304] ? kernfs_root+0x23/0x2a0 [ 186.916934][ T8304] ? find_held_lock+0x2b/0x80 [ 186.916960][ T8304] ? kernfs_root+0xee/0x2a0 [ 186.916985][ T8304] ? kernfs_root+0xee/0x2a0 [ 186.917014][ T8304] kernfs_new_node+0x117/0x150 [ 186.917044][ T8304] kernfs_create_link+0xcc/0x240 [ 186.917069][ T8304] sysfs_do_create_link_sd+0x90/0x140 [ 186.917098][ T8304] sysfs_create_link+0x61/0xc0 [ 186.917125][ T8304] driver_sysfs_add+0x112/0x2d0 [ 186.917149][ T8304] really_probe+0x146/0xa60 [ 186.917174][ T8304] __driver_probe_device+0x210/0x460 [ 186.917196][ T8304] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 186.917225][ T8304] driver_probe_device+0x4a/0x140 [ 186.917249][ T8304] __driver_attach+0x21f/0x5b0 [ 186.917274][ T8304] ? __pfx___driver_attach+0x10/0x10 [ 186.917298][ T8304] bus_for_each_dev+0x13e/0x1d0 [ 186.917329][ T8304] ? __pfx_bus_for_each_dev+0x10/0x10 [ 186.917357][ T8304] ? bus_add_driver+0x2b5/0x5b0 [ 186.917384][ T8304] bus_add_driver+0x305/0x5b0 [ 186.917406][ T8304] driver_register+0x1e2/0x360 [ 186.917430][ T8304] ? rcu_is_watching+0x13/0xc0 [ 186.917459][ T8304] usb_gadget_register_driver_owner+0x132/0x210 [ 186.917482][ T8304] raw_ioctl+0x1a85/0x2b80 [ 186.917505][ T8304] ? __pfx_raw_ioctl+0x10/0x10 [ 186.917523][ T8304] ? selinux_file_ioctl+0x13b/0x290 [ 186.917553][ T8304] ? selinux_file_ioctl+0xb6/0x290 [ 186.917578][ T8304] ? __pfx_raw_ioctl+0x10/0x10 [ 186.917600][ T8304] __x64_sys_ioctl+0x18e/0x210 [ 186.917626][ T8304] do_syscall_64+0x123/0x790 [ 186.917657][ T8304] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.917678][ T8304] RIP: 0033:0x7f1aeff9ddeb [ 186.917695][ T8304] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 186.917713][ T8304] RSP: 002b:00007f1aee1f3f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 186.917735][ T8304] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f1aeff9ddeb [ 186.917748][ T8304] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 186.917759][ T8304] RBP: 00007f1aee1f4fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 186.917771][ T8304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 186.917783][ T8304] R13: 0000200000000180 R14: 0000000000000005 R15: 0000000000000000 [ 186.917809][ T8304] [ 186.920133][ T8304] raw-gadget.0 gadget.3: really_probe: driver_sysfs_add failed [ 186.920669][ T8304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.921086][ T8304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.363192][ T31] audit: type=1400 audit(1789685144.600:673): avc: denied { mount } for pid=8318 comm="syz.2.921" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 188.344237][ T31] audit: type=1400 audit(1789685145.590:674): avc: denied { write } for pid=8335 comm="syz.5.926" path="socket:[17974]" dev="sockfs" ino=17974 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 188.660540][ T8354] netlink: 352 bytes leftover after parsing attributes in process `syz.2.935'. [ 188.660561][ T8354] netlink: 44 bytes leftover after parsing attributes in process `syz.2.935'. [ 188.727981][ T31] audit: type=1400 audit(1789685145.970:675): avc: denied { read } for pid=8357 comm="syz.3.936" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 189.824663][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 189.824711][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.884762][ T8387] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 190.150530][ T31] audit: type=1400 audit(1789685147.390:676): avc: denied { bind } for pid=8397 comm="syz.2.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 190.206424][ T31] audit: type=1400 audit(1789685147.450:677): avc: denied { write } for pid=8379 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.348311][ T31] audit: type=1400 audit(1789685147.590:678): avc: denied { write } for pid=8403 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.356012][ T8402] MTRR 2 not used [ 190.633263][ T5732] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 190.783805][ T5732] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 190.786415][ T5732] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 190.786440][ T5732] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 190.786494][ T5732] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 190.786532][ T5732] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 190.786559][ T5732] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 190.790233][ T5732] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 190.790272][ T5732] usb 6-1: Product: syz [ 190.790285][ T5732] usb 6-1: Manufacturer: syz [ 190.808147][ T5732] cdc_wdm 6-1:1.0: skipping garbage [ 190.808163][ T5732] cdc_wdm 6-1:1.0: skipping garbage [ 190.826172][ T5732] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 190.826191][ T5732] cdc_wdm 6-1:1.0: Unknown control protocol [ 191.155107][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.155131][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.155319][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.155336][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.155518][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.155536][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.155721][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.155737][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.155918][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.155934][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156118][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.156135][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156320][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.156337][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156524][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.156542][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156730][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.156746][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156932][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 191.156948][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 191.156960][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 191.156973][ T5697] usb 6-1: USB disconnect, device number 2 [ 191.905918][ T5597] Bluetooth: hci3: command 0x0406 tx timeout [ 191.906383][ T5597] Bluetooth: hci0: command 0x0406 tx timeout [ 191.906419][ T5597] Bluetooth: hci4: command 0x0406 tx timeout [ 191.906459][ T5597] Bluetooth: hci2: command 0x0406 tx timeout [ 191.972377][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 191.972393][ T31] audit: type=1400 audit(1789685149.210:684): avc: denied { write } for pid=8435 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.016418][ T9] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 192.122071][ T8445] SELinux: DCCP has been removed, pid=8445 