last executing test programs: 1m56.60518976s ago: executing program 1 (id=16): r0 = syz_usb_connect$uac2(0x3, 0xa8, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0xf, 0xe, 0x7, 0x1}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) sysinfo(&(0x7f0000000140)=""/35) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000000)={0x0, 0x16, 0x1, "9f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m54.048312918s ago: executing program 1 (id=38): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_clone3(&(0x7f0000000080)={0x180801400, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0}, 0x58) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) 1m53.123329548s ago: executing program 1 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x158) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) chdir(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x171) rmdir(&(0x7f0000000100)='./control\x00') 1m52.818044101s ago: executing program 1 (id=51): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="2e1221b20ab601c477d3df163e75963d86dd606712e9000d2fa1c1049d90491c3248040000dbb8a10000", 0x2a}, {&(0x7f00000001c0)='$\x00\x00\x00\x00\x00', 0x6}, {&(0x7f0000000240)="a43b2eaab40000", 0x7}, {&(0x7f0000000080)="c6d34f", 0x3}], 0x4) 1m52.513328912s ago: executing program 1 (id=55): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) 1m52.081477317s ago: executing program 1 (id=56): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r3, 0x0, r2}, 0x10) 1m36.8854743s ago: executing program 32 (id=56): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r3, 0x0, r2}, 0x10) 1m30.94663806s ago: executing program 3 (id=185): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x7, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) syz_emit_ethernet(0x4a, &(0x7f0000000880)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "05e000", 0x14, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x4}}}}}}}, 0x0) 1m30.78184149s ago: executing program 3 (id=187): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) gettid() mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)={0x8}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000004c0)) 1m29.69902799s ago: executing program 3 (id=198): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r0, 0xfffff789) r1 = accept(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0x0, 0x2a, 0x4, 0xe0}, 0x9c) 1m28.671289326s ago: executing program 3 (id=211): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1m28.520904059s ago: executing program 3 (id=213): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000140)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000080)=0x126) pwritev(r0, &(0x7f0000000680)=[{&(0x7f0000000040)="00214500002c00000000400600000a0000010a00000200500050000000010000000160100385bc40df0001010101", 0x2e}], 0x1, 0x6, 0x0) pwritev(r0, &(0x7f00000002c0)=[{&(0x7f00000007c0)="0021452e001400000000400600000a0000010a2e0002005000500000ffff00000001683003e80000e40201010101", 0x2e}], 0x1, 0x3, 0x0) 1m27.80043386s ago: executing program 3 (id=219): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) r0 = inotify_init() read(r0, 0x0, 0x0) 1m27.66999098s ago: executing program 33 (id=219): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) r0 = inotify_init() read(r0, 0x0, 0x0) 28.316609285s ago: executing program 6 (id=900): unshare(0x2c020400) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804) r0 = io_uring_setup(0x1cf8, &(0x7f0000000040)={0x0, 0xe83e, 0xc000, 0x2000008, 0x4c1}) pselect6(0x40, &(0x7f0000000380)={0x101, 0xfffffffffffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x400000000001}, &(0x7f0000000000)={0x8000021000000021, 0x0, 0x0, 0x3, 0x0, 0x401, 0xfffffffffffffffe, 0x3}, 0x0, 0x0, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 27.098978615s ago: executing program 6 (id=908): socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xffffffffffffff4e}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_PSAMPLE_GROUP={0x0, 0x5, 0x4}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x1, 0x0, 0xe, 0x0, 0x80000}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4008085}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 26.584660612s ago: executing program 6 (id=914): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a8c"], 0xb4}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) 26.307803348s ago: executing program 6 (id=917): socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0', 0x1) syz_clone(0x100, &(0x7f0000000180)="a1c429c672ca627004ec8bd9928deee0b797984ae477a6222025ecae82ddf61d5432f3b75157c0e18e164d6543b7c7d15c50fad4d09fbde4f0e09a79f595a5d7c595681ae375d2db93cbff363809978878e6ba1df87642092ba8afe2545c65a60bedb2fd6aed1705dae30a172f5f9a4959e19b51802dc97d3712e7a279d44628de8f84943af5e0791f649ab85db23e3a2a32faf4a85e6e80b48c95fa716892d58882e6f28520be62b3b7ba9bb594d3366c72a57fd718e16d2fe8a6979216a16b2a57787812a937e2a2d42389897575e8d98bab69ffae9148ec889e1ff0452e5f8fefa7cc1d0072eecd9c156a93", 0xed, &(0x7f0000000280), 0x0, &(0x7f0000000300)="1b2ed6578064b580c6eab52979416f0ff3a6e97108c6f1c952a2c01daff0e098b87905e57274eb9a8f6512e325ae072b8379b489c68c277b31aaed82e9dc2a56f0798a74556904ecc90c1af472a04c429f1b765e4c8e8a880407b6afa49dd2f084323fb56df60f7282a3d2ba806c6459859d7f46071999abbc01747cea2d0785d2918d708e701d276c7fadb8a3d4d2df8a216d6ec1dfa5a70d8cf5d67d01bb547992d221f5b41c41") 25.702333833s ago: executing program 6 (id=924): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x40040) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000efdbdf252e00000008000300", @ANYRES32=r1, @ANYBLOB="0a00340001010101010100002400fe"], 0x58}, 0x1, 0x0, 0x0, 0x2000894}, 0x884) 24.38435773s ago: executing program 6 (id=938): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmallocinfo\x00', 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) read$char_usb(r0, &(0x7f00000000c0)=""/104, 0x12) sendfile(r1, r0, 0x0, 0xffdf) 23.837858432s ago: executing program 34 (id=938): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmallocinfo\x00', 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) read$char_usb(r0, &(0x7f00000000c0)=""/104, 0x12) sendfile(r1, r0, 0x0, 0xffdf) 13.209279064s ago: executing program 2 (id=1009): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x0, 0x1, r2}, 0xc) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) 13.123811578s ago: executing program 2 (id=1010): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000002000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 12.970550176s ago: executing program 2 (id=1014): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) 6.209966596s ago: executing program 5 (id=1068): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xb, 0x6}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44000}, 0x20000000) 5.368463124s ago: executing program 5 (id=1072): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0xff, 0x2, 0x9}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0xffffffff000) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/146, 0x92}], 0x1}, 0x9}], 0x1, 0x2, 0x0) 4.287840849s ago: executing program 0 (id=1082): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040)=0x5, 0x4) listen(r1, 0x5) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) 3.920004061s ago: executing program 5 (id=1085): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201000005d0d3087d07aa04d85b0102030109021b000f000000000904000001dbcc7a000905", @ANYRES32], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000440)={@link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x58, 0x80, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0xf, 0x0, 0x0, 0xf, 0x3cc, {0xf, 0x4, 0x0, 0x1f, 0x900, 0x66, 0x0, 0x2, 0x32, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, {[@cipso={0x86, 0x15, 0x2, [{0x1, 0x9, "f7fc442317a61e"}, {0x1, 0x6, "02b13799"}]}, @timestamp={0x44, 0x10, 0x52, 0x0, 0x1, [0x8, 0xd, 0x1]}]}}}}}}}, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x2) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) 3.897826647s ago: executing program 4 (id=1086): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) 3.891985659s ago: executing program 0 (id=1087): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x100, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='-', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3.73668686s ago: executing program 7 (id=1088): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x13, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0xf4, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x0, 0x20, 0x40}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x6, 0x9, 0x13}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x5, 0x9, {0x8, 0x25, 0x1, 0x3, 0xf, 0xc, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0xff, 0x4c, {0x8, 0x25, 0x1, 0x81, 0xf, 0x40, 0x5}}}}}}}}]}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}, @IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0xffff}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x48}}, 0x40) 3.660365924s ago: executing program 2 (id=1089): r0 = socket$kcm(0x2b, 0x1, 0x0) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x10, 0x3, 0x200003ca}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x2, 0x4001, @remote}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) shutdown(r0, 0x1) 3.51265345s ago: executing program 4 (id=1090): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r2}, &(0x7f0000000840), &(0x7f0000000880)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r3, r1, 0x25, 0x2, @val=@netfilter={0x2, 0x3, 0x102018}}, 0x20) syz_emit_ethernet(0x3a, &(0x7f0000000740)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x3, 0x0, 0x0, 0x5, 0x0, @dev, @private=0xa010100, {[@timestamp_addr={0x44, 0x4, 0x5, 0x3}]}}, {{0x1, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) 3.214567203s ago: executing program 4 (id=1091): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x18, 0x0, &(0x7f00000000c0)) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000080)={0xc, 0x34, 0xfff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xa) 3.08073687s ago: executing program 0 (id=1092): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000080)={@void, @val={0x6, 0x0, 0x6488, 0x8, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x2, 0x2, 0x18, 0x66, 0x0, 0xb, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3d}, @broadcast, {[@timestamp_addr={0x44, 0x4, 0xc}]}}}}, 0x22) 2.998333959s ago: executing program 4 (id=1093): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000007000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001200)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f07df33c9f7b986", 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 2.42958741s ago: executing program 2 (id=1094): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=@newtfilter={0x98, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x57f}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x4e3, 0xca0b, 0x6, 0x3}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x4, 0x7}}]}, 0x98}, 0x1, 0x0, 0x0, 0x40800}, 0x44000) 2.236811288s ago: executing program 4 (id=1095): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) msgsnd(0x0, 0x0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001400add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 1.944097287s ago: executing program 0 (id=1096): syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa080045000028006400000402907800000000e000000211009078e0000002000000020000000400000000d470028c0f4296e4430e4150"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x119f, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000280)=ANY=[], 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x20, 0x10012, r0, 0x0) 1.933946885s ago: executing program 4 (id=1097): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7fffffff}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000540)="04", 0x1, 0x2404c081, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) syz_usb_connect(0x0, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b010203010902"], 0x0) shutdown(r0, 0x1) 1.755161027s ago: executing program 2 (id=1098): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001300)=ANY=[@ANYBLOB="12010000000000205804115000000000000109022400010000000009040000050300000009210000000122940309058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, 0x0) 1.734239466s ago: executing program 7 (id=1099): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={r0, 0x7, 0x104, 0xfffffffe}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.591144808s ago: executing program 0 (id=1100): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0xa, 0x4c, 0x5, 0x9, 0x6, 0xffffffffffffff09, 0x1041, 0x4, 0x0, 0x400033a, 0xd, 0x2000000100000004, 0x49, 0x8, 0x800005, 0x67], 0xd005, 0x200440}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.575102424s ago: executing program 5 (id=1101): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="380100001000330624c47000000000007f00000100000000000000000000000000000000000000000000000000000000000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, &(0x7f0000000140)="0e0412b60f0c0df0f2747782bb71", 0xe) 1.304500572s ago: executing program 7 (id=1102): close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xa, 0x4, 0x6, 0xb}, 0x50) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000ff80850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000ff908500000071"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) 1.06482261s ago: executing program 5 (id=1103): r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000240)={{{@in6, @in6=@mcast1}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000340)=0xc5) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@remote, @in6=@private2}}, {{@in=@empty}, 0x0, @in6=@loopback}}, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r0, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 995.28421ms ago: executing program 0 (id=1104): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 993.886964ms ago: executing program 7 (id=1105): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x5, @mcast2, 0x17fff}}}, 0x32) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, 0x0, 0x1, 0x0, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000ffffff06000000140008"], 0x34}}, 0x0) 805.308418ms ago: executing program 7 (id=1106): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) r2 = openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'a', ' *:* ', 'm\x00'}, 0x8) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) 596.694184ms ago: executing program 7 (id=1107): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001000010825bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="804001000000010008001b000000000008000d"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) close(0x3) 0s ago: executing program 5 (id=1108): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myproc/interrupts\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000043c0)={0x2020}, 0x2020) read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2048) kernel console output (not intermixed with test programs): 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 100.206102][ T5715] usb 5-1: config 0 interface 0 has no altsetting 0 [ 100.206129][ T5715] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.211158][ T5715] usb 5-1: config 0 descriptor?? [ 100.283624][ T5748] spcp8x5 3-1:1.0: SPCP8x5 converter detected [ 100.308871][ T5748] usb 3-1: SPCP8x5 converter now attached to ttyUSB0 [ 100.347034][ T59] hsr_slave_0: left promiscuous mode [ 100.348759][ T59] hsr_slave_1: left promiscuous mode [ 100.349500][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 100.349529][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 100.350413][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 100.350430][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 100.399555][ T59] veth1_macvtap: left promiscuous mode [ 100.400055][ T59] veth0_macvtap: left promiscuous mode [ 100.400157][ T59] veth1_vlan: left promiscuous mode [ 100.400246][ T59] veth0_vlan: left promiscuous mode [ 100.404607][ T5723] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 100.553892][ T5723] usb 4-1: Using ep0 maxpacket: 16 [ 100.554527][ T5723] usb 4-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 100.555454][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 100.555484][ T5723] usb 4-1: config 0 interface 0 has no altsetting 0 [ 100.557277][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.557299][ T5723] usb 4-1: Product: syz [ 100.557314][ T5723] usb 4-1: Manufacturer: syz [ 100.557327][ T5723] usb 4-1: SerialNumber: syz [ 100.571333][ T5723] usb 4-1: config 0 descriptor?? [ 100.632765][ T6252] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 100.633309][ T6252] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 100.635328][ T6252] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 100.673575][ T5715] input: HID 04f3:074d as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:04F3:074D.0003/input/input8 [ 100.729867][ T6252] SPCP8x5 ttyUSB0: Set UART format 0x1 failed (error = -32) [ 100.748005][ T5715] elan 0003:04F3:074D.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 04f3:074d] on usb-dummy_hcd.4-1/input0 [ 100.863480][ C0] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 100.895940][ T5723] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input9 [ 100.961813][ T5723] imon:send_packet: packet tx failed (-71) [ 100.986828][ T5723] imon 4-1:0.0: panel buttons/knobs setup failed [ 101.025708][ T59] team0 (unregistering): Port device team_slave_1 removed [ 101.070746][ T59] team0 (unregistering): Port device team_slave_0 removed [ 101.098888][ T5723] rc_core: IR keymap rc-imon-pad not found [ 101.098906][ T5723] Registered IR keymap rc-empty [ 101.099052][ T5723] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 101.099070][ T5723] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 101.100043][ T5723] imon:send_packet: packet tx failed (-71) [ 101.140051][ T5723] imon 4-1:0.0: remote input dev register failed [ 101.140191][ T5723] imon 4-1:0.0: imon_init_intf0: rc device setup failed [ 101.222819][ T5723] imon 4-1:0.0: unable to initialize intf0, err 0 [ 101.222833][ T5723] imon:imon_probe: failed to initialize context! [ 101.222840][ T5723] imon 4-1:0.0: unable to register, err -19 [ 101.238714][ T5723] usb 4-1: USB disconnect, device number 6 [ 101.323548][ T5268] 8021q: adding VLAN 0 to HW filter on device eth2 [ 101.361284][ T9] usb 1-1: USB disconnect, device number 6 [ 101.378621][ T9] em28xx 1-1:0.0: Disconnecting em28xx [ 101.401935][ T9] em28xx: Freeing device [ 101.492072][ T5715] usb 5-1: USB disconnect, device number 6 [ 101.554259][ T5723] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 101.626099][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 101.626115][ T30] audit: type=1400 audit(1790288421.423:368): avc: denied { mounton } for pid=6292 comm="syz.0.173" path="/proc/99/cgroup" dev="proc" ino=11343 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 101.706081][ T5723] usb 4-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 101.709374][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 101.709404][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 101.709431][ T5723] usb 4-1: config 0 interface 0 has no altsetting 0 [ 101.715703][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.715725][ T5723] usb 4-1: Product: syz [ 101.715740][ T5723] usb 4-1: Manufacturer: syz [ 101.715754][ T5723] usb 4-1: SerialNumber: syz [ 101.722358][ T5723] usb 4-1: config 0 descriptor?? [ 101.724647][ T6216] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 101.725391][ T6269] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 101.763162][ T6216] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.770681][ T6216] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 101.788882][ T6216] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.798073][ T6216] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 101.829480][ T6216] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.830306][ T6216] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 101.833816][ T6216] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.868989][ T30] audit: type=1400 audit(1790288421.663:369): avc: denied { create } for pid=6296 comm="syz.0.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.871833][ T30] audit: type=1400 audit(1790288421.663:370): avc: denied { write } for pid=6296 comm="syz.0.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.871877][ T30] audit: type=1400 audit(1790288421.663:371): avc: denied { nlmsg_write } for pid=6296 comm="syz.0.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.872485][ T6298] unsupported nlmsg_type 40 [ 101.999601][ C0] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 102.021501][ T5723] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input11 [ 102.064007][ T5616] Bluetooth: hci5: command tx timeout [ 102.110282][ T6216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.169179][ T6216] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.202163][ T6175] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.202259][ T6175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.221806][ T3943] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.221894][ T3943] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.247856][ T30] audit: type=1400 audit(1790288422.043:372): avc: denied { name_bind } for pid=6311 comm="syz.4.176" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 102.350765][ T30] audit: type=1400 audit(1790288422.143:373): avc: denied { write } for pid=6291 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.384065][ T5723] rc_core: IR keymap rc-imon-pad not found [ 102.384088][ T5723] Registered IR keymap rc-empty [ 102.384141][ T5723] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 102.384169][ T5723] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 102.442806][ T5723] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 102.452885][ T5723] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input12 [ 102.466328][ T5723] imon 4-1:0.0: iMON device (15c2:0045, intf0) on usb<4:7> initialized [ 102.689244][ T30] audit: type=1400 audit(1790288422.483:374): avc: denied { write } for pid=6324 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.730304][ T6321] gadgetfs: bound to dummy_udc driver [ 102.743753][ T48] usb 4-1: USB disconnect, device number 7 [ 102.760753][ T5723] usb 3-1: USB disconnect, device number 4 [ 102.912225][ T5268] 8021q: adding VLAN 0 to HW filter on device eth3 [ 102.922819][ T5723] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 102.923389][ T5723] spcp8x5 3-1:1.0: device disconnected [ 102.964493][ T5715] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 102.965369][ C1] gadgetfs: connected [ 102.968618][ T5715] gadgetfs: disconnected [ 103.083698][ T30] audit: type=1400 audit(1790288422.873:375): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 103.135787][ T6333] ip6tnl1: entered allmulticast mode [ 103.192654][ T30] audit: type=1400 audit(1790288422.983:376): avc: denied { node_bind } for pid=6337 comm="syz.4.182" saddr=127.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 103.222639][ T30] audit: type=1400 audit(1790288423.013:377): avc: denied { read } for pid=6337 comm="syz.4.182" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 103.223791][ T6339] netlink: 4 bytes leftover after parsing attributes in process `syz.0.181'. [ 103.243522][ T6339] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.243541][ T6339] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.260786][ T6339] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.260803][ T6339] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.667377][ T6216] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.145531][ T5616] Bluetooth: hci5: command tx timeout [ 104.225608][ T6216] veth0_vlan: entered promiscuous mode [ 104.250486][ T6216] veth1_vlan: entered promiscuous mode [ 104.306624][ T6216] veth0_macvtap: entered promiscuous mode [ 104.327070][ T6216] veth1_macvtap: entered promiscuous mode [ 104.380827][ T6216] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.408385][ T6216] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.474766][ T4020] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.475108][ T4020] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.475141][ T4020] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.475171][ T4020] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.716467][ T5268] 8021q: adding VLAN 0 to HW filter on device eth4 [ 104.740196][ T421] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.740214][ T421] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.766660][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 104.877332][ T421] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.877351][ T421] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.938252][ T9] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 104.940153][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 104.940178][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 104.943656][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.943678][ T9] usb 3-1: Product: syz [ 104.943692][ T9] usb 3-1: Manufacturer: syz [ 104.943726][ T9] usb 3-1: SerialNumber: syz [ 105.759563][ T6444] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 106.036919][ T4020] greybus 1-svc: unexpected request 0x7d received (state 0) [ 106.225656][ T5616] Bluetooth: hci5: command tx timeout [ 106.368795][ T9] usb 3-1: USB disconnect, device number 5 [ 106.371531][ C0] usb 3-1: failed to resubmit arpc in-urb: -19 [ 106.371574][ C0] usb 3-1: failed to resubmit arpc in-urb: -19 [ 106.374291][ T9] usb 3-1: failed to send ARPC request 4: -19 [ 106.374357][ T9] usb 3-1: failed to execute ARPC: -19 [ 106.374372][ T9] usb 3-1: failed to flush cport 0: -19 [ 106.374397][ T9] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 106.374517][ T9] usb 3-1: failed to send ARPC request 2: -19 [ 106.374575][ T9] usb 3-1: failed to execute ARPC: -19 [ 106.374589][ T9] usb 3-1: failed to quiesce cport 0: -19 (0) [ 106.374607][ T9] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 106.374725][ T9] usb 3-1: failed to send ARPC request 3: -19 [ 106.374789][ T9] usb 3-1: failed to execute ARPC: -19 [ 106.374804][ T9] usb 3-1: failed to clear cport 0: -19 [ 106.374819][ T9] greybus greybus1: 0/0:0: failed to clear host cport: -19 [ 106.876486][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 106.880156][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 106.880667][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 106.881411][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 106.883604][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 107.077502][ T5715] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 107.184456][ T5748] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 107.216438][ T59] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.256364][ T5715] usb 1-1: Using ep0 maxpacket: 8 [ 107.256865][ T5715] usb 1-1: New USB device found, idVendor=0810, idProduct=0001, bcdDevice= 0.00 [ 107.257768][ T5715] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.257797][ T5715] usb 1-1: config 0 interface 0 has no altsetting 0 [ 107.257826][ T5715] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.261945][ T5715] usb 1-1: config 0 descriptor?? [ 107.335124][ T5748] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 107.338167][ T5748] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.364954][ T5748] usb 3-1: config 0 descriptor?? [ 107.427077][ T59] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.437252][ T30] kauditd_printk_skb: 230 callbacks suppressed [ 107.437265][ T30] audit: type=1400 audit(1790288427.233:608): avc: denied { shutdown } for pid=6491 comm="syz.5.225" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 107.507045][ T6476] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.507413][ T6476] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 107.556315][ T5715] usbhid 1-1:0.0: can't add hid device: -71 [ 107.556400][ T5715] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 107.585122][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 107.611858][ T5715] usb 1-1: USB disconnect, device number 8 [ 107.620578][ T5748] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 107.633355][ T59] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.705215][ T59] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.793331][ T6499] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 107.871979][ T5748] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 107.872004][ T5748] [drm] Initialized udl on minor 1 [ 107.958598][ T30] audit: type=1400 audit(1790288427.753:609): avc: denied { name_connect } for pid=6503 comm="syz.4.229" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 107.993342][ T30] audit: type=1400 audit(1790288427.783:610): avc: denied { getopt } for pid=6503 comm="syz.4.229" lport=55982 faddr=fc01:: scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 108.049997][ T30] audit: type=1400 audit(1790288427.843:611): avc: denied { read } for pid=6479 comm="syz.2.222" name="card1" dev="devtmpfs" ino=2914 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.050044][ T30] audit: type=1400 audit(1790288427.843:612): avc: denied { open } for pid=6479 comm="syz.2.222" path="/dev/dri/card1" dev="devtmpfs" ino=2914 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.109449][ T5748] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 108.124815][ T5748] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 108.131193][ T5748] usb 3-1: USB disconnect, device number 6 [ 108.230360][ T30] audit: type=1400 audit(1790288428.023:613): avc: denied { cmd } for pid=6510 comm="iou-wrk-6511" path="socket:[11808]" dev="sockfs" ino=11808 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 108.236221][ T6509] netlink: 8 bytes leftover after parsing attributes in process `syz.5.231'. [ 108.236238][ T6509] netlink: 4 bytes leftover after parsing attributes in process `syz.5.231'. [ 108.340975][ T59] bridge_slave_1: left allmulticast mode [ 108.340999][ T59] bridge_slave_1: left promiscuous mode [ 108.341188][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.350545][ T30] audit: type=1400 audit(1790288428.143:614): avc: denied { ioctl } for pid=6479 comm="syz.2.222" path=2F6465762F6472692F6361726431202864656C6574656429 dev="devtmpfs" ino=2914 ioctlcmd=0x64ce scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.393080][ T59] bridge_slave_0: left allmulticast mode [ 108.393101][ T59] bridge_slave_0: left promiscuous mode [ 108.393295][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.466027][ T5723] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 108.640083][ T5723] usb 5-1: Using ep0 maxpacket: 8 [ 108.641027][ T5723] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 108.641926][ T5723] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 108.646041][ T5723] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.646063][ T5723] usb 5-1: Product: syz [ 108.646077][ T5723] usb 5-1: Manufacturer: syz [ 108.646092][ T5723] usb 5-1: SerialNumber: syz [ 108.652697][ T5723] usb 5-1: config 0 descriptor?? [ 108.671103][ T5723] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 108.829992][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 108.904652][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 108.912140][ T59] bond0 (unregistering): Released all slaves [ 108.944465][ T52] Bluetooth: hci2: command tx timeout [ 108.961392][ T30] audit: type=1400 audit(1790288428.753:615): avc: denied { write } for pid=6518 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.185484][ T30] audit: type=1400 audit(1790288428.983:616): avc: denied { write } for pid=6541 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.235706][ T30] audit: type=1400 audit(1790288429.033:617): avc: denied { map } for pid=6543 comm="syz.0.237" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 109.375022][ T6548] loop3: detected capacity change from 0 to 7 [ 109.393773][ T6548] Dev loop3: unable to read RDB block 7 [ 109.393821][ T6548] loop3: unable to read partition table [ 109.395688][ T6548] loop3: partition table beyond EOD, truncated [ 109.395713][ T6548] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 109.471749][ T5268] 8021q: adding VLAN 0 to HW filter on device eth5 [ 109.534380][ T5723] gspca_zc3xx: reg_w_i err -71 [ 109.576370][ T6556] FAULT_INJECTION: forcing a failure. [ 109.576370][ T6556] name failslab, interval 1, probability 0, space 0, times 0 [ 109.576399][ T6556] CPU: 1 UID: 0 PID: 6556 Comm: syz.0.241 Not tainted syzkaller #0 PREEMPT(full) [ 109.576421][ T6556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 109.576432][ T6556] Call Trace: [ 109.576438][ T6556] [ 109.576445][ T6556] dump_stack_lvl+0x100/0x190 [ 109.576477][ T6556] should_fail_ex.cold+0x5/0xa [ 109.576504][ T6556] should_failslab+0xc2/0x120 [ 109.576528][ T6556] kmem_cache_alloc_noprof+0x92/0x6a0 [ 109.576557][ T6556] ? __pfx_map_id_range_down+0x10/0x10 [ 109.576579][ T6556] ? security_inode_alloc+0x3b/0x2c0 [ 109.576604][ T6556] security_inode_alloc+0x3b/0x2c0 [ 109.576625][ T6556] inode_init_always_gfp+0xc6f/0xfb0 [ 109.576653][ T6556] alloc_inode+0x8e/0x250 [ 109.576671][ T6556] new_inode+0x22/0x1c0 [ 109.576691][ T6556] binderfs_fill_super+0x76d/0x13d0 [ 109.576730][ T6556] ? __pfx_binderfs_fill_super+0x10/0x10 [ 109.576761][ T6556] ? __init_swait_queue_head+0xca/0x150 [ 109.576810][ T6556] ? rcu_is_watching+0x13/0xc0 [ 109.576836][ T6556] ? cap_capable+0x107/0x430 [ 109.576869][ T6556] ? __pfx_binderfs_fill_super+0x10/0x10 [ 109.576895][ T6556] get_tree_nodev+0xdd/0x190 [ 109.576916][ T6556] vfs_get_tree+0x92/0x320 [ 109.576943][ T6556] path_mount+0x7d0/0x24c0 [ 109.576974][ T6556] ? __pfx_path_mount+0x10/0x10 [ 109.576999][ T6556] ? lockdep_hardirqs_on+0x7d/0x110 [ 109.577030][ T6556] ? putname+0xb1/0x110 [ 109.577053][ T6556] ? kmem_cache_free+0x127/0x6c0 [ 109.577090][ T6556] ? __x64_sys_mount+0x293/0x310 [ 109.577118][ T6556] __x64_sys_mount+0x293/0x310 [ 109.577145][ T6556] ? __pfx___x64_sys_mount+0x10/0x10 [ 109.577178][ T6556] do_syscall_64+0x123/0x790 [ 109.577205][ T6556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.577230][ T6556] RIP: 0033:0x7eff3539e159 [ 109.577251][ T6556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.577275][ T6556] RSP: 002b:00007eff362ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 109.577299][ T6556] RAX: ffffffffffffffda RBX: 00007eff35625fa0 RCX: 00007eff3539e159 [ 109.577316][ T6556] RDX: 0000200000000040 RSI: 0000200000000080 RDI: 0000000000000000 [ 109.577333][ T6556] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 109.577349][ T6556] R10: 0000000002200892 R11: 0000000000000246 R12: 0000000000000000 [ 109.577363][ T6556] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 109.577398][ T6556] [ 109.855124][ T59] hsr_slave_0: left promiscuous mode [ 109.860153][ T59] hsr_slave_1: left promiscuous mode [ 109.860876][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 109.860893][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 109.867268][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.867284][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 109.929816][ T59] veth1_macvtap: left promiscuous mode [ 109.929849][ T59] veth0_macvtap: left promiscuous mode [ 109.929934][ T59] veth1_vlan: left promiscuous mode [ 109.929990][ T59] veth0_vlan: left promiscuous mode [ 110.134563][ T5723] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 110.138012][ T5723] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 110.142992][ T5723] usb 5-1: USB disconnect, device number 7 [ 110.399778][ T6588] FAULT_INJECTION: forcing a failure. [ 110.399778][ T6588] name failslab, interval 1, probability 0, space 0, times 0 [ 110.399902][ T6588] CPU: 1 UID: 0 PID: 6588 Comm: syz.2.249 Not tainted syzkaller #0 PREEMPT(full) [ 110.399928][ T6588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 110.399940][ T6588] Call Trace: [ 110.399947][ T6588] [ 110.399955][ T6588] dump_stack_lvl+0x100/0x190 [ 110.399988][ T6588] should_fail_ex.cold+0x5/0xa [ 110.400025][ T6588] should_failslab+0xc2/0x120 [ 110.400051][ T6588] kmem_cache_alloc_noprof+0x92/0x6a0 [ 110.400075][ T6588] ? posix_lock_inode+0x5b5/0x2760 [ 110.400109][ T6588] posix_lock_inode+0x5b5/0x2760 [ 110.400142][ T6588] ? __file_has_perm+0x32e/0x4a0 [ 110.400167][ T6588] ? __pfx_posix_lock_inode+0x10/0x10 [ 110.400200][ T6588] ? lockdep_init_map_type+0x5c/0x250 [ 110.400224][ T6588] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 110.400255][ T6588] vfs_lock_file+0xfb/0x150 [ 110.400286][ T6588] fcntl_setlk+0x757/0xe20 [ 110.400307][ T6588] ? __pfx_fcntl_setlk+0x10/0x10 [ 110.400323][ T6588] ? lock_acquire+0x1d1/0x380 [ 110.400341][ T6588] ? __might_fault+0xc5/0x140 [ 110.400372][ T6588] ? __might_fault+0xc5/0x140 [ 110.400398][ T6588] ? __might_fault+0xc5/0x140 [ 110.400437][ T6588] do_fcntl+0xf39/0x1670 [ 110.400469][ T6588] ? __pfx_do_fcntl+0x10/0x10 [ 110.400506][ T6588] ? selinux_file_fcntl+0xea/0x170 [ 110.400533][ T6588] __x64_sys_fcntl+0x163/0x200 [ 110.400566][ T6588] do_syscall_64+0x123/0x790 [ 110.400600][ T6588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.400622][ T6588] RIP: 0033:0x7f49e1d9e159 [ 110.400640][ T6588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.400659][ T6588] RSP: 002b:00007f49dfff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 110.400678][ T6588] RAX: ffffffffffffffda RBX: 00007f49e2025fa0 RCX: 00007f49e1d9e159 [ 110.400690][ T6588] RDX: 0000200000000200 RSI: 0000000000000025 RDI: 0000000000000003 [ 110.400701][ T6588] RBP: 00007f49e1e3506b R08: 0000000000000000 R09: 0000000000000000 [ 110.400712][ T6588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.400722][ T6588] R13: 00007f49e2026038 R14: 00007f49e2025fa0 R15: 00007ffd87f65eb8 [ 110.400748][ T6588] [ 110.790602][ T59] team0 (unregistering): Port device team_slave_1 removed [ 110.829080][ T59] team0 (unregistering): Port device team_slave_0 removed [ 111.024047][ T52] Bluetooth: hci2: command tx timeout [ 111.118187][ T5268] 8021q: adding VLAN 0 to HW filter on device eth6 [ 111.255736][ T6610] SELinux: failed to load policy [ 111.303639][ T6477] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.305699][ T6477] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.305816][ T6477] bridge_slave_0: entered allmulticast mode [ 111.307265][ T6477] bridge_slave_0: entered promiscuous mode [ 111.347673][ T6477] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.347762][ T6477] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.347864][ T6477] bridge_slave_1: entered allmulticast mode [ 111.359355][ T6477] bridge_slave_1: entered promiscuous mode [ 111.464156][ T6614] printk: console [ttyS0] disabled syzkaller syzkaller login: [ 151.130561][ T7937] printk: console [ttyS0] enabled [ 151.188509][ T7944] vlan0: entered allmulticast mode [ 151.188529][ T7944] veth0_vlan: entered allmulticast mode [ 151.321485][ T7951] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 151.965347][ T7980] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 152.095468][ T7987] 9pnet: p9_errstr2errno: server reported unknown error ÿÿÿ [ 152.125791][ T5790] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 152.144424][ T7992] netlink: 'syz.4.730': attribute type 18 has an invalid length. [ 152.144443][ T7992] netlink: 4 bytes leftover after parsing attributes in process `syz.4.730'. [ 152.247509][ T7992] netlink: 'syz.4.730': attribute type 18 has an invalid length. [ 152.247530][ T7992] netlink: 4 bytes leftover after parsing attributes in process `syz.4.730'. [ 152.254062][ T7744] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.256951][ T421] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.256986][ T421] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.273978][ T7744] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.285195][ T5790] usb 7-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 152.286108][ T5790] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 152.286138][ T5790] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 152.286163][ T5790] usb 7-1: config 0 interface 0 has no altsetting 0 [ 152.286191][ T5790] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.291889][ T5790] usb 7-1: config 0 descriptor?? [ 152.622850][ T7747] tipc: Subscription rejected, illegal request [ 152.923434][ T5790] sony 0003:054C:0268.0007: failed to retrieve feature report 0xf2 with the Sixaxis MAC address [ 152.931062][ T5790] sony 0003:054C:0268.0007: hiddev0,hidraw0: USB HID v80.00 Joystick [HID 054c:0268] on usb-dummy_hcd.6-1/input0 [ 152.931097][ T5790] sony 0003:054C:0268.0007: failed to claim input [ 152.939301][ T5790] usb 7-1: USB disconnect, device number 5 [ 153.004453][ T5715] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 153.034796][ T8029] fido_id[8029]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 153.154537][ T5715] usb 1-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 153.155435][ T5715] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 153.155463][ T5715] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 153.155505][ T5715] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.159397][ T5715] usb 1-1: config 0 descriptor?? [ 153.220375][ T8035] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 153.488170][ T8050] FAULT_INJECTION: forcing a failure. [ 153.488170][ T8050] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 153.488202][ T8050] CPU: 0 UID: 0 PID: 8050 Comm: syz.5.754 Tainted: G L syzkaller #0 PREEMPT(full) [ 153.488229][ T8050] Tainted: [L]=SOFTLOCKUP [ 153.488235][ T8050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 153.488246][ T8050] Call Trace: [ 153.488252][ T8050] [ 153.488259][ T8050] dump_stack_lvl+0x100/0x190 [ 153.488294][ T8050] should_fail_ex.cold+0x5/0xa [ 153.488316][ T8050] ? prepare_alloc_pages+0x16d/0x5b0 [ 153.488342][ T8050] should_fail_alloc_page+0xeb/0x140 [ 153.488366][ T8050] prepare_alloc_pages+0x1f0/0x5b0 [ 153.488387][ T8050] ? __memcg_kmem_charge_page+0x373/0x4d0 [ 153.488420][ T8050] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 153.488445][ T8050] ? do_raw_spin_unlock+0x145/0x1e0 [ 153.488474][ T8050] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 153.488507][ T8050] ? rcu_is_watching+0x13/0xc0 [ 153.488537][ T8050] ? trace_hrtimer_start+0x77/0x220 [ 153.488571][ T8050] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 153.488599][ T8050] ? find_held_lock+0x2b/0x80 [ 153.488626][ T8050] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 153.488650][ T8050] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 153.488676][ T8050] ? rcu_is_watching+0x13/0xc0 [ 153.488712][ T8050] ? trace_sched_exit_tp+0x120/0x160 [ 153.488742][ T8050] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 153.488769][ T8050] ? policy_nodemask+0xed/0x4f0 [ 153.488799][ T8050] alloc_pages_mpol+0x201/0x550 [ 153.488827][ T8050] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 153.488857][ T8050] ? avc_has_perm_noaudit+0x145/0x470 [ 153.488890][ T8050] alloc_pages_noprof+0x1a/0x160 [ 153.488921][ T8050] anon_pipe_prefill_and_lock+0x102/0x580 [ 153.488948][ T8050] ? futex_unqueue+0x13d/0x2c0 [ 153.488986][ T8050] ? __pfx_anon_pipe_prefill_and_lock+0x10/0x10 [ 153.489021][ T8050] ? inode_has_perm.isra.0+0x14a/0x1a0 [ 153.489052][ T8050] anon_pipe_write+0x164/0x1b50 [ 153.489089][ T8050] ? __pfx_anon_pipe_write+0x10/0x10 [ 153.489114][ T8050] ? selinux_file_permission+0x8f/0x6d0 [ 153.489145][ T8050] ? bpf_lsm_file_permission+0x9/0x10 [ 153.489171][ T8050] ? security_file_permission+0x76/0x210 [ 153.489197][ T8050] ? rw_verify_area+0xce/0x6d0 [ 153.489230][ T8050] vfs_write+0x6af/0x1050 [ 153.489252][ T8050] ? __pfx_anon_pipe_write+0x10/0x10 [ 153.489280][ T8050] ? __pfx_vfs_write+0x10/0x10 [ 153.489299][ T8050] ? find_held_lock+0x2b/0x80 [ 153.489345][ T8050] ksys_write+0x1f8/0x250 [ 153.489366][ T8050] ? __pfx_ksys_write+0x10/0x10 [ 153.489396][ T8050] do_syscall_64+0x123/0x790 [ 153.489429][ T8050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.489450][ T8050] RIP: 0033:0x7ff1fa39e159 [ 153.489468][ T8050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.489488][ T8050] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 153.489509][ T8050] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 153.489523][ T8050] RDX: 00000000ffffff9a RSI: 0000200000000000 RDI: 0000000000000004 [ 153.489536][ T8050] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 153.489548][ T8050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 153.489558][ T8050] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 153.489587][ T8050] [ 153.911437][ T5715] hid-led 0003:1D34:000A.0008: unknown main item tag 0x0 [ 153.911459][ T5715] hid-led 0003:1D34:000A.0008: unknown main item tag 0x0 [ 153.911474][ T5715] hid-led 0003:1D34:000A.0008: unknown main item tag 0x0 [ 153.978915][ T8056] Bluetooth: MGMT ver 1.23 [ 153.978942][ T8056] Bluetooth: hci1: too big key_count value 29096 [ 154.152006][ T5715] hid-led 0003:1D34:000A.0008: hidraw0: USB HID v0.00 Device [HID 1d34:000a] on usb-dummy_hcd.0-1/input0 [ 154.219191][ T5715] hid-led 0003:1D34:000A.0008: Dream Cheeky Webmail Notifier initialized [ 154.378137][ T5715] usb 1-1: USB disconnect, device number 16 [ 154.641947][ T8067] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 155.193412][ T8097] IPv4: Oversized IP packet from 172.20.20.24 [ 155.200468][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 155.201411][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 155.683064][ T8122] netlink: 'syz.0.785': attribute type 1 has an invalid length. [ 155.751718][ T8122] bond0: entered promiscuous mode [ 155.752872][ T8122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.759140][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 155.759155][ T30] audit: type=1400 audit(1790288475.553:872): avc: denied { listen } for pid=8124 comm="syz.4.786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 155.839873][ T8125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.840288][ T8125] bond0: (slave wireguard0): The slave device specified does not support setting the MAC address [ 155.840307][ T8125] bond0: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 155.880607][ T8125] bond0: (slave wireguard0): making interface the new active one [ 155.880629][ T8125] wireguard0: entered promiscuous mode [ 155.897969][ T8125] bond0: (slave wireguard0): Enslaving as an active interface with an up link [ 155.967097][ T8132] all: renamed from bridge_slave_0 (while UP) [ 156.221218][ T30] audit: type=1400 audit(1790288476.013:873): avc: denied { bind } for pid=8144 comm="syz.5.793" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 156.221511][ T30] audit: type=1400 audit(1790288476.013:874): avc: denied { name_bind } for pid=8144 comm="syz.5.793" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 156.440489][ T30] audit: type=1400 audit(1790288476.233:875): avc: denied { accept } for pid=8150 comm="syz.4.796" lport=49205 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 156.444602][ T8154] netlink: 'syz.2.797': attribute type 2 has an invalid length. [ 156.444619][ T8154] netlink: 4 bytes leftover after parsing attributes in process `syz.2.797'. [ 156.532743][ T8156] FAULT_INJECTION: forcing a failure. [ 156.532743][ T8156] name failslab, interval 1, probability 0, space 0, times 0 [ 156.532773][ T8156] CPU: 1 UID: 0 PID: 8156 Comm: syz.0.798 Tainted: G L syzkaller #0 PREEMPT(full) [ 156.532802][ T8156] Tainted: [L]=SOFTLOCKUP [ 156.532809][ T8156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 156.532821][ T8156] Call Trace: [ 156.532828][ T8156] [ 156.532836][ T8156] dump_stack_lvl+0x100/0x190 [ 156.532874][ T8156] should_fail_ex.cold+0x5/0xa [ 156.532898][ T8156] ? lockdep_hardirqs_on+0x7d/0x110 [ 156.532932][ T8156] should_failslab+0xc2/0x120 [ 156.532961][ T8156] kmem_cache_alloc_noprof+0x92/0x6a0 [ 156.532984][ T8156] ? do_raw_spin_lock+0x128/0x260 [ 156.533008][ T8156] ? inet_bind_bucket_create+0x2d/0x280 [ 156.533037][ T8156] inet_bind_bucket_create+0x2d/0x280 [ 156.533062][ T8156] inet_csk_get_port+0x153f/0x28e0 [ 156.533106][ T8156] ? __pfx_inet_csk_get_port+0x10/0x10 [ 156.533134][ T8156] inet_csk_listen_start+0x205/0x450 [ 156.533164][ T8156] __inet_listen_sk+0x20f/0x510 [ 156.533185][ T8156] ? __pfx___inet_listen_sk+0x10/0x10 [ 156.533205][ T8156] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 156.533246][ T8156] ? __local_bh_enable_ip+0xa5/0x120 [ 156.533275][ T8156] inet_listen+0x93/0xd0 [ 156.533295][ T8156] __sys_listen_socket+0x108/0x150 [ 156.533319][ T8156] __sys_listen+0xa7/0x130 [ 156.533342][ T8156] __x64_sys_listen+0x53/0x80 [ 156.533364][ T8156] do_syscall_64+0x123/0x790 [ 156.533396][ T8156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.533417][ T8156] RIP: 0033:0x7eff3539e159 [ 156.533435][ T8156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.533454][ T8156] RSP: 002b:00007eff362ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 [ 156.533474][ T8156] RAX: ffffffffffffffda RBX: 00007eff35625fa0 RCX: 00007eff3539e159 [ 156.533487][ T8156] RDX: 0000000000000000 RSI: 0000000004000000 RDI: 0000000000000003 [ 156.533500][ T8156] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 156.533512][ T8156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 156.533525][ T8156] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 156.533556][ T8156] [ 156.650448][ T8159] syz_tun: entered allmulticast mode [ 156.662565][ T30] audit: type=1400 audit(1790288476.453:876): avc: denied { name_connect } for pid=8158 comm="syz.6.800" dest=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 156.672015][ T8157] syz_tun: left allmulticast mode [ 157.114579][ T8177] netlink: 4 bytes leftover after parsing attributes in process `syz.5.806'. [ 157.484840][ T8181] smc: net device lo applied user defined pnetid SYZ0 [ 157.505597][ T8183] netlink: 8 bytes leftover after parsing attributes in process `syz.5.809'. [ 157.505630][ T8183] netlink: 'syz.5.809': attribute type 22 has an invalid length. [ 157.505644][ T8183] netlink: 8 bytes leftover after parsing attributes in process `syz.5.809'. [ 157.541772][ T8183] netlink: 8 bytes leftover after parsing attributes in process `syz.5.809'. [ 157.541803][ T8183] netlink: 'syz.5.809': attribute type 22 has an invalid length. [ 157.541816][ T8183] netlink: 8 bytes leftover after parsing attributes in process `syz.5.809'. [ 157.547428][ T7750] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 157.547465][ T7750] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 157.547496][ T7750] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 157.547527][ T7750] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 157.904571][ T30] audit: type=1400 audit(1790288477.703:877): avc: denied { read write } for pid=8192 comm="syz.2.814" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 157.905130][ T30] audit: type=1400 audit(1790288477.703:878): avc: denied { open } for pid=8192 comm="syz.2.814" path="/188/proc/mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 157.906667][ T30] audit: type=1400 audit(1790288477.703:879): avc: denied { ioctl } for pid=8192 comm="syz.2.814" path="/188/proc/mtrr" dev="proc" ino=4026531995 ioctlcmd=0x4d05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 158.033884][ T5715] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 158.216605][ T5715] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 158.219935][ T5715] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 158.219965][ T5715] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 158.219989][ T5715] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 158.220028][ T5715] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.222400][ T5715] usb 7-1: config 0 descriptor?? [ 158.438955][ T30] audit: type=1400 audit(1790288478.233:880): avc: denied { mount } for pid=8199 comm="syz.5.817" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 158.701676][ T5715] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 158.927577][ T8217] netlink: 4 bytes leftover after parsing attributes in process `syz.5.823'. [ 159.070069][ T30] audit: type=1400 audit(1790288478.863:881): avc: denied { mounton } for pid=8222 comm="syz.5.826" path="/153/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 160.869513][ T25] usb 7-1: USB disconnect, device number 6 [ 160.960542][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 160.960556][ T30] audit: type=1400 audit(1790288480.753:885): avc: denied { create } for pid=8272 comm="syz.0.846" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 160.981553][ T8268] bond0: entered promiscuous mode [ 161.021506][ T30] audit: type=1400 audit(1790288480.813:886): avc: denied { rename } for pid=8272 comm="syz.0.846" name="file0" dev="tmpfs" ino=846 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 161.329703][ T30] audit: type=1400 audit(1790288481.123:887): avc: denied { remount } for pid=8288 comm="syz.2.852" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 161.368647][ T8289] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 161.438123][ T5715] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 161.460574][ T8294] netlink: 1363 bytes leftover after parsing attributes in process `syz.2.854'. [ 161.594007][ T5715] usb 7-1: Using ep0 maxpacket: 16 [ 161.595061][ T5715] usb 7-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 161.596298][ T5715] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.596328][ T5715] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.596349][ T5715] usb 7-1: config 0 interface 0 has no altsetting 0 [ 161.596387][ T5715] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.602959][ T5715] usb 7-1: config 0 descriptor?? [ 161.774295][ T8299] syzkaller1: entered promiscuous mode [ 161.774318][ T8299] syzkaller1: entered allmulticast mode [ 161.840345][ T8282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.840806][ T8282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.853362][ T5715] usbhid 7-1:0.0: can't add hid device: -71 [ 161.853445][ T5715] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 161.861311][ T5715] usb 7-1: USB disconnect, device number 7 [ 162.115650][ T5748] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 162.273937][ T5748] usb 3-1: Using ep0 maxpacket: 32 [ 162.275383][ T5748] usb 3-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 162.275419][ T5748] usb 3-1: too many configurations: 17, using maximum allowed: 8 [ 162.276517][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.276541][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.276579][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.276601][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.277420][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.277443][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.277532][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.277556][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.278411][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.278435][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.278469][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.278491][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.279465][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.279488][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.279524][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.279547][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.280376][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.280397][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.280433][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.280455][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.281281][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.281304][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.281346][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.281369][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.282234][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.282257][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.282292][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.282313][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.283423][ T5748] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 162.283446][ T5748] usb 3-1: config 0 has no interface number 0 [ 162.283482][ T5748] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.283504][ T5748] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.290204][ T5748] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.290227][ T5748] usb 3-1: Product: syz [ 162.290241][ T5748] usb 3-1: Manufacturer: syz [ 162.290256][ T5748] usb 3-1: SerialNumber: syz [ 162.295401][ T5748] usb 3-1: config 0 descriptor?? [ 162.299720][ T5748] etas_es58x 3-1:0.2: Starting syz syz (Serial Number syz) [ 162.333898][ T5715] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 162.498876][ T5715] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 162.503593][ T5715] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.503622][ T5715] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.503667][ T5715] usb 7-1: config 0 interface 0 has no altsetting 0 [ 162.503697][ T5715] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.518391][ T5715] usb 7-1: config 0 descriptor?? [ 162.600298][ T30] audit: type=1400 audit(1790288482.393:888): avc: denied { create } for pid=8315 comm="syz.0.864" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 162.620830][ T30] audit: type=1400 audit(1790288482.403:889): avc: denied { write } for pid=8315 comm="syz.0.864" name="file0" dev="tmpfs" ino=879 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 162.623102][ T30] audit: type=1400 audit(1790288482.413:890): avc: denied { open } for pid=8315 comm="syz.0.864" path="/163/file0" dev="tmpfs" ino=879 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 162.627319][ T30] audit: type=1400 audit(1790288482.413:891): avc: denied { ioctl } for pid=8315 comm="syz.0.864" path="/163/file0" dev="tmpfs" ino=879 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 162.691744][ T30] audit: type=1400 audit(1790288482.463:892): avc: denied { unlink } for pid=5601 comm="syz-executor" name="file0" dev="tmpfs" ino=879 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 162.814637][ T30] audit: type=1400 audit(1790288482.613:893): avc: denied { getopt } for pid=8319 comm="syz.0.