comm=syz.4.962 [ 192.166558][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 192.167427][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 192.167455][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 192.167477][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 192.167514][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.172471][ T9] usb 4-1: config 0 descriptor?? [ 192.749793][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 192.750147][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 192.819916][ T9] usb 4-1: USB disconnect, device number 13 [ 193.745145][ T31] audit: type=1400 audit(1789685150.990:685): avc: denied { ioctl } for pid=8475 comm="syz.1.969" path="socket:[18157]" dev="sockfs" ino=18157 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 193.841234][ T31] audit: type=1400 audit(1789685151.080:686): avc: denied { write } for pid=8450 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.909103][ T8485] random: crng reseeded on system resumption [ 194.209631][ T31] audit: type=1400 audit(1789685151.450:687): avc: denied { write } for pid=8491 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.353978][ T5604] syz_tun (unregistering): left allmulticast mode [ 194.444797][ T5720] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 194.505147][ T8506] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.981'. [ 194.598780][ T5720] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 194.601296][ T5720] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 194.601324][ T5720] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 194.601343][ T5720] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 194.601406][ T5720] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 194.601431][ T5720] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 194.606485][ T5720] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 194.606508][ T5720] usb 6-1: Product: syz [ 194.606522][ T5720] usb 6-1: Manufacturer: syz [ 194.632325][ T5720] cdc_wdm 6-1:1.0: skipping garbage [ 194.632345][ T5720] cdc_wdm 6-1:1.0: skipping garbage [ 194.691952][ T5720] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 194.691973][ T5720] cdc_wdm 6-1:1.0: Unknown control protocol [ 194.874055][ T6174] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.989427][ T5713] usb 6-1: USB disconnect, device number 3 [ 194.989574][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 195.243426][ T6174] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.429040][ T6174] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.478010][ T31] audit: type=1400 audit(1789685152.720:688): avc: denied { write } for pid=8502 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 195.552355][ T8533] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 195.552355][ T8533] The task syz.4.987 (8533) triggered the difference, watch for misbehavior. [ 195.607744][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 195.609989][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 195.610966][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 195.611578][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 195.611991][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 195.671586][ T6174] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.685561][ T31] audit: type=1400 audit(1789685152.940:689): avc: denied { write } for pid=8536 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 196.028884][ T6174] bridge_slave_1: left allmulticast mode [ 196.028922][ T6174] bridge_slave_1: left promiscuous mode [ 196.029094][ T6174] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.099136][ T6174] bridge_slave_0: left allmulticast mode [ 196.099160][ T6174] bridge_slave_0: left promiscuous mode [ 196.099332][ T6174] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.225331][ T8556] 9p: Bad value for 'wfdno' [ 196.428191][ T31] audit: type=1400 audit(1789685153.670:690): avc: denied { write } for pid=8561 comm="syz.3.996" name="filter" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 196.701902][ T6174] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 196.733700][ T6174] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 196.745134][ T6174] bond0 (unregistering): Released all slaves [ 196.798101][ T8582] FAULT_INJECTION: forcing a failure. [ 196.798101][ T8582] name fail_futex, interval 1, probability 0, space 0, times 1 [ 196.798133][ T8582] CPU: 0 UID: 0 PID: 8582 Comm: syz.4.999 Not tainted syzkaller #0 PREEMPT(full) [ 196.798155][ T8582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 196.798167][ T8582] Call Trace: [ 196.798174][ T8582] [ 196.798180][ T8582] dump_stack_lvl+0x100/0x190 [ 196.798216][ T8582] should_fail_ex.cold+0x5/0xa [ 196.798248][ T8582] get_futex_key+0x1d0/0x14f0 [ 196.798280][ T8582] ? __pfx_get_futex_key+0x10/0x10 [ 196.798314][ T8582] futex_wake+0xf4/0x5e0 [ 196.798339][ T8582] ? kasan_quarantine_put+0x104/0x240 [ 196.798363][ T8582] ? __pfx_futex_wake+0x10/0x10 [ 196.798389][ T8582] ? kfree_skbmem+0x19a/0x210 [ 196.798412][ T8582] ? skb_release_data+0x6ca/0x8e0 [ 196.798428][ T8582] ? kfree_skbmem+0x19f/0x210 [ 196.798457][ T8582] do_futex+0x2b2/0x440 [ 196.798483][ T8582] ? __pfx_do_futex+0x10/0x10 [ 196.798507][ T8582] ? __pfx_do_mq_notify+0x10/0x10 [ 196.798532][ T8582] __x64_sys_futex+0x34f/0x4d0 [ 196.798550][ T8582] ? __pfx___x64_sys_futex+0x10/0x10 [ 196.798571][ T8582] do_syscall_64+0x123/0x790 [ 196.798598][ T8582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.798619][ T8582] RIP: 0033:0x7f0e7b39e159 [ 196.798636][ T8582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.798653][ T8582] RSP: 002b:00007f0e7c33d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 196.798669][ T8582] RAX: ffffffffffffffda RBX: 00007f0e7b625fa8 RCX: 00007f0e7b39e159 [ 196.798676][ T8582] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f0e7b625fac [ 196.798683][ T8582] RBP: 00007f0e7b625fa0 R08: 0000000000000001 R09: 0000000000000000 [ 196.798691][ T8582] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 196.798699][ T8582] R13: 00007f0e7b626038 R14: 00007ffe30def4e0 R15: 00007ffe30def5c8 [ 196.798716][ T8582] [ 197.224648][ T8557] syzkaller0: entered promiscuous mode [ 197.224671][ T8557] syzkaller0: entered allmulticast mode [ 197.655761][ T5609] Bluetooth: hci3: command tx timeout [ 197.961520][ T31] audit: type=1400 audit(1789685155.200:691): avc: denied { write } for pid=8590 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 198.196707][ T31] audit: type=1400 audit(1789685155.440:692): avc: denied { write } for pid=8609 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 198.351521][ T8612] 9p: Bad value for 'wfdno' [ 198.474531][ T8614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1006'. [ 198.474551][ T8614] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1006'. [ 198.596023][ T8618] netlink: 352 bytes leftover after parsing attributes in process `syz.4.1007'. [ 198.596044][ T8618] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1007'. [ 198.726119][ T8621] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1008'. [ 199.734702][ T5609] Bluetooth: hci3: command tx timeout [ 199.736746][ T5261] 8021q: adding VLAN 0 to HW filter on device eth5 [ 199.784011][ T153] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.784841][ T153] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.784872][ T153] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.784900][ T153] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 200.444270][ T6174] hsr_slave_0: left promiscuous mode [ 200.451738][ T6174] hsr_slave_1: left promiscuous mode [ 200.455240][ T6174] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 200.455258][ T6174] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 200.483841][ T6174] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 200.483857][ T6174] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 200.556894][ T6174] veth1_macvtap: left promiscuous mode [ 200.556920][ T6174] veth0_macvtap: left promiscuous mode [ 200.557070][ T6174] veth1_vlan: left promiscuous mode [ 200.557114][ T6174] veth0_vlan: left promiscuous mode [ 200.628938][ T31] audit: type=1400 audit(1789685157.870:693): avc: denied { write } for pid=8633 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 200.851801][ T8661] netlink: 352 bytes leftover after parsing attributes in process `syz.4.1017'. [ 200.851823][ T8661] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1017'. [ 201.042002][ T31] audit: type=1400 audit(1789685158.280:694): avc: denied { write } for pid=8662 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 201.568299][ T6174] team0 (unregistering): Port device team_slave_1 removed [ 201.598139][ T6174] team0 (unregistering): Port device team_slave_0 removed [ 201.815340][ T5609] Bluetooth: hci3: command tx timeout [ 201.831591][ T8665] kthread_run failed with err -4 [ 201.833891][ T5261] 8021q: adding VLAN 0 to HW filter on device eth6 [ 202.544835][ T5697] kernel read not supported for file /480/syscall (pid: 5697 comm: kworker/0:4) [ 203.118935][ T31] audit: type=1400 audit(1789685160.330:695): avc: denied { write } for pid=8715 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.904838][ T5609] Bluetooth: hci3: command tx timeout [ 204.189892][ T31] audit: type=1400 audit(1789685161.430:696): avc: denied { write } for pid=8753 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 204.270744][ T8755] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.368088][ T5261] 8021q: adding VLAN 0 to HW filter on device eth7 [ 204.416140][ T31] audit: type=1400 audit(1789685161.640:697): avc: denied { mount } for pid=8760 comm="syz.2.1042" name="/" dev="rpc_pipefs" ino=19270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 204.459651][ T8534] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.459732][ T8534] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.459840][ T8534] bridge_slave_0: entered allmulticast mode [ 204.469529][ T8769] 9p: Bad value for 'rfdno' [ 204.474250][ T8534] bridge_slave_0: entered promiscuous mode [ 204.490738][ T8534] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.490849][ T8534] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.490978][ T8534] bridge_slave_1: entered allmulticast mode [ 204.497281][ T8534] bridge_slave_1: entered promiscuous mode [ 204.509329][ T31] audit: type=1400 audit(1789685161.760:698): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 204.576017][ T8774] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1048'. [ 204.577126][ T8770] team0 (unregistering): Port device team_slave_0 removed [ 204.589844][ T8770] team0 (unregistering): Port device team_slave_1 removed [ 204.679220][ T8534] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.732045][ T8534] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.818029][ T31] audit: type=1400 audit(1789685162.060:699): avc: denied { write } for pid=8784 comm="syz.2.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 204.899533][ T8534] team0: Port device team_slave_0 added [ 204.916416][ T8534] team0: Port device team_slave_1 added [ 205.072063][ T31] audit: type=1400 audit(1789685162.310:700): avc: denied { write } for pid=8788 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 205.107986][ T8802] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.122740][ T8534] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 205.122756][ T8534] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 205.122798][ T8534] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 205.132357][ T8534] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 205.132371][ T8534] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 205.132409][ T8534] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 205.279513][ T5697] kernel read not supported for file /549/syscall (pid: 5697 comm: kworker/0:4) [ 205.298600][ T8811] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1058'. [ 205.318515][ T8534] hsr_slave_0: entered promiscuous mode [ 205.320729][ T8534] hsr_slave_1: entered promiscuous mode [ 205.331184][ T8534] debugfs: 'hsr0' already exists in 'hsr' [ 205.331203][ T8534] Cannot create hsr debugfs directory [ 205.485440][ T8821] team0 (unregistering): Port device team_slave_0 removed [ 205.489554][ T31] audit: type=1400 audit(1789685162.720:701): avc: denied { write } for pid=8813 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 205.526624][ T8821] team0 (unregistering): Port device team_slave_1 removed [ 205.627004][ T8827] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1064'. [ 205.669797][ T5261] 8021q: adding VLAN 0 to HW filter on device eth8 [ 205.680185][ T8824] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 206.989088][ T8534] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 207.031493][ T8534] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 207.052155][ T8534] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 207.130531][ T8534] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 207.148728][ T8534] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 207.289977][ T8534] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 207.290693][ T8534] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 207.309846][ T8534] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 207.535738][ T8534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.575732][ T8534] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.582956][ T6174] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.584210][ T6174] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.599711][ T8871] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1076'. [ 207.623931][ T5786] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 207.627098][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.627177][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.648691][ T8874] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1078'. [ 207.648727][ T8874] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1078'. [ 207.816847][ T5786] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 207.819224][ T5786] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.819270][ T5786] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.822469][ T5786] usb 6-1: config 0 descriptor?? [ 207.836253][ T5786] pwc: Askey VC010 type 2 USB webcam detected. [ 207.866933][ T31] audit: type=1400 audit(1789685165.110:702): avc: denied { read } for pid=8880 comm="syz.2.1080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 207.908380][ T31] audit: type=1400 audit(1789685165.150:703): avc: denied { setopt } for pid=8880 comm="syz.2.1080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 208.272193][ T5786] pwc: recv_control_msg error -32 req 02 val 2b00 [ 208.294253][ T5786] pwc: recv_control_msg error -32 req 02 val 2700 [ 208.294804][ T5786] pwc: recv_control_msg error -32 req 02 val 2c00 [ 208.295673][ T5786] pwc: recv_control_msg error -32 req 04 val 1000 [ 208.296369][ T5786] pwc: recv_control_msg error -32 req 04 val 1300 [ 208.296935][ T5786] pwc: recv_control_msg error -32 req 04 val 1400 [ 208.297743][ T5786] pwc: recv_control_msg error -32 req 02 val 2000 [ 208.298335][ T5786] pwc: recv_control_msg error -32 req 02 val 2100 [ 208.299619][ T5786] pwc: recv_control_msg error -32 req 04 val 1500 [ 208.300322][ T5786] pwc: recv_control_msg error -32 req 02 val 2500 [ 208.301261][ T5786] pwc: recv_control_msg error -32 req 02 val 2400 [ 208.302712][ T5786] pwc: recv_control_msg error -32 req 02 val 2600 [ 208.303093][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 208.342757][ T5786] pwc: recv_control_msg error -32 req 02 val 2900 [ 208.378183][ T5786] pwc: recv_control_msg error -71 req 02 val 2800 [ 208.410761][ T5786] pwc: recv_control_msg error -71 req 04 val 1100 [ 208.411488][ T5786] pwc: recv_control_msg error -71 req 04 val 1200 [ 208.582812][ T5786] pwc: Registered as video103. [ 208.795606][ T5786] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input10 [ 209.014841][ T5786] usb 6-1: USB disconnect, device number 4 [ 209.218752][ T8908] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1088'. [ 209.301792][ T31] audit: type=1400 audit(1789685166.540:704): avc: denied { bind } for pid=8912 comm="syz.2.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 209.355526][ T31] audit: type=1400 audit(1789685166.600:705): avc: denied { map } for pid=8912 comm="syz.2.1089" path="socket:[19791]" dev="sockfs" ino=19791 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 209.355575][ T31] audit: type=1400 audit(1789685166.600:706): avc: denied { read } for pid=8912 comm="syz.2.1089" path="socket:[19791]" dev="sockfs" ino=19791 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 209.515220][ T8534] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.052202][ T8938] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1098'. [ 210.174059][ T5786] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 210.264966][ T8534] veth0_vlan: entered promiscuous mode [ 210.302416][ T8534] veth1_vlan: entered promiscuous mode [ 210.357546][ T5786] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 210.375541][ T5786] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.375634][ T5786] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.441664][ T5786] usb 3-1: config 0 descriptor?? [ 210.544492][ T5786] pwc: Askey VC010 type 2 USB webcam detected. [ 210.749273][ T8534] veth0_macvtap: entered promiscuous mode [ 210.802042][ T8534] veth1_macvtap: entered promiscuous mode [ 210.937110][ T8947] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1100'. [ 210.940221][ T5786] pwc: recv_control_msg error -32 req 02 val 2b00 [ 210.943844][ T5786] pwc: recv_control_msg error -32 req 02 val 2700 [ 210.980353][ T5786] pwc: recv_control_msg error -32 req 02 val 2c00 [ 210.980446][ T8534] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 210.986536][ T5786] pwc: recv_control_msg error -32 req 04 val 1000 [ 210.996090][ T5786] pwc: recv_control_msg error -32 req 04 val 1300 [ 211.011793][ T5786] pwc: recv_control_msg error -32 req 04 val 1400 [ 211.015501][ T5786] pwc: recv_control_msg error -32 req 02 val 2000 [ 211.016137][ T5786] pwc: recv_control_msg error -32 req 02 val 2100 [ 211.016666][ T5786] pwc: recv_control_msg error -32 req 04 val 1500 [ 211.017190][ T5786] pwc: recv_control_msg error -32 req 02 val 2500 [ 211.024751][ T5786] pwc: recv_control_msg error -32 req 02 val 2400 [ 211.028839][ T5786] pwc: recv_control_msg error -32 req 02 val 2600 [ 211.029394][ T5786] pwc: recv_control_msg error -71 req 02 val 2900 [ 211.031304][ T5786] pwc: recv_control_msg error -71 req 02 val 2800 [ 211.033262][ T5786] pwc: recv_control_msg error -71 req 04 val 1100 [ 211.034773][ T5786] pwc: recv_control_msg error -71 req 04 val 1200 [ 211.056834][ T5786] pwc: Registered as video103. [ 211.067690][ T5786] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input11 [ 211.069955][ T8534] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 211.103389][ T5786] usb 3-1: USB disconnect, device number 16 [ 211.134471][ T6174] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 211.134512][ T6174] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 211.134543][ T6174] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 211.134572][ T6174] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 211.519668][ T6174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 211.519688][ T6174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 211.670418][ T8969] netlink: 460 bytes leftover after parsing attributes in process `syz.2.1110'. [ 211.676982][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 211.677000][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 211.869802][ T31] audit: type=1400 audit(1789685169.110:707): avc: denied { execute } for pid=8977 comm="syz.4.1114" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=20901 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 211.902520][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 212.058278][ T9] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 212.060460][ T9] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 212.060486][ T9] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 212.060505][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 