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 163.014997][ T5715] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0D8C:0022.000A/input/input17 [ 163.067504][ T5715] cm6533_jd 0003:0D8C:0022.000A: input,hiddev0,hidraw0: USB HID v0.05 Device [HID 0d8c:0022] on usb-dummy_hcd.6-1/input0 [ 163.183628][ T30] audit: type=1400 audit(1790288482.973:894): avc: denied { write } for pid=8326 comm="syz.0.868" name="nullb" dev="configfs" ino=147 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.276120][ T5715] usb 7-1: USB disconnect, device number 8 [ 163.311913][ T8325] fido_id[8325]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory [ 163.447354][ T8249] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 163.486189][ T5748] etas_es58x 3-1:0.2: could not retrieve the product info string [ 163.644333][ T8337] device-mapper: table: 248:1: thin-pool: Invalid argument count (-EINVAL) [ 163.644355][ T8337] device-mapper: ioctl: error adding target to table [ 163.767025][ T5748] usb 3-1: USB disconnect, device number 11 [ 163.775675][ T5748] etas_es58x 3-1:0.2: Disconnecting syz syz [ 164.534729][ T8364] device-mapper: table: 248:1: thin-p: unknown target type [ 164.534748][ T8364] device-mapper: ioctl: error adding target to table [ 164.873995][ T8370] FAULT_INJECTION: forcing a failure. [ 164.873995][ T8370] name failslab, interval 1, probability 0, space 0, times 0 [ 164.874029][ T8370] CPU: 1 UID: 0 PID: 8370 Comm: syz.5.886 Tainted: G L syzkaller #0 PREEMPT(full) [ 164.874057][ T8370] Tainted: [L]=SOFTLOCKUP [ 164.874065][ T8370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 164.874078][ T8370] Call Trace: [ 164.874084][ T8370] [ 164.874093][ T8370] dump_stack_lvl+0x100/0x190 [ 164.874128][ T8370] should_fail_ex.cold+0x5/0xa [ 164.874166][ T8370] should_failslab+0xc2/0x120 [ 164.874195][ T8370] __kmalloc_cache_noprof+0x91/0x6d0 [ 164.874224][ T8370] ? futex_unqueue+0x13d/0x2c0 [ 164.874250][ T8370] ? alloc_pipe_info+0x10e/0x590 [ 164.874281][ T8370] alloc_pipe_info+0x10e/0x590 [ 164.874305][ T8370] ? futex_hash+0x311/0x400 [ 164.874332][ T8370] splice_direct_to_actor+0x78f/0xa30 [ 164.874362][ T8370] ? __lock_acquire+0x5c0/0x1f40 [ 164.874384][ T8370] ? __pfx_direct_splice_actor+0x10/0x10 [ 164.874413][ T8370] ? find_held_lock+0x2b/0x80 [ 164.874441][ T8370] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 164.874471][ T8370] ? lock_acquire+0x1d1/0x380 [ 164.874495][ T8370] do_splice_direct+0x174/0x240 [ 164.874523][ T8370] ? __pfx_do_splice_direct+0x10/0x10 [ 164.874547][ T8370] ? avc_policy_seqno+0x9/0x20 [ 164.874577][ T8370] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 164.874608][ T8370] ? rw_verify_area+0xce/0x6d0 [ 164.874636][ T8370] do_sendfile+0xadc/0xe20 [ 164.874660][ T8370] ? __pfx_do_sendfile+0x10/0x10 [ 164.874679][ T8370] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 164.874715][ T8370] ? __x64_sys_futex+0x34f/0x4d0 [ 164.874741][ T8370] ? __x64_sys_futex+0x358/0x4d0 [ 164.874770][ T8370] __x64_sys_sendfile64+0x1d8/0x220 [ 164.874796][ T8370] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 164.874830][ T8370] do_syscall_64+0x123/0x790 [ 164.874863][ T8370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.874883][ T8370] RIP: 0033:0x7ff1fa39e159 [ 164.874901][ T8370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.874920][ T8370] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 164.874943][ T8370] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 164.874957][ T8370] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 164.874969][ T8370] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 164.874982][ T8370] R10: 0000000000008112 R11: 0000000000000246 R12: 0000000000000000 [ 164.874995][ T8370] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 164.875024][ T8370] [ 165.769170][ T8393] FAULT_INJECTION: forcing a failure. [ 165.769170][ T8393] name failslab, interval 1, probability 0, space 0, times 0 [ 165.769206][ T8393] CPU: 1 UID: 0 PID: 8393 Comm: syz.5.896 Tainted: G L syzkaller #0 PREEMPT(full) [ 165.769236][ T8393] Tainted: [L]=SOFTLOCKUP [ 165.769244][ T8393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 165.769256][ T8393] Call Trace: [ 165.769263][ T8393] [ 165.769271][ T8393] dump_stack_lvl+0x100/0x190 [ 165.769308][ T8393] should_fail_ex.cold+0x5/0xa [ 165.769338][ T8393] should_failslab+0xc2/0x120 [ 165.769365][ T8393] kmem_cache_alloc_noprof+0x92/0x6a0 [ 165.769390][ T8393] ? dup_fd+0x4d/0xd10 [ 165.769422][ T8393] dup_fd+0x4d/0xd10 [ 165.769446][ T8393] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 165.769486][ T8393] __x64_sys_close_range+0x405/0x5d0 [ 165.769519][ T8393] ? __pfx___x64_sys_close_range+0x10/0x10 [ 165.769557][ T8393] do_syscall_64+0x123/0x790 [ 165.769590][ T8393] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.769620][ T8393] RIP: 0033:0x7ff1fa39e159 [ 165.769638][ T8393] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.769659][ T8393] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 165.769681][ T8393] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 165.769696][ T8393] RDX: 0000000000000002 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 165.769710][ T8393] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 165.769723][ T8393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.769735][ T8393] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 165.769765][ T8393] [ 166.148715][ T8398] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 166.446878][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 166.446894][ T30] audit: type=1400 audit(1790288486.243:899): avc: denied { accept } for pid=8407 comm="syz.4.902" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 167.204885][ T8418] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 167.414690][ T8425] netlink: 28 bytes leftover after parsing attributes in process `syz.6.908'. [ 167.414728][ T8425] netlink: 'syz.6.908': attribute type 7 has an invalid length. [ 167.414741][ T8425] netlink: 'syz.6.908': attribute type 8 has an invalid length. [ 167.414753][ T8425] netlink: 4 bytes leftover after parsing attributes in process `syz.6.908'. [ 167.487798][ T8425] erspan0: entered promiscuous mode [ 167.488950][ T8425] gretap0: entered promiscuous mode [ 167.506149][ T8425] erspan0: left promiscuous mode [ 167.519606][ T8425] gretap0: left promiscuous mode [ 167.593966][ T189] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 167.753878][ T189] usb 3-1: Using ep0 maxpacket: 8 [ 167.861714][ T8422] gtp0: entered promiscuous mode [ 167.861735][ T8422] gtp0: entered allmulticast mode [ 168.200682][ T189] usb 3-1: unable to get BOS descriptor or descriptor too short [ 168.202665][ T189] usb 3-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 0.40 [ 168.225212][ T189] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 168.225246][ T189] usb 3-1: can't read configurations, error -71 [ 168.254506][ T8441] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 168.672147][ T8454] FAULT_INJECTION: forcing a failure. [ 168.672147][ T8454] name failslab, interval 1, probability 0, space 0, times 0 [ 168.672181][ T8454] CPU: 1 UID: 0 PID: 8454 Comm: syz.4.921 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.672209][ T8454] Tainted: [L]=SOFTLOCKUP [ 168.672217][ T8454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 168.672229][ T8454] Call Trace: [ 168.672236][ T8454] [ 168.672244][ T8454] dump_stack_lvl+0x100/0x190 [ 168.672281][ T8454] should_fail_ex.cold+0x5/0xa [ 168.672310][ T8454] should_failslab+0xc2/0x120 [ 168.672336][ T8454] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 168.672362][ T8454] ? __d_alloc+0x35/0xa50 [ 168.672394][ T8454] __d_alloc+0x35/0xa50 [ 168.672424][ T8454] d_alloc_pseudo+0x1c/0xc0 [ 168.672444][ T8454] alloc_file_pseudo+0x118/0x290 [ 168.672475][ T8454] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 168.672505][ T8454] ? _raw_spin_unlock+0x28/0x50 [ 168.672531][ T8454] ? alloc_fd+0x471/0x7a0 [ 168.672559][ T8454] __anon_inode_getfile+0xe8/0x280 [ 168.672585][ T8454] do_epoll_create+0x3ac/0x540 [ 168.672615][ T8454] __x64_sys_epoll_create1+0x30/0x40 [ 168.672645][ T8454] do_syscall_64+0x123/0x790 [ 168.672677][ T8454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.672698][ T8454] RIP: 0033:0x7f184459e159 [ 168.672715][ T8454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.672734][ T8454] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000123 [ 168.672755][ T8454] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 168.672769][ T8454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 168.672781][ T8454] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 168.672793][ T8454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 168.672805][ T8454] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 168.672835][ T8454] [ 168.893878][ T8458] FAULT_INJECTION: forcing a failure. [ 168.893878][ T8458] name failslab, interval 1, probability 0, space 0, times 0 [ 168.893912][ T8458] CPU: 0 UID: 0 PID: 8458 Comm: syz.4.925 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.893942][ T8458] Tainted: [L]=SOFTLOCKUP [ 168.893949][ T8458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 168.893963][ T8458] Call Trace: [ 168.893970][ T8458] [ 168.893978][ T8458] dump_stack_lvl+0x100/0x190 [ 168.894014][ T8458] should_fail_ex.cold+0x5/0xa [ 168.894042][ T8458] should_failslab+0xc2/0x120 [ 168.894068][ T8458] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 168.894095][ T8458] ? setup_ipc_sysctls+0x5e/0x300 [ 168.894130][ T8458] kmemdup_noprof+0x29/0x60 [ 168.894164][ T8458] setup_ipc_sysctls+0x5e/0x300 [ 168.894196][ T8458] copy_ipcs+0x57a/0x7e0 [ 168.894220][ T8458] create_new_namespaces+0x20a/0xac0 [ 168.894245][ T8458] ? security_capable+0x80/0x260 [ 168.894279][ T8458] unshare_nsproxy_namespaces+0xf2/0x220 [ 168.894307][ T8458] ksys_unshare+0x4a2/0xa70 [ 168.894332][ T8458] ? __pfx_ksys_unshare+0x10/0x10 [ 168.894366][ T8458] __x64_sys_unshare+0x31/0x40 [ 168.894390][ T8458] do_syscall_64+0x123/0x790 [ 168.894423][ T8458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.894446][ T8458] RIP: 0033:0x7f184459e159 [ 168.894464][ T8458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.894483][ T8458] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 168.894503][ T8458] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 168.894517][ T8458] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008040480 [ 168.894530][ T8458] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 168.894543][ T8458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 168.894555][ T8458] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 168.894583][ T8458] [ 169.366546][ T30] audit: type=1400 audit(1790288489.163:900): avc: denied { mount } for pid=8465 comm="syz.4.928" name="/" dev="rpc_pipefs" ino=22148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 169.414978][ T30] audit: type=1400 audit(1790288489.213:901): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 169.663629][ T8474] netlink: 8752 bytes leftover after parsing attributes in process `syz.4.931'. [ 170.001129][ T1001] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.048017][ T8485] kvm: MWAIT instruction emulated as NOP! [ 170.296295][ T1001] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.447516][ T1001] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.552104][ T1001] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.745621][ T30] audit: type=1400 audit(1790288490.543:902): avc: denied { read } for pid=5268 comm="dhcpcd" name="n42" dev="tmpfs" ino=5798 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 170.745962][ T30] audit: type=1400 audit(1790288490.543:903): avc: denied { open } for pid=5268 comm="dhcpcd" path="/run/udev/data/n42" dev="tmpfs" ino=5798 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 170.747447][ T30] audit: type=1400 audit(1790288490.543:904): avc: denied { getattr } for pid=5268 comm="dhcpcd" path="/run/udev/data/n42" dev="tmpfs" ino=5798 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 170.919133][ T5616] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 170.921232][ T5616] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 170.923177][ T5616] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 170.947499][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 170.948587][ T5616] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 170.953272][ T30] audit: type=1400 audit(1790288490.743:905): avc: denied { read } for pid=8500 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 170.953317][ T30] audit: type=1400 audit(1790288490.743:906): avc: denied { open } for pid=8500 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 171.045611][ T1001] bridge_slave_1: left allmulticast mode [ 171.045634][ T1001] bridge_slave_1: left promiscuous mode [ 171.045822][ T1001] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.057875][ T1001] bridge_slave_0: left allmulticast mode [ 171.057896][ T1001] bridge_slave_0: left promiscuous mode [ 171.058056][ T1001] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.380525][ T30] audit: type=1400 audit(1790288491.173:907): avc: denied { write } for pid=8507 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.380889][ T30] audit: type=1400 audit(1790288491.173:908): avc: denied { create } for pid=8507 comm="dhcpcd-run-hook" name="resolv.conf.eth9.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.550443][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 171.550459][ T30] audit: type=1400 audit(1790288491.343:911): avc: denied { write } for pid=8520 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.552436][ T30] audit: type=1400 audit(1790288491.343:912): avc: denied { unlink } for pid=8520 comm="rm" name="resolv.conf.eth9.link" dev="tmpfs" ino=5808 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.783079][ T1001] bond0 (unregistering): Released all slaves [ 171.849050][ T8175] syz.2.802 (8175) used greatest stack depth: 17552 bytes left [ 171.897337][ T5268] 8021q: adding VLAN 0 to HW filter on device eth9 [ 172.672398][ T1001] hsr_slave_0: left promiscuous mode [ 172.690793][ T1001] hsr_slave_1: left promiscuous mode [ 172.691947][ T1001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 172.691966][ T1001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 172.741883][ T8551] FAULT_INJECTION: forcing a failure. [ 172.741883][ T8551] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 172.741917][ T8551] CPU: 0 UID: 0 PID: 8551 Comm: syz.0.948 Tainted: G L syzkaller #0 PREEMPT(full) [ 172.741946][ T8551] Tainted: [L]=SOFTLOCKUP [ 172.741953][ T8551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 172.741965][ T8551] Call Trace: [ 172.741972][ T8551] [ 172.741981][ T8551] dump_stack_lvl+0x100/0x190 [ 172.742017][ T8551] should_fail_ex.cold+0x5/0xa [ 172.742041][ T8551] ? prepare_alloc_pages+0x16d/0x5b0 [ 172.742072][ T8551] should_fail_alloc_page+0xeb/0x140 [ 172.742111][ T8551] prepare_alloc_pages+0x1f0/0x5b0 [ 172.742140][ T8551] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 172.742165][ T8551] ? rcu_is_watching+0x13/0xc0 [ 172.742199][ T8551] ? __lock_acquire+0x5c0/0x1f40 [ 172.742222][ T8551] ? __css_rstat_updated+0x1ce/0x590 [ 172.742250][ T8551] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 172.742278][ T8551] ? rcu_is_watching+0x13/0xc0 [ 172.742299][ T8551] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 172.742319][ T8551] ? find_held_lock+0x2b/0x80 [ 172.742350][ T8551] ? __lock_acquire+0x5c0/0x1f40 [ 172.742369][ T8551] ? rcu_is_watching+0x13/0xc0 [ 172.742403][ T8551] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 172.742431][ T8551] ? policy_nodemask+0xed/0x4f0 [ 172.742458][ T8551] alloc_pages_mpol+0x201/0x550 [ 172.742484][ T8551] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 