212.060544][ T9] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 212.060578][ T9] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 212.061886][ T9] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 212.061909][ T9] usb 6-1: Product: syz [ 212.061925][ T9] usb 6-1: Manufacturer: syz [ 212.148632][ T9] cdc_wdm 6-1:1.0: skipping garbage [ 212.148660][ T9] cdc_wdm 6-1:1.0: skipping garbage [ 212.169531][ T9] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 212.169553][ T9] cdc_wdm 6-1:1.0: Unknown control protocol [ 212.216818][ T8995] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1121'. [ 212.234695][ T8996] netlink: 460 bytes leftover after parsing attributes in process `syz.6.1120'. [ 212.816117][ C1] wdm_int_callback: 4 callbacks suppressed [ 212.816150][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.816168][ C1] wdm_int_callback: 4 callbacks suppressed [ 212.816182][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.816375][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.816393][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.816576][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.816593][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.817026][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.817045][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.817228][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.817245][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.817428][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.817445][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.817625][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.817642][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.817823][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.817840][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.818093][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.818110][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.818332][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 212.818350][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 212.819490][ T5786] usb 6-1: USB disconnect, device number 5 [ 212.819598][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 213.550385][ T9030] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 214.059949][ T9056] syzkaller0: entered promiscuous mode [ 214.059973][ T9056] syzkaller0: entered allmulticast mode [ 214.441766][ T9076] tipc: Started in network mode [ 214.441794][ T9076] tipc: Node identity 1675def56275, cluster identity 4711 [ 214.441978][ T9076] tipc: Enabled bearer , priority 0 [ 214.450301][ T9076] syzkaller0: entered promiscuous mode [ 214.450321][ T9076] syzkaller0: entered allmulticast mode [ 214.460942][ T9076] tipc: Resetting bearer [ 214.501248][ T9075] tipc: Resetting bearer [ 214.572679][ T9075] tipc: Disabling bearer [ 214.741674][ T31] audit: type=1326 audit(1789685171.980:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.741724][ T31] audit: type=1326 audit(1789685171.980:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.763194][ T31] audit: type=1326 audit(1789685172.000:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.763241][ T31] audit: type=1326 audit(1789685172.000:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.770109][ T31] audit: type=1326 audit(1789685172.010:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=141 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.770161][ T31] audit: type=1326 audit(1789685172.010:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.770201][ T31] audit: type=1326 audit(1789685172.010:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.777765][ T31] audit: type=1326 audit(1789685172.020:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 214.777808][ T31] audit: type=1326 audit(1789685172.020:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9087 comm="syz.2.1158" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fc348b9e159 code=0x7ffc0000 [ 215.023451][ T5713] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 215.110173][ T31] audit: type=1400 audit(1789685172.350:717): avc: denied { create } for pid=9105 comm="syz.2.1167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 215.174364][ T5713] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 215.176386][ T5713] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 215.176414][ T5713] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 215.176433][ T5713] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 215.176471][ T5713] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 215.176497][ T5713] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 215.177785][ T5713] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 215.177806][ T5713] usb 4-1: Product: syz [ 215.177820][ T5713] usb 4-1: Manufacturer: syz [ 215.197289][ T5713] cdc_wdm 4-1:1.0: skipping garbage [ 215.197307][ T5713] cdc_wdm 4-1:1.0: skipping garbage [ 215.212604][ T5713] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 215.212622][ T5713] cdc_wdm 4-1:1.0: Unknown control protocol [ 216.457142][ T5713] usb 4-1: USB disconnect, device number 14 [ 216.457240][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 216.480198][ T9124] capability: warning: `syz.4.1171' uses deprecated v2 capabilities in a way that may be insecure [ 216.933700][ T52] Bluetooth: hci5: status 0x01 [ 216.934674][ T52] Bluetooth: hci5: unexpected event for opcode 0x0c03 [ 216.934765][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 1 < 9 [ 216.963636][ T5609] Bluetooth: hci5: Opcode 0x1003 failed: -38 [ 216.969327][ T9138] infiniband syz0: set down [ 216.969343][ T9138] infiniband syz0: added bond0 [ 217.005016][ T9138] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 217.005054][ T9138] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 217.005093][ T9138] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 217.021133][ T9138] RDS/IB: syz0: added [ 217.021501][ T9138] smc: adding ib device syz0 with port count 1 [ 217.021574][ T9138] smc: ib device syz0 port 1 has no pnetid [ 217.862785][ T9128] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 218.141775][ T9181] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 218.150517][ T9181] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 218.152730][ T9181] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 218.154413][ T9181] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 218.743322][ T5786] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 218.895820][ T5786] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 218.897208][ T5786] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 218.897235][ T5786] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 218.897254][ T5786] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 218.897312][ T5786] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 218.897337][ T5786] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 218.898879][ T5786] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 218.898902][ T5786] usb 7-1: Product: syz [ 218.898918][ T5786] usb 7-1: Manufacturer: syz [ 218.987599][ T5786] cdc_wdm 7-1:1.0: skipping garbage [ 218.987620][ T5786] cdc_wdm 7-1:1.0: skipping garbage [ 218.989155][ T5786] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 218.989173][ T5786] cdc_wdm 7-1:1.0: Unknown control protocol [ 219.267227][ C1] wdm_int_callback: 9 callbacks suppressed [ 219.267250][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 219.267266][ C1] wdm_int_callback: 9 callbacks suppressed [ 219.267278][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 219.267464][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 219.267481][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 219.267627][ T9] usb 7-1: USB disconnect, device number 2 [ 219.267665][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 219.267682][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 219.267697][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 219.899147][ T31] kauditd_printk_skb: 111 callbacks suppressed [ 219.899165][ T31] audit: type=1400 audit(1789685177.140:829): avc: denied { write } for pid=9236 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.453516][ T31] audit: type=1400 audit(1789685177.560:830): avc: denied { execmem } for pid=9246 comm="syz.3.1215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 220.453563][ T31] audit: type=1400 audit(1789685177.560:831): avc: denied { mmap_zero } for pid=9246 comm="syz.3.1215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 220.453681][ T31] audit: type=1400 audit(1789685177.570:832): avc: denied { map } for pid=9246 comm="syz.3.1215" path="socket:[21375]" dev="sockfs" ino=21375 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 221.478487][ T31] audit: type=1400 audit(1789685178.570:833): avc: denied { ioctl } for pid=9275 comm="syz.5.1223" path="socket:[21406]" dev="sockfs" ino=21406 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 221.478655][ T31] audit: type=1400 audit(1789685178.700:834): avc: denied { prog_run } for pid=9275 comm="syz.5.1223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 221.752825][ T31] audit: type=1400 audit(1789685178.990:835): avc: denied { write } for pid=9251 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.988539][ T31] audit: type=1400 audit(1789685179.230:836): avc: denied { write } for pid=9300 comm="rm" name="hook-state" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 222.047237][ T5720] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 222.132889][ T31] audit: type=1400 audit(1789685179.380:837): avc: denied { mount } for pid=9306 comm="syz.2.1233" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 222.156022][ T31] audit: type=1400 audit(1789685179.380:838): avc: denied { mount } for pid=9306 comm="syz.2.1233" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 222.206712][ T5720] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 222.207651][ T5720] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 222.207675][ T5720] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 222.207695][ T5720] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 222.207733][ T5720] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 222.207778][ T5720] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 222.223873][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 222.223899][ T5720] usb 4-1: Product: syz [ 222.223912][ T5720] usb 4-1: Manufacturer: syz [ 222.267276][ T5720] cdc_wdm 4-1:1.0: skipping garbage [ 222.267294][ T5720] cdc_wdm 4-1:1.0: skipping garbage [ 222.304305][ T5720] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 222.304343][ T5720] cdc_wdm 4-1:1.0: Unknown control protocol [ 222.838055][ T5332] usb 4-1: USB disconnect, device number 15 [ 223.221117][ T9324] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1238'. [ 223.308819][ T9326] smc: net device vlan1 applied user defined pnetid SYZ2 [ 223.310744][ T9326] smc: net device vlan1 erased user defined pnetid SYZ2 [ 223.966511][ T9359] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1246'. [ 224.343051][ T9387] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1259'. [ 224.343070][ T9387] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1259'. [ 224.957933][ T9396] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 225.053130][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 225.053244][ T31] audit: type=1400 audit(1789685182.290:856): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 225.564226][ T9417] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1270'. [ 226.164899][ T31] audit: type=1400 audit(1789685182.800:857): avc: denied { mount } for pid=9409 comm="syz.6.1270" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 226.164953][ T31] audit: type=1400 audit(1789685182.850:858): avc: denied { getopt } for pid=9409 comm="syz.6.1270" laddr=::1 lport=49315 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 227.058041][ T31] audit: type=1400 audit(1789685184.300:859): avc: denied { create } for pid=9425 comm="syz.3.1274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 227.086108][ T31] audit: type=1400 audit(1789685184.330:860): avc: denied { bind } for pid=9425 comm="syz.3.1274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 227.122416][ T9431] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1276'. [ 227.138111][ T31] audit: type=1400 audit(1789685184.380:861): avc: denied { listen } for pid=9425 comm="syz.3.1274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 227.140759][ T31] audit: type=1400 audit(1789685184.380:862): avc: denied { write } for pid=9425 comm="syz.3.1274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 227.440474][ T31] audit: type=1400 audit(1789685184.680:863): avc: denied { create } for pid=9410 comm="syz.2.1269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 227.441063][ T31] audit: type=1400 audit(1789685184.680:864): avc: denied { write } for pid=9410 comm="syz.2.1269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 227.441203][ T31] audit: type=1400 audit(1789685184.680:865): avc: denied { nlmsg_write } for pid=9410 comm="syz.2.1269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 227.721414][ T9445] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1281'. [ 228.879953][ T9463] batman_adv: batadv0: Adding interface: dummy0 [ 228.879970][ T9463] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 228.879988][ T9463] batman_adv: batadv0: Interface activated: dummy0 [ 229.009231][ T9466] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1289'. [ 229.097125][ T9461] batadv0: mtu less than device minimum [ 229.099539][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.100632][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.101709][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.102767][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.103754][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.104622][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.105504][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.106370][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 229.107234][ T9461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 230.306264][ T31] kauditd_printk_skb: 16 callbacks suppressed [ 230.306283][ T31] audit: type=1400 audit(1789685187.550:882): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 230.877263][ T9528] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1316'. [ 230.894260][ T31] audit: type=1400 audit(1789685188.120:883): avc: denied { append } for pid=9527 comm="syz.6.1317" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 230.940641][ T31] audit: type=1400 audit(1789685188.180:884): avc: denied { write } for pid=9527 comm="syz.6.1317" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 231.167245][ T9534] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1320'. [ 231.647950][ T31] audit: type=1400 audit(1789685188.890:885): avc: denied { read } for pid=9539 comm="syz.2.1322" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 231.648255][ T31] audit: type=1400 audit(1789685188.890:886): avc: denied { read open } for pid=9539 comm="syz.2.1322" path="/252/sys" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 231.833208][ T31] audit: type=1326 audit(1789685189.070:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9544 comm="syz.4.1324" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b39e159 code=0x7ffc0000 [ 231.833261][ T31] audit: type=1326 audit(1789685189.070:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9544 comm="syz.4.1324" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b39e159 code=0x7ffc0000 [ 231.836102][ T31] audit: type=1326 audit(1789685189.070:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9544 comm="syz.4.1324" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0e7b35e98e code=0x7ffc0000 [ 231.836185][ T31] audit: type=1326 audit(1789685189.080:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9544 comm="syz.4.1324" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b39e159 code=0x7ffc0000 [ 231.836224][ T31] audit: type=1326 audit(1789685189.080:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9544 comm="syz.4.1324" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b39e159 code=0x7ffc0000 [ 231.882974][ T9547] FAULT_INJECTION: forcing a failure. [ 231.882974][ T9547] name failslab, interval 1, probability 0, space 0, times 0 [ 231.883020][ T9547] CPU: 1 UID: 0 PID: 9547 Comm: syz.5.1325 Not tainted syzkaller #0 PREEMPT(full) [ 231.883043][ T9547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 231.883055][ T9547] Call Trace: [ 231.883063][ T9547] [ 231.883070][ T9547] dump_stack_lvl+0x100/0x190 [ 231.883104][ T9547] should_fail_ex.cold+0x5/0xa [ 231.883129][ T9547] should_failslab+0xc2/0x120 [ 231.883153][ T9547] __kmalloc_cache_noprof+0x91/0x6d0 [ 231.883180][ T9547] ? newque+0xa3/0x680 [ 231.883205][ T9547] newque+0xa3/0x680 [ 231.883228][ T9547] ipcget+0xee/0xf50 [ 231.883250][ T9547] ? __pfx_do_futex+0x10/0x10 [ 231.883277][ T9547] ? __pfx_ipcget+0x10/0x10 [ 231.883298][ T9547] ? __x64_sys_futex+0x34f/0x4d0 [ 231.883320][ T9547] ? __x64_sys_futex+0x358/0x4d0 [ 231.883346][ T9547] __x64_sys_msgget+0x125/0x1a0 [ 231.883370][ T9547] ? __pfx___x64_sys_msgget+0x10/0x10 [ 231.883399][ T9547] do_syscall_64+0x123/0x790 [ 231.883425][ T9547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.883443][ T9547] RIP: 0033:0x7f4100d9e159 [ 231.883458][ T9547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.883474][ T9547] RSP: 002b:00007f4101d3b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000044 [ 231.883492][ T9547] RAX: ffffffffffffffda RBX: 00007f4101025fa0 RCX: 00007f4100d9e159 [ 231.883503][ T9547] RDX: 0000000000000000 RSI: 00000000000001c0 RDI: 0000000000000000 [ 231.883514][ T9547] RBP: 00007f4100e3506b R08: 0000000000000000 R09: 0000000000000000 [ 231.883524][ T9547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.883534][ T9547] R13: 00007f4101026038 R14: 00007f4101025fa0 R15: 00007ffcb29c4eb8 [ 231.883564][ T9547] [ 232.287977][ T9557] FAULT_INJECTION: forcing a failure. [ 232.287977][ T9557] name failslab, interval 1, probability 0, space 0, times 0 [ 232.288011][ T9557] CPU: 1 UID: 0 PID: 9557 Comm: syz.5.1329 Not tainted syzkaller #0 PREEMPT(full) [ 232.288039][ T9557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 232.288052][ T9557] Call Trace: [ 232.288062][ T9557] [ 232.288071][ T9557] dump_stack_lvl+0x100/0x190 [ 232.288108][ T9557] should_fail_ex.cold+0x5/0xa [ 232.288140][ T9557] should_failslab+0xc2/0x120 [ 232.288169][ T9557] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 232.288199][ T9557] ? x509_get_sig_params+0xf5/0x6c0 [ 232.288226][ T9557] kmemdup_noprof+0x29/0x60 [ 232.288260][ T9557] x509_get_sig_params+0xf5/0x6c0 [ 232.288281][ T9557] ? __asan_memcpy+0x3c/0x60 [ 232.288303][ T9557] x509_cert_parse+0x4e9/0x910 [ 232.288326][ T9557] x509_key_preparse+0x65/0x9c0 [ 232.288359][ T9557] asymmetric_key_preparse+0xce/0x1d0 [ 232.288386][ T9557] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 232.288417][ T9557] __key_create_or_update+0x463/0xe30 [ 232.288448][ T9557] ? __pfx___key_create_or_update+0x10/0x10 [ 232.288476][ T9557] ? lookup_user_key+0x3f3/0x1300 [ 232.288511][ T9557] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 232.288539][ T9557] key_create_or_update+0x42/0x60 [ 232.288566][ T9557] __do_sys_add_key+0x2e8/0x460 [ 232.288597][ T9557] ? __pfx___do_sys_add_key+0x10/0x10 [ 232.288635][ T9557] do_syscall_64+0x123/0x790 [ 232.288665][ T9557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.288686][ T9557] RIP: 0033:0x7f4100d9e159 [ 232.288703][ T9557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.288721][ T9557] RSP: 002b:00007f4101d3b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 232.288742][ T9557] RAX: ffffffffffffffda RBX: 00007f4101025fa0 RCX: 00007f4100d9e159 [ 232.288755][ T9557] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 232.288767][ T9557] RBP: 00007f4100e3506b R08: ffffffffffffffff R09: 0000000000000000 [ 232.288780][ T9557] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 232.288792][ T9557] R13: 00007f4101026038 R14: 00007f4101025fa0 R15: 00007ffcb29c4eb8 [ 232.288819][ T9557] [ 233.337544][ T5332] wiimote 0005:057E:0330.0004: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 233.337881][ T5332] wiimote 0005:057E:0330.0004: New device registered [ 233.501612][ T9594] wiimote 0005:057E:0330.0004: Device removed [ 234.731972][ T5332] wiimote 0005:057E:0330.0004: detected device: Nintendo Wii Remote Plus (Gen 2) [ 234.778344][ T5332] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0004/input/input13 [ 234.820556][ T5332] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0004/input/input14 [ 234.848040][ T9603] fido_id[9603]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 234.851165][ T5332] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0004/input/input12 [ 235.302724][ T9620] [ 235.305080][ T9620] ====================================================== [ 235.312086][ T9620] WARNING: possible circular locking dependency detected [ 235.319094][ T9620] syzkaller #0 Not tainted [ 235.323496][ T9620] ------------------------------------------------------ [ 235.330501][ T9620] syz.4.1355/9620 is trying to acquire lock: [ 235.336466][ T9620] ffff88807f2161e8 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x4ca/0xcb0 [ 235.347942][ T9620] [ 235.347942][ T9620] but task is already holding lock: [ 235.355293][ T9620] ffff88807f2172e0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x3a5/0x620 [ 235.364256][ T9620] [ 235.364256][ T9620] which lock already depends on the new lock. [ 235.364256][ T9620] [ 235.374640][ T9620] [ 235.374640][ T9620] the existing dependency chain (in reverse order) is: [ 235.383638][ T9620] [ 235.383638][ T9620] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 235.391359][ T9620] lock_acquire+0x1d1/0x380 [ 235.396376][ T9620] lock_sock_nested+0x41/0xf0 [ 235.401562][ T9620] smc_listen_out+0xf2/0x4b0 [ 235.406664][ T9620] smc_listen_work+0x767/0x50e0 [ 235.412029][ T9620] process_one_work+0xac7/0x1b10 [ 235.417477][ T9620] worker_thread+0x5ef/0xe50 [ 235.422582][ T9620] kthread+0x373/0x450 [ 235.427162][ T9620] ret_from_fork+0x730/0xd60 [ 235.432258][ T9620] ret_from_fork_asm+0x1a/0x30 [ 235.437551][ T9620] [ 235.437551][ T9620] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 235.447696][ T9620] check_prev_add+0xeb/0xe60 [ 235.452788][ T9620] __lock_acquire+0x1528/0x1f40 [ 235.458139][ T9620] lock_acquire+0x1d1/0x380 [ 235.463145][ T9620] __flush_work+0x4de/0xcb0 [ 235.468154][ T9620] cancel_work_sync+0xd1/0xf0 [ 235.473348][ T9620] smc_clcsock_release+0x5f/0xe0 [ 235.478805][ T9620] __smc_release+0x5c2/0x880 [ 235.483906][ T9620] smc_close_non_accepted+0xda/0x200 [ 235.489698][ T9620] smc_close_active+0x4ff/0x1060 [ 235.495146][ T9620] __smc_release+0x634/0x880 [ 235.500246][ T9620] smc_release+0x1fc/0x620 [ 235.505172][ T9620] __sock_release+0xb3/0x260 [ 235.510274][ T9620] sock_close+0x1c/0x30 [ 235.514936][ T9620] __fput+0x3ff/0xb50 [ 235.519422][ T9620] task_work_run+0x150/0x240 [ 235.524518][ T9620] exit_to_user_mode_loop+0x1d8/0x700 [ 235.530413][ T9620] do_syscall_64+0x661/0x790 [ 235.535520][ T9620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.541918][ T9620] [ 235.541918][ T9620] other info that might help us debug this: [ 235.541918][ T9620] [ 235.552125][ T9620] Possible unsafe locking scenario: [ 235.552125][ T9620] [ 235.559561][ T9620] CPU0 CPU1 [ 235.564905][ T9620] ---- ---- [ 235.570248][ T9620] lock(sk_lock-AF_SMC/1); [ 235.574738][ T9620] lock((work_completion)(&new_smc->smc_listen_work)); [ 235.584187][ T9620] lock(sk_lock-AF_SMC/1); [ 235.591195][ T9620] lock((work_completion)(&new_smc->smc_listen_work)); [ 235.598110][ T9620] [ 235.598110][ T9620] *** DEADLOCK *** [ 235.598110][ T9620] [ 235.606234][ T9620] locks held by syz.4.1355/9620: 3, last CPU#0: [ 235.612451][ T9620] #0: ffff888037953040 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 [ 235.622974][ T9620] #1: ffff88807f2172e0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x3a5/0x620 [ 235.632375][ T9620] #2: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xfd/0xcb0 [ 235.641491][ T9620] [ 235.641491][ T9620] stack backtrace: [ 235.647377][ T9620] CPU: 0 UID: 0 PID: 9620 Comm: syz.4.1355 Not tainted syzkaller #0 PREEMPT(full) [ 235.656639][ T9620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 235.666676][ T9620] Call Trace: [ 235.669934][ T9620] [ 235.672850][ T9620] dump_stack_lvl+0x100/0x190 [ 235.677528][ T9620] print_circular_bug.cold+0x178/0x1be [ 235.682984][ T9620] check_noncircular+0x146/0x160 [ 235.687905][ T9620] check_prev_add+0xeb/0xe60 [ 235.692476][ T9620] __lock_acquire+0x1528/0x1f40 [ 235.697316][ T9620] lock_acquire+0x1d1/0x380 [ 235.701802][ T9620] ? __flush_work+0x4ca/0xcb0 [ 235.706460][ T9620] ? preempt_schedule_thunk+0x16/0x40 [ 235.711818][ T9620] ? __flush_work+0x4ca/0xcb0 [ 235.716474][ T9620] __flush_work+0x4de/0xcb0 [ 235.720975][ T9620] ? __flush_work+0x4ca/0xcb0 [ 235.725637][ T9620] ? __pfx___flush_work+0x10/0x10 [ 235.730642][ T9620] ? __lock_acquire+0x5c0/0x1f40 [ 235.735560][ T9620] ? __pfx_wq_barrier_func+0x10/0x10 [ 235.740835][ T9620] ? __pfx___might_resched+0x10/0x10 [ 235.746103][ T9620] ? __smc_release+0x5ba/0x880 [ 235.750869][ T9620] cancel_work_sync+0xd1/0xf0 [ 235.755532][ T9620] smc_clcsock_release+0x5f/0xe0 [ 235.760457][ T9620] __smc_release+0x5c2/0x880 [ 235.765031][ T9620] ? __pfx_sock_def_readable+0x10/0x10 [ 235.770474][ T9620] smc_close_non_accepted+0xda/0x200 [ 235.775744][ T9620] smc_close_active+0x4ff/0x1060 [ 235.780669][ T9620] __smc_release+0x634/0x880 [ 235.785245][ T9620] smc_release+0x1fc/0x620 [ 235.789647][ T9620] __sock_release+0xb3/0x260 [ 235.794222][ T9620] ? __pfx_sock_close+0x10/0x10 [ 235.799062][ T9620] sock_close+0x1c/0x30 [ 235.803206][ T9620] __fput+0x3ff/0xb50 [ 235.807173][ T9620] ? _raw_spin_unlock_irq+0x23/0x50 [ 235.812357][ T9620] task_work_run+0x150/0x240 [ 235.816939][ T9620] ? __pfx_task_work_run+0x10/0x10 [ 235.822040][ T9620] exit_to_user_mode_loop+0x1d8/0x700 [ 235.827398][ T9620] ? rcu_is_watching+0x13/0xc0 [ 235.832151][ T9620] do_syscall_64+0x661/0x790 [ 235.836731][ T9620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.842608][ T9620] RIP: 0033:0x7f0e7b39e159 [ 235.847005][ T9620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 235.866595][ T9620] RSP: 002b:00007ffe30def728 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 235.874996][ T9620] RAX: 0000000000000000 RBX: 00007ffe30def810 RCX: 00007f0e7b39e159 [ 235.882950][ T9620] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 235.890903][ T9620] RBP: 0000000000039694 R08: 0000000000000001 R09: 0000000000000000 [ 235.898863][ T9620] R10: 0000001b31a20000 R11: 0000000000000246 R12: 00007ffe30def850 [ 235.906824][ T9620] R13: 00007f0e7b62609c R14: 0000000000039708 R15: 00007f0e7b626090 [ 235.914795][ T9620]