172.742508][ T8551] ? filemap_get_entry+0x22d/0x450 [ 172.742532][ T8551] ? filemap_get_entry+0x22d/0x450 [ 172.742557][ T8551] folio_alloc_noprof+0x22/0x250 [ 172.742586][ T8551] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 172.742613][ T8551] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 172.742638][ T8551] ? rcu_is_watching+0x13/0xc0 [ 172.742663][ T8551] ? trace_kmalloc+0xeb/0x110 [ 172.742685][ T1001] veth1_macvtap: left promiscuous mode [ 172.742694][ T8551] __filemap_get_folio_mpol+0x653/0x1280 [ 172.742715][ T1001] veth0_macvtap: left promiscuous mode [ 172.742731][ T8551] ioctx_alloc+0x7e1/0x21a0 [ 172.742775][ T8551] ? __pfx_ioctx_alloc+0x10/0x10 [ 172.742803][ T1001] veth1_vlan: left promiscuous mode [ 172.742812][ T8551] __x64_sys_io_setup+0xc9/0x220 [ 172.742843][ T8551] do_syscall_64+0x123/0x790 [ 172.742860][ T1001] veth0_vlan: left promiscuous mode [ 172.742878][ T8551] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.742899][ T8551] RIP: 0033:0x7eff3539e159 [ 172.742919][ T8551] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.742937][ T8551] RSP: 002b:00007eff362ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 172.742958][ T8551] RAX: ffffffffffffffda RBX: 00007eff35625fa0 RCX: 00007eff3539e159 [ 172.742972][ T8551] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 00000000000005ff [ 172.742986][ T8551] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 172.742998][ T8551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 172.743009][ T8551] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 172.743044][ T8551] [ 173.033949][ T52] Bluetooth: hci2: command tx timeout [ 173.105337][ T30] audit: type=1400 audit(1790288492.893:913): avc: denied { write } for pid=8541 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.243767][ T30] audit: type=1400 audit(1790288493.033:914): avc: denied { write } for pid=8559 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.572214][ T1001] team0 (unregistering): Port device team_slave_1 removed [ 173.619108][ T1001] team0 (unregistering): Port device team_slave_0 removed [ 173.968594][ T1001] smc: removing net device lo with user defined pnetid SYZ0 [ 174.015147][ T5268] 8021q: adding VLAN 0 to HW filter on device eth10 [ 174.042192][ T8579] FAULT_INJECTION: forcing a failure. [ 174.042192][ T8579] name failslab, interval 1, probability 0, space 0, times 0 [ 174.042220][ T8579] CPU: 0 UID: 0 PID: 8579 Comm: syz.0.954 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.042246][ T8579] Tainted: [L]=SOFTLOCKUP [ 174.042253][ T8579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 174.042267][ T8579] Call Trace: [ 174.042274][ T8579] [ 174.042282][ T8579] dump_stack_lvl+0x100/0x190 [ 174.042328][ T8579] should_fail_ex.cold+0x5/0xa [ 174.042368][ T8579] should_failslab+0xc2/0x120 [ 174.042405][ T8579] __kmalloc_cache_noprof+0x91/0x6d0 [ 174.042446][ T8579] ? adfs_init_fs_context+0x45/0x420 [ 174.042480][ T8579] adfs_init_fs_context+0x45/0x420 [ 174.042506][ T8579] alloc_fs_context+0x60c/0xf40 [ 174.042544][ T8579] __x64_sys_fsopen+0xed/0x220 [ 174.042566][ T8579] do_syscall_64+0x123/0x790 [ 174.042601][ T8579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.042621][ T8579] RIP: 0033:0x7eff3539e159 [ 174.042638][ T8579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.042657][ T8579] RSP: 002b:00007eff362ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 174.042677][ T8579] RAX: ffffffffffffffda RBX: 00007eff35625fa0 RCX: 00007eff3539e159 [ 174.042691][ T8579] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 [ 174.042705][ T8579] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 174.042719][ T8579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.042732][ T8579] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 174.042761][ T8579] [ 174.440102][ T8586] FAULT_INJECTION: forcing a failure. [ 174.440102][ T8586] name failslab, interval 1, probability 0, space 0, times 0 [ 174.440132][ T8586] CPU: 0 UID: 0 PID: 8586 Comm: syz.0.956 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.440161][ T8586] Tainted: [L]=SOFTLOCKUP [ 174.440170][ T8586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 174.440183][ T8586] Call Trace: [ 174.440190][ T8586] [ 174.440199][ T8586] dump_stack_lvl+0x100/0x190 [ 174.440236][ T8586] should_fail_ex.cold+0x5/0xa [ 174.440267][ T8586] should_failslab+0xc2/0x120 [ 174.440294][ T8586] kmem_cache_alloc_noprof+0x92/0x6a0 [ 174.440318][ T8586] ? net_alloc_generic+0x1e/0x70 [ 174.440346][ T8586] ? copy_net_ns+0xe8/0x7a0 [ 174.440382][ T8586] copy_net_ns+0xe8/0x7a0 [ 174.440410][ T8586] ? copy_cgroup_ns+0x71/0x970 [ 174.440439][ T8586] create_new_namespaces+0x3ea/0xac0 [ 174.440472][ T8586] unshare_nsproxy_namespaces+0xf2/0x220 [ 174.440499][ T8586] ksys_unshare+0x4a2/0xa70 [ 174.440524][ T8586] ? __pfx_ksys_unshare+0x10/0x10 [ 174.440559][ T8586] __x64_sys_unshare+0x31/0x40 [ 174.440583][ T8586] do_syscall_64+0x123/0x790 [ 174.440615][ T8586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.440637][ T8586] RIP: 0033:0x7eff3539e159 [ 174.440659][ T8586] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.440680][ T8586] RSP: 002b:00007eff362ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 174.440701][ T8586] RAX: ffffffffffffffda RBX: 00007eff35625fa0 RCX: 00007eff3539e159 [ 174.440715][ T8586] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040040000 [ 174.440729][ T8586] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 174.440742][ T8586] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.440754][ T8586] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 174.440781][ T8586] [ 174.797248][ T30] audit: type=1400 audit(1790288494.593:915): avc: denied { watch } for pid=8592 comm="syz.5.960" path="/177" dev="tmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 174.797290][ T30] audit: type=1400 audit(1790288494.593:916): avc: denied { watch_sb } for pid=8592 comm="syz.5.960" path="/177" dev="tmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 174.944287][ T8597] FAULT_INJECTION: forcing a failure. [ 174.944287][ T8597] name failslab, interval 1, probability 0, space 0, times 0 [ 174.944331][ T8597] CPU: 1 UID: 0 PID: 8597 Comm: syz.4.959 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.944358][ T8597] Tainted: [L]=SOFTLOCKUP [ 174.944365][ T8597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 174.944384][ T8597] Call Trace: [ 174.944391][ T8597] [ 174.944402][ T8597] dump_stack_lvl+0x100/0x190 [ 174.944438][ T8597] should_fail_ex.cold+0x5/0xa [ 174.944469][ T8597] should_failslab+0xc2/0x120 [ 174.944497][ T8597] __kmalloc_cache_noprof+0x91/0x6d0 [ 174.944529][ T8597] ? do_getname+0x238/0x390 [ 174.944564][ T8597] do_getname+0x238/0x390 [ 174.944596][ T8597] __x64_sys_chdir+0xaa/0x280 [ 174.944622][ T8597] ? __pfx___x64_sys_chdir+0x10/0x10 [ 174.944654][ T8597] do_syscall_64+0x123/0x790 [ 174.944687][ T8597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.944710][ T8597] RIP: 0033:0x7f184459e159 [ 174.944728][ T8597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.944747][ T8597] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000050 [ 174.944768][ T8597] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 174.944782][ T8597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000007c0 [ 174.944796][ T8597] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 174.944809][ T8597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.944821][ T8597] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 174.944851][ T8597] [ 175.115658][ T52] Bluetooth: hci2: command tx timeout [ 175.416082][ T8500] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.416202][ T8500] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.416304][ T8500] bridge_slave_0: entered allmulticast mode [ 175.421318][ T8500] bridge_slave_0: entered promiscuous mode [ 175.465579][ T8500] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.465656][ T8500] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.465767][ T8500] bridge_slave_1: entered allmulticast mode [ 175.472160][ T8500] bridge_slave_1: entered promiscuous mode [ 175.488446][ T7747] IPVS: starting estimator thread 0... [ 175.526506][ T8616] syzkaller1: entered promiscuous mode [ 175.526526][ T8616] syzkaller1: entered allmulticast mode [ 175.567034][ T8500] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 175.587194][ T8624] IPVS: using max 32 ests per chain, 76800 per kthread [ 175.618995][ T30] audit: type=1400 audit(1790288495.413:917): avc: denied { bind } for pid=8628 comm="syz.2.968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 175.635573][ T30] audit: type=1400 audit(1790288495.423:918): avc: denied { write } for pid=8588 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.702530][ T30] audit: type=1400 audit(1790288495.493:919): avc: denied { write } for pid=8628 comm="syz.2.968" path="socket:[23798]" dev="sockfs" ino=23798 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 175.738268][ T8500] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 175.766658][ T30] audit: type=1400 audit(1790288495.563:920): avc: denied { read } for pid=8628 comm="syz.2.968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 175.875660][ T8500] team0: Port device team_slave_0 added [ 175.897201][ T8500] team0: Port device team_slave_1 added [ 176.063062][ T8500] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 176.063078][ T8500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 176.063101][ T8500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 176.125500][ T8500] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 176.125516][ T8500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 176.125537][ T8500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 176.335832][ T5268] 8021q: adding VLAN 0 to HW filter on device eth11 [ 176.376264][ T8500] hsr_slave_0: entered promiscuous mode [ 176.385096][ T8500] hsr_slave_1: entered promiscuous mode [ 176.387973][ T8500] debugfs: 'hsr0' already exists in 'hsr' [ 176.387992][ T8500] Cannot create hsr debugfs directory [ 176.880933][ T8500] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 176.899405][ T8500] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 176.901329][ T8500] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 176.925580][ T8500] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 176.927464][ T8500] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 176.957280][ T8500] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 176.959786][ T8500] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 176.984224][ T8500] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 177.184382][ T52] Bluetooth: hci2: command tx timeout [ 177.282615][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 177.282631][ T30] audit: type=1400 audit(1790288497.073:922): avc: denied { write } for pid=8650 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.339978][ T8500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 177.440802][ T8500] 8021q: adding VLAN 0 to HW filter on device team0 [ 177.473866][ T7747] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.473953][ T7747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 177.518066][ T8563] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.518157][ T8563] bridge0: port 2(bridge_slave_1) entered forwarding state [ 177.614329][ T30] audit: type=1400 audit(1790288497.403:923): avc: denied { append } for pid=8676 comm="syz.2.978" name="kmsg" dev="devtmpfs" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file permissive=1 [ 177.705232][ T8679] [ 177.757332][ T30] audit: type=1400 audit(1790288497.553:924): avc: denied { write } for pid=8680 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.853444][ T8683] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 177.853489][ T8683] SELinux: failed to load policy [ 178.006771][ T8688] FAULT_INJECTION: forcing a failure. [ 178.006771][ T8688] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 178.006806][ T8688] CPU: 1 UID: 0 PID: 8688 Comm: syz.5.981 Tainted: G L syzkaller #0 PREEMPT(full) [ 178.006835][ T8688] Tainted: [L]=SOFTLOCKUP [ 178.006842][ T8688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 178.006855][ T8688] Call Trace: [ 178.006863][ T8688] [ 178.006872][ T8688] dump_stack_lvl+0x100/0x190 [ 178.006907][ T8688] should_fail_ex.cold+0x5/0xa [ 178.006931][ T8688] ? prepare_alloc_pages+0x16d/0x5b0 [ 178.006961][ T8688] should_fail_alloc_page+0xeb/0x140 [ 178.006991][ T8688] prepare_alloc_pages+0x1f0/0x5b0 [ 178.007022][ T8688] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 178.007046][ T8688] ? __pfx_get_page_from_freelist+0x10/0x10 [ 178.007067][ T8688] ? prepare_alloc_pages+0x1f0/0x5b0 [ 178.007093][ T8688] ? is_bpf_text_address+0x94/0x1a0 [ 178.007123][ T8688] ? rcu_is_watching+0x13/0xc0 [ 178.007151][ T8688] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 178.007177][ T8688] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 178.007206][ T8688] ? stack_trace_save+0x8e/0xc0 [ 178.007232][ T8688] ? __pfx_stack_trace_save+0x10/0x10 [ 178.007253][ T8688] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 178.007274][ T8688] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 178.007296][ T8688] ? is_bpf_text_address+0x94/0x1a0 [ 178.007331][ T8688] ? kasan_save_track+0x14/0x30 [ 178.007354][ T8688] ? __kasan_slab_alloc+0x89/0x90 [ 178.007377][ T8688] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 178.007400][ T8688] ? alloc_vmap_area+0x640/0x2bb0 [ 178.007421][ T8688] ? __get_vm_area_node+0x1ed/0x350 [ 178.007445][ T8688] ? get_vm_area_caller+0x71/0xa0 [ 178.007468][ T8688] ? vmap+0x132/0x2e0 [ 178.007489][ T8688] ? ringbuf_map_alloc+0x363/0x860 [ 178.007511][ T8688] ? map_create+0x874/0x30d0 [ 178.007538][ T8688] ? __sys_bpf+0x12a0/0x4a30 [ 178.007558][ T8688] ? __x64_sys_bpf+0xce/0x140 [ 178.007578][ T8688] ? do_syscall_64+0x123/0x790 [ 178.007606][ T8688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.007637][ T8688] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 178.007667][ T8688] ? policy_nodemask+0xed/0x4f0 [ 178.007697][ T8688] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 178.007736][ T8688] __kasan_populate_vmalloc+0xf0/0x210 [ 178.007766][ T8688] alloc_vmap_area+0x95d/0x2bb0 [ 178.007799][ T8688] ? kasan_save_track+0x14/0x30 [ 178.007822][ T8688] ? __kasan_kmalloc+0xaa/0xb0 [ 178.007845][ T8688] ? __pfx_alloc_vmap_area+0x10/0x10 [ 178.007871][ T8688] ? __get_vm_area_node+0x124/0x350 [ 178.007900][ T8688] __get_vm_area_node+0x1ed/0x350 [ 178.007929][ T8688] ? ringbuf_map_alloc+0x363/0x860 [ 178.007954][ T8688] get_vm_area_caller+0x71/0xa0 [ 178.007979][ T8688] ? ringbuf_map_alloc+0x363/0x860 [ 178.008004][ T8688] vmap+0x132/0x2e0 [ 178.008028][ T8688] ? __pfx_vmap+0x10/0x10 [ 178.008050][ T8688] ? __pfx_alloc_pages_node_noprof+0x10/0x10 [ 178.008074][ T8688] ? __bpf_map_area_alloc+0x13a/0x200 [ 178.008101][ T8688] ringbuf_map_alloc+0x363/0x860 [ 178.008132][ T8688] map_create+0x874/0x30d0 [ 178.008160][ T8688] ? find_held_lock+0x2b/0x80 [ 178.008187][ T8688] ? avc_has_perm_noaudit+0x11e/0x470 [ 178.008223][ T8688] ? avc_has_perm_noaudit+0x11e/0x470 [ 178.008262][ T8688] ? __pfx_map_create+0x10/0x10 [ 178.008289][ T8688] ? avc_has_perm+0x135/0x1e0 [ 178.008316][ T8688] ? __pfx_avc_has_perm+0x10/0x10 [ 178.008339][ T8688] ? __might_fault+0xc5/0x140 [ 178.008368][ T8688] ? __might_fault+0xc5/0x140 [ 178.008401][ T8688] ? selinux_bpf+0xfb/0x150 [ 178.008433][ T8688] __sys_bpf+0x12a0/0x4a30 [ 178.008462][ T8688] ? __pfx___sys_bpf+0x10/0x10 [ 178.008481][ T8688] ? find_held_lock+0x2b/0x80 [ 178.008507][ T8688] ? futex_wake+0x4ea/0x5e0 [ 178.008547][ T8688] ? rcu_read_lock_any_held+0x6a/0x90 [ 178.008575][ T8688] ? find_held_lock+0x2b/0x80 [ 178.008603][ T8688] ? ksys_write+0x190/0x250 [ 178.008624][ T8688] ? ksys_write+0x190/0x250 [ 178.008662][ T8688] ? __x64_sys_futex+0x34f/0x4d0 [ 178.008688][ T8688] ? __x64_sys_futex+0x358/0x4d0 [ 178.008718][ T8688] ? xfd_validate_state+0x129/0x190 [ 178.008745][ T8688] ? __x64_sys_bpf+0xce/0x140 [ 178.008765][ T8688] __x64_sys_bpf+0xce/0x140 [ 178.008788][ T8688] ? do_syscall_64+0xae/0x790 [ 178.008820][ T8688] do_syscall_64+0x123/0x790 [ 178.008854][ T8688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.008875][ T8688] RIP: 0033:0x7ff1fa39e159 [ 178.008893][ T8688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.008912][ T8688] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 178.008933][ T8688] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 178.008949][ T8688] RDX: 0000000000000048 RSI: 0000200000000dc0 RDI: 0000000000000000 [ 178.008962][ T8688] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 178.008976][ T8688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.008988][ T8688] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 178.009021][ T8688] [ 178.162114][ T5268] 8021q: adding VLAN 0 to HW filter on device eth12 [ 179.209791][ T8500] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 179.264028][ T52] Bluetooth: hci2: command tx timeout [ 179.677723][ T8702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.984'. [ 179.684976][ T8500] veth0_vlan: entered promiscuous mode [ 179.698237][ T8500] veth1_vlan: entered promiscuous mode [ 179.973968][ T8500] veth0_macvtap: entered promiscuous mode [ 180.006379][ T8500] veth1_macvtap: entered promiscuous mode [ 180.118533][ T8500] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 180.154952][ T8500] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 180.216610][ T8563] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.235490][ T7747] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.235530][ T7747] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.235561][ T7747] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.307690][ T30] audit: type=1400 audit(1790288500.103:925): avc: denied { write } for pid=8749 comm="syz.2.997" name="functions" dev="configfs" ino=16392 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 180.310548][ T30] audit: type=1400 audit(1790288500.103:926): avc: denied { write } for pid=8749 comm="syz.2.997" name="functions" dev="configfs" ino=16392 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 180.590088][ T8563] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.590107][ T8563] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.640414][ T7747] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.640426][ T7747] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.913724][ T8765] gadgetfs: bound to dummy_udc driver [ 181.070058][ T8773] Illegal XDP return value 4294967274 on prog (id 74) dev syz_tun, expect packet loss! [ 181.129403][ T8775] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1007'. [ 181.179502][ T8777] syz_tun: entered allmulticast mode [ 181.182295][ T8777] syz_tun: left allmulticast mode [ 181.209401][ T30] audit: type=1400 audit(1790288501.003:927): avc: denied { setopt } for pid=8778 comm="syz.7.1008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 181.430324][ T8771] Bluetooth: MGMT ver 1.23 [ 181.457568][ T30] audit: type=1400 audit(1790288501.253:928): avc: denied { setopt } for pid=8788 comm="syz.0.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 181.520687][ T8792] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 181.551194][ T25] wiimote 0005:057E:0330.000B: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 181.560265][ T25] wiimote 0005:057E:0330.000B: New device registered [ 181.584791][ T8787] wiimote 0005:057E:0330.000B: Device removed [ 181.693404][ T8563] IPVS: starting estimator thread 0... [ 181.736887][ T8796] fido_id[8796]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 181.785777][ T8800] IPVS: using max 30 ests per chain, 72000 per kthread [ 181.930925][ T30] audit: type=1400 audit(1790288501.723:929): avc: denied { ioctl } for pid=8809 comm="syz.7.1022" path="/dev/rtc0" dev="devtmpfs" ino=915 ioctlcmd=0x7002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 181.971806][ T8812] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1021'. [ 182.624253][ T25] wiimote 0005:057E:0330.000B: detected device: Nintendo Wii Remote Plus (Gen 2) [ 182.811924][ T25] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input19 [ 182.851247][ T25] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input20 [ 182.896170][ T25] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input18 [ 183.170521][ T8835] lo: Caught tx_queue_len zero misconfig [ 183.909413][ T8851] X25: received unknown 00 with LCI 000 [ 184.120418][ T8856] netlink: 'syz.4.1039': attribute type 4 has an invalid length. [ 184.455141][ T30] audit: type=1400 audit(1790288504.253:930): avc: denied { create } for pid=8869 comm="syz.5.1043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 184.508392][ T30] audit: type=1400 audit(1790288504.303:931): avc: denied { write } for pid=8869 comm="syz.5.1043" path="socket:[24714]" dev="sockfs" ino=24714 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 184.695005][ T30] audit: type=1400 audit(1790288504.493:932): avc: denied { write } for pid=8857 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 184.830398][ T30] audit: type=1326 audit(1790288504.623:933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.830526][ T30] audit: type=1326 audit(1790288504.623:934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.831956][ T30] audit: type=1326 audit(1790288504.623:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.833665][ T30] audit: type=1326 audit(1790288504.623:936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.861268][ T30] audit: type=1326 audit(1790288504.623:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.861324][ T30] audit: type=1326 audit(1790288504.633:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 184.861368][ T30] audit: type=1326 audit(1790288504.633:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8884 comm="syz.7.1046" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa49a99e159 code=0x7ffc0000 [ 185.422525][ T8903] gretap0: entered promiscuous mode [ 185.436335][ T8903] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1050'. [ 185.436359][ T8903] gretap0: left promiscuous mode [ 185.660821][ T8916] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1053'. [ 185.660844][ T8916] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1053'. [ 185.660859][ T8916] netlink: 'syz.0.1053': attribute type 4 has an invalid length. [ 185.763905][ T5790] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 185.918225][ T5790] usb 8-1: Using ep0 maxpacket: 32 [ 185.921545][ T5790] usb 8-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 185.922491][ T5790] usb 8-1: config index 0 descriptor too short (expected 156, got 27) [ 185.922524][ T5790] usb 8-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 185.922559][ T5790] usb 8-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 185.922585][ T5790] usb 8-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 185.922611][ T5790] usb 8-1: config 0 interface 0 has no altsetting 0 [ 185.959966][ T5790] usb 8-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 185.959992][ T5790] usb 8-1: Product: syz [ 185.960007][ T5790] usb 8-1: Manufacturer: syz [ 185.960023][ T5790] usb 8-1: SerialNumber: syz [ 185.991579][ T8926] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1054'. [ 186.036351][ T5790] usb 8-1: config 0 descriptor?? [ 186.040035][ T5790] ldusb 8-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 186.074743][ T5790] ldusb 8-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 186.244031][ T8928] tipc: Started in network mode [ 186.244058][ T8928] tipc: Node identity ac1414aa, cluster identity 4711 [ 186.267482][ T8928] tipc: New replicast peer: 172.20.20.187 [ 186.287868][ T8928] tipc: Enabled bearer , priority 10 [ 186.447319][ T189] usb 8-1: USB disconnect, device number 2 [ 186.450356][ T8910] ldusb 8-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 186.453218][ T8936] ldusb: No device or device unplugged -19 [ 186.455280][ T189] ldusb 8-1:0.0: LD USB Device #0 now disconnected [ 186.583893][ T5723] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 186.746192][ T5723] usb 6-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 186.747116][ T5723] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 186.747166][ T5723] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 186.747203][ T5723] usb 6-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 186.747242][ T5723] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.753582][ T8934] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 186.756775][ T5723] ims_pcu 6-1:1.0: Incorrect number of endpoints on data interface (0) [ 186.756824][ T5723] ims_pcu 6-1:1.0: probe with driver ims_pcu failed with error -22 [ 187.003155][ T5723] usb 6-1: USB disconnect, device number 5 [ 187.385954][ T5790] tipc: Node number set to 2886997162 [ 187.463464][ T8948] SELinux: invalid class [ 187.463525][ T8948] SELinux: failed to load policy [ 187.498566][ T8952] FAULT_INJECTION: forcing a failure. [ 187.498566][ T8952] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 187.498602][ T8952] CPU: 0 UID: 0 PID: 8952 Comm: syz.4.1064 Tainted: G L syzkaller #0 PREEMPT(full) [ 187.498631][ T8952] Tainted: [L]=SOFTLOCKUP [ 187.498638][ T8952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 187.498652][ T8952] Call Trace: [ 187.498659][ T8952] [ 187.498667][ T8952] dump_stack_lvl+0x100/0x190 [ 187.498704][ T8952] should_fail_ex.cold+0x5/0xa [ 187.498730][ T8952] ? prepare_alloc_pages+0x16d/0x5b0 [ 187.498759][ T8952] should_fail_alloc_page+0xeb/0x140 [ 187.498787][ T8952] prepare_alloc_pages+0x1f0/0x5b0 [ 187.498819][ T8952] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 187.498848][ T8952] ? prepare_alloc_pages+0x151/0x5b0 [ 187.498878][ T8952] ? rcu_is_watching+0x13/0xc0 [ 187.498906][ T8952] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 187.498929][ T8952] ? lock_release+0x24d/0x310 [ 187.498950][ T8952] ? bpf_ksym_find+0x128/0x1c0 [ 187.498981][ T8952] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 187.499003][ T8952] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 187.499026][ T8952] ? is_bpf_text_address+0x94/0x1a0 [ 187.499054][ T8952] ? kernel_text_address+0x8d/0x100 [ 187.499084][ T8952] ? mark_held_locks+0x40/0x70 [ 187.499105][ T8952] ? __kernel_text_address+0xd/0x30 [ 187.499135][ T8952] ? unwind_get_return_address+0x59/0xa0 [ 187.499164][ T8952] ? arch_stack_walk+0xa6/0xf0 [ 187.499191][ T8952] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 187.499222][ T8952] ? stack_trace_save+0x8e/0xc0 [ 187.499242][ T8952] ? __pfx_stack_trace_save+0x10/0x10 [ 187.499275][ T8952] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 187.499304][ T8952] ? policy_nodemask+0xed/0x4f0 [ 187.499334][ T8952] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 187.499374][ T8952] __kasan_populate_vmalloc+0xf0/0x210 [ 187.499404][ T8952] alloc_vmap_area+0x95d/0x2bb0 [ 187.499439][ T8952] ? kasan_save_track+0x14/0x30 [ 187.499462][ T8952] ? __kasan_kmalloc+0xaa/0xb0 [ 187.499485][ T8952] ? __pfx_alloc_vmap_area+0x10/0x10 [ 187.499511][ T8952] ? __get_vm_area_node+0x124/0x350 [ 187.499546][ T8952] __get_vm_area_node+0x1ed/0x350 [ 187.499581][ T8952] __vmalloc_node_range_noprof+0x268/0x1420 [ 187.499610][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.499636][ T8952] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 187.499670][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.499697][ T8952] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 187.499728][ T8952] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 187.499761][ T8952] ? rcu_is_watching+0x13/0xc0 [ 187.499796][ T8952] __kvmalloc_node_noprof+0x3da/0x9b0 [ 187.499820][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.499843][ T8952] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 187.499873][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.499903][ T8952] hash_mac_create+0x3e0/0x1080 [ 187.499927][ T8952] ? __pfx_hash_mac_create+0x10/0x10 [ 187.499950][ T8952] ip_set_create+0x6c4/0x1510 [ 187.499986][ T8952] ? __pfx_ip_set_create+0x10/0x10 [ 187.500036][ T8952] ? find_held_lock+0x2b/0x80 [ 187.500084][ T8952] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 187.500140][ T8952] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 187.500190][ T8952] ? __lock_acquire+0x5c0/0x1f40 [ 187.500251][ T8952] ? avc_has_perm_noaudit+0x145/0x470 [ 187.500301][ T8952] netlink_rcv_skb+0x159/0x420 [ 187.500337][ T8952] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 187.500386][ T8952] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 187.500436][ T8952] ? ns_capable+0xd2/0xf0 [ 187.500466][ T8952] nfnetlink_rcv+0x1b3/0x440 [ 187.500494][ T8952] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 187.500519][ T8952] ? netlink_deliver_tap+0x1ae/0xcc0 [ 187.500553][ T8952] netlink_unicast+0x585/0x850 [ 187.500592][ T8952] ? __pfx_netlink_unicast+0x10/0x10 [ 187.500635][ T8952] netlink_sendmsg+0x8b0/0xda0 [ 187.500672][ T8952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.500711][ T8952] ? selinux_socket_sendmsg+0x198/0x2f0 [ 187.500747][ T8952] ____sys_sendmsg+0xa4d/0xbe0 [ 187.500791][ T8952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.500821][ T8952] ? __pfx_____sys_sendmsg+0x10/0x10 [ 187.500883][ T8952] ___sys_sendmsg+0x190/0x1e0 [ 187.500913][ T8952] ? __pfx____sys_sendmsg+0x10/0x10 [ 187.500942][ T8952] ? futex_wait+0x11e/0x370 [ 187.500981][ T8952] ? find_held_lock+0x2b/0x80 [ 187.501044][ T8952] __sys_sendmsg+0x160/0x210 [ 187.501082][ T8952] ? __pfx___sys_sendmsg+0x10/0x10 [ 187.501137][ T8952] do_syscall_64+0x123/0x790 [ 187.501177][ T8952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.501205][ T8952] RIP: 0033:0x7f184459e159 [ 187.501227][ T8952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.501256][ T8952] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 187.501281][ T8952] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 187.501299][ T8952] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 187.501318][ T8952] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 187.501336][ T8952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 187.501353][ T8952] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 187.501390][ T8952] [ 187.526172][ T8952] syz.4.1064: vmalloc error: size 16777256, align 0x200000, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 187.526392][ T8952] CPU: 0 UID: 0 PID: 8952 Comm: syz.4.1064 Tainted: G L syzkaller #0 PREEMPT(full) [ 187.526423][ T8952] Tainted: [L]=SOFTLOCKUP [ 187.526432][ T8952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 187.526444][ T8952] Call Trace: [ 187.526451][ T8952] [ 187.526459][ T8952] dump_stack_lvl+0x100/0x190 [ 187.526493][ T8952] warn_alloc.cold+0x9e/0xb2 [ 187.526517][ T8952] ? __pfx_warn_alloc+0x10/0x10 [ 187.526545][ T8952] ? lockdep_hardirqs_on+0x7d/0x110 [ 187.526580][ T8952] ? __get_vm_area_node+0x2f0/0x350 [ 187.526614][ T8952] ? __get_vm_area_node+0x22b/0x350 [ 187.526646][ T8952] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 187.526675][ T8952] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 187.526707][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.526732][ T8952] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 187.526763][ T8952] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 187.526793][ T8952] ? rcu_is_watching+0x13/0xc0 [ 187.526827][ T8952] __kvmalloc_node_noprof+0x3da/0x9b0 [ 187.526850][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.526872][ T8952] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 187.526903][ T8952] ? hash_mac_create+0x3e0/0x1080 [ 187.526930][ T8952] hash_mac_create+0x3e0/0x1080 [ 187.526956][ T8952] ? __pfx_hash_mac_create+0x10/0x10 [ 187.526981][ T8952] ip_set_create+0x6c4/0x1510 [ 187.527009][ T8952] ? __pfx_ip_set_create+0x10/0x10 [ 187.527049][ T8952] ? find_held_lock+0x2b/0x80 [ 187.527084][ T8952] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 187.527124][ T8952] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 187.527155][ T8952] ? __lock_acquire+0x5c0/0x1f40 [ 187.527202][ T8952] ? avc_has_perm_noaudit+0x145/0x470 [ 187.527239][ T8952] netlink_rcv_skb+0x159/0x420 [ 187.527262][ T8952] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 187.527292][ T8952] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 187.527329][ T8952] ? ns_capable+0xd2/0xf0 [ 187.527352][ T8952] nfnetlink_rcv+0x1b3/0x440 [ 187.527381][ T8952] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 187.527409][ T8952] ? netlink_deliver_tap+0x1ae/0xcc0 [ 187.527437][ T8952] netlink_unicast+0x585/0x850 [ 187.527465][ T8952] ? __pfx_netlink_unicast+0x10/0x10 [ 187.527496][ T8952] netlink_sendmsg+0x8b0/0xda0 [ 187.527525][ T8952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.527557][ T8952] ? selinux_socket_sendmsg+0x198/0x2f0 [ 187.527586][ T8952] ____sys_sendmsg+0xa4d/0xbe0 [ 187.527616][ T8952] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.527642][ T8952] ? __pfx_____sys_sendmsg+0x10/0x10 [ 187.527686][ T8952] ___sys_sendmsg+0x190/0x1e0 [ 187.527708][ T8952] ? __pfx____sys_sendmsg+0x10/0x10 [ 187.527729][ T8952] ? futex_wait+0x11e/0x370 [ 187.527760][ T8952] ? find_held_lock+0x2b/0x80 [ 187.527806][ T8952] __sys_sendmsg+0x160/0x210 [ 187.527832][ T8952] ? __pfx___sys_sendmsg+0x10/0x10 [ 187.527874][ T8952] do_syscall_64+0x123/0x790 [ 187.527907][ T8952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.527927][ T8952] RIP: 0033:0x7f184459e159 [ 187.527943][ T8952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.527961][ T8952] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 187.527979][ T8952] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 187.527993][ T8952] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 187.528005][ T8952] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 187.528018][ T8952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 187.528031][ T8952] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 187.528059][ T8952] [ 187.540425][ T8952] Mem-Info: [ 187.540440][ T8952] active_anon:48485 inactive_anon:72 isolated_anon:0 [ 187.540440][ T8952] active_file:170 inactive_file:60075 isolated_file:0 [ 187.540440][ T8952] unevictable:0 dirty:527 writeback:50 [ 187.540440][ T8952] slab_reclaimable:11968 slab_unreclaimable:100230 [ 187.540440][ T8952] mapped:48785 shmem:38039 pagetables:1734 [ 187.540440][ T8952] sec_pagetables:0 bounce:0 [ 187.540440][ T8952] kernel_misc_reclaimable:0 [ 187.540440][ T8952] free:1228359 free_pcp:24759 free_cma:0 [ 187.540497][ T8952] Node 0 active_anon:193940kB inactive_anon:288kB active_file:680kB inactive_file:239984kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:195020kB dirty:2100kB writeback:200kB shmem:152156kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14220kB pagetables:6796kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 187.540558][ T8952] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:316kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:120kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 187.540634][ T8952] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 187.540694][ T8952] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 187.540729][ T8952] Node 0 DMA32 free:963984kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:193940kB inactive_anon:288kB active_file:680kB inactive_file:239984kB unevictable:0kB writepending:2200kB zspages:2352kB present:3129332kB managed:2530468kB mlocked:0kB bounce:0kB free_pcp:99036kB local_pcp:25292kB free_cma:0kB [ 187.540976][ T8952] lowmem_reserve[]: 0 0 0 0 0 [ 187.541012][ T8952] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:68kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 187.541067][ T8952] lowmem_reserve[]: 0 0 0 0 0 [ 187.541099][ T8952] Node 1 Normal free:3934092kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:316kB unevictable:0kB writepending:8kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 187.541154][ T8952] lowmem_reserve[]: 0 0 0 0 0 [ 187.541186][ T8952] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 187.541297][ T8952] Node 0 DMA32: 335*4kB (UE) 104*8kB (UE) 17*16kB (UM) 0*32kB 2*64kB (UM) 1*128kB (M) 1*256kB (M) 1*512kB (U) 32*1024kB (UM) 15*2048kB (UM) 219*4096kB (M) = 963980kB [ 187.541445][ T8952] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 187.541546][ T8952] Node 1 Normal: 1*4kB (M) 3*8kB (U) 5*16kB (U) 3*32kB (U) 3*64kB (U) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 3*2048kB (U) 958*4096kB (M) = 3934092kB [ 187.541703][ T8952] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 187.541718][ T8952] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 187.541734][ T8952] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 187.541749][ T8952] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 187.541764][ T8952] 98363 total pagecache pages [ 187.541771][ T8952] 83 pages in swap cache [ 187.541777][ T8952] Free swap = 81972kB [ 187.541784][ T8952] Total swap = 124996kB [ 187.541791][ T8952] 2097051 pages RAM [ 187.541798][ T8952] 0 pages HighMem/MovableOnly [ 187.541804][ T8952] 432801 pages reserved [ 187.541811][ T8952] 0 pages cma reserved [ 188.701869][ T8967] netlink: 'syz.7.1070': attribute type 1 has an invalid length. [ 188.876921][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.876983][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.413670][ T8984] dvmrp0: entered allmulticast mode [ 189.593160][ T8988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1078'. [ 189.741135][ T8992] FAULT_INJECTION: forcing a failure. [ 189.741135][ T8992] name failslab, interval 1, probability 0, space 0, times 0 [ 189.741170][ T8992] CPU: 1 UID: 0 PID: 8992 Comm: syz.0.1080 Tainted: G L syzkaller #0 PREEMPT(full) [ 189.741200][ T8992] Tainted: [L]=SOFTLOCKUP [ 189.741208][ T8992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 189.741220][ T8992] Call Trace: [ 189.741226][ T8992] [ 189.741235][ T8992] dump_stack_lvl+0x100/0x190 [ 189.741271][ T8992] should_fail_ex.cold+0x5/0xa [ 189.741301][ T8992] should_failslab+0xc2/0x120 [ 189.741328][ T8992] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 189.741355][ T8992] ? kstrdup_const+0x63/0x80 [ 189.741381][ T8992] kstrdup+0x51/0xe0 [ 189.741401][ T8992] kstrdup_const+0x63/0x80 [ 189.741429][ T8992] __kernfs_new_node+0x9b/0xa10 [ 189.741467][ T8992] ? __pfx___kernfs_new_node+0x10/0x10 [ 189.741504][ T8992] ? lock_acquire+0x1d1/0x380 [ 189.741527][ T8992] ? kernfs_root+0x23/0x2a0 [ 189.741555][ T8992] ? find_held_lock+0x2b/0x80 [ 189.741582][ T8992] ? kernfs_root+0xee/0x2a0 [ 189.741608][ T8992] ? kernfs_root+0xee/0x2a0 [ 189.741643][ T8992] kernfs_new_node+0x117/0x150 [ 189.741678][ T8992] kernfs_create_link+0xcc/0x240 [ 189.741707][ T8992] sysfs_do_create_link_sd+0x90/0x140 [ 189.741733][ T8992] sysfs_create_link+0x61/0xc0 [ 189.741754][ T8992] device_add+0xb62/0x1970 [ 189.741778][ T8992] ? __pfx_device_add+0x10/0x10 [ 189.741798][ T8992] ? kfree_const+0x5a/0x70 [ 189.741811][ T8992] ? kfree+0x1e5/0x6d0 [ 189.741840][ T8992] device_create_groups_vargs+0x1f8/0x270 [ 189.741866][ T8992] device_create+0xed/0x130 [ 189.741889][ T8992] ? __pfx_device_create+0x10/0x10 [ 189.741912][ T8992] ? is_console_locked+0x9/0x20 [ 189.741928][ T8992] ? con_is_visible+0x65/0x150 [ 189.741952][ T8992] ? csi_J+0x57e/0xad0 [ 189.741974][ T8992] vcs_make_sysfs+0x32/0x80 [ 189.741989][ T8992] vc_allocate+0x539/0x880 [ 189.742008][ T8992] ? __pfx_vc_allocate+0x10/0x10 [ 189.742032][ T8992] con_install+0xa1/0x620 [ 189.742052][ T8992] ? __pfx_con_install+0x10/0x10 [ 189.742075][ T8992] ? __pfx_con_install+0x10/0x10 [ 189.742093][ T8992] tty_init_dev.part.0+0x9e/0x470 [ 189.742116][ T8992] tty_open+0x953/0xe20 [ 189.742140][ T8992] ? __pfx_tty_open+0x10/0x10 [ 189.742158][ T8992] ? chrdev_open+0x589/0x6a0 [ 189.742176][ T8992] ? chrdev_open+0x589/0x6a0 [ 189.742198][ T8992] ? __pfx_tty_open+0x10/0x10 [ 189.742218][ T8992] chrdev_open+0x234/0x6a0 [ 189.742237][ T8992] ? __pfx_chrdev_open+0x10/0x10 [ 189.742258][ T8992] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 189.742287][ T8992] do_dentry_open+0x6ab/0x14d0 [ 189.742307][ T8992] ? __pfx_chrdev_open+0x10/0x10 [ 189.742337][ T8992] vfs_open+0x82/0x3f0 [ 189.742367][ T8992] path_openat+0x19fa/0x2440 [ 189.742398][ T8992] ? __pfx_path_openat+0x10/0x10 [ 189.742441][ T8992] do_file_open+0x20e/0x430 [ 189.742473][ T8992] ? __pfx_do_file_open+0x10/0x10 [ 189.742522][ T8992] ? _raw_spin_unlock+0x28/0x50 [ 189.742550][ T8992] ? alloc_fd+0x471/0x7a0 [ 189.742587][ T8992] do_sys_openat2+0x10f/0x1e0 [ 189.742615][ T8992] ? __pfx_do_sys_openat2+0x10/0x10 [ 189.742644][ T8992] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 189.742684][ T8992] __x64_sys_openat+0x12d/0x210 [ 189.742712][ T8992] ? __pfx___x64_sys_openat+0x10/0x10 [ 189.742753][ T8992] do_syscall_64+0x123/0x790 [ 189.742785][ T8992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.742806][ T8992] RIP: 0033:0x7eff3535e98e [ 189.742824][ T8992] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 189.742842][ T8992] RSP: 002b:00007eff362feb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 189.742875][ T8992] RAX: ffffffffffffffda RBX: 00007eff362ff6c0 RCX: 00007eff3535e98e [ 189.742889][ T8992] RDX: 0000000000000002 RSI: 00007eff362fec00 RDI: ffffffffffffff9c [ 189.742903][ T8992] RBP: 00007eff3543506b R08: 0000000000000000 R09: 0000000000000000 [ 189.742916][ T8992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 189.742928][ T8992] R13: 00007eff35626038 R14: 00007eff35625fa0 R15: 00007ffe58a7cd58 [ 189.742959][ T8992] [ 189.957538][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 189.957554][ T30] audit: type=1400 audit(1790288509.743:973): avc: denied { mount } for pid=8994 comm="syz.7.1079" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 190.323281][ T30] audit: type=1400 audit(1790288510.113:974): avc: denied { setopt } for pid=9000 comm="syz.0.1082" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 190.662414][ T9016] FAULT_INJECTION: forcing a failure. [ 190.662414][ T9016] name failslab, interval 1, probability 0, space 0, times 0 [ 190.662446][ T9016] CPU: 0 UID: 0 PID: 9016 Comm: syz.4.1086 Tainted: G L syzkaller #0 PREEMPT(full) [ 190.662475][ T9016] Tainted: [L]=SOFTLOCKUP [ 190.662482][ T9016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 190.662495][ T9016] Call Trace: [ 190.662503][ T9016] [ 190.662510][ T9016] dump_stack_lvl+0x100/0x190 [ 190.662545][ T9016] should_fail_ex.cold+0x5/0xa [ 190.662575][ T9016] should_failslab+0xc2/0x120 [ 190.662602][ T9016] __kmalloc_noprof+0xfc/0x840 [ 190.662626][ T9016] ? __vb2_queue_alloc+0x23e/0x1160 [ 190.662660][ T9016] __vb2_queue_alloc+0x23e/0x1160 [ 190.662700][ T9016] vb2_core_reqbufs+0x899/0xf30 [ 190.662729][ T9016] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 190.662755][ T9016] ? trace_contention_end+0x126/0x160 [ 190.662781][ T9016] ? __mutex_lock+0x26c/0x1bd0 [ 190.662830][ T9016] ? __video_do_ioctl+0x50f/0xdf0 [ 190.662873][ T9016] vb2_ioctl_reqbufs+0x291/0x450 [ 190.662897][ T9016] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 190.662928][ T9016] vidioc_reqbufs+0x86/0x100 [ 190.662957][ T9016] v4l_reqbufs+0x175/0x1d0 [ 190.662985][ T9016] __video_do_ioctl+0xb2a/0xdf0 [ 190.663018][ T9016] ? __might_fault+0xc5/0x140 [ 190.663047][ T9016] ? __pfx___video_do_ioctl+0x10/0x10 [ 190.663087][ T9016] video_usercopy+0x47a/0x1730 [ 190.663118][ T9016] ? __pfx___video_do_ioctl+0x10/0x10 [ 190.663149][ T9016] ? __pfx_video_usercopy+0x10/0x10 [ 190.663198][ T9016] v4l2_ioctl+0x1bd/0x250 [ 190.663226][ T9016] ? __pfx_v4l2_ioctl+0x10/0x10 [ 190.663256][ T9016] __x64_sys_ioctl+0x18e/0x210 [ 190.663280][ T9016] do_syscall_64+0x123/0x790 [ 190.663312][ T9016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.663333][ T9016] RIP: 0033:0x7f184459e159 [ 190.663350][ T9016] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 190.663370][ T9016] RSP: 002b:00007f18453a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 190.663391][ T9016] RAX: ffffffffffffffda RBX: 00007f1844825fa0 RCX: 00007f184459e159 [ 190.663405][ T9016] RDX: 0000200000000200 RSI: 00000000c0145608 RDI: 0000000000000004 [ 190.663418][ T9016] RBP: 00007f184463506b R08: 0000000000000000 R09: 0000000000000000 [ 190.663429][ T9016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 190.663440][ T9016] R13: 00007f1844826038 R14: 00007f1844825fa0 R15: 00007ffcd965b468 [ 190.663469][ T9016] [ 190.798725][ T30] audit: type=1400 audit(1790288510.573:975): avc: denied { write } for pid=8999 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 191.109325][ T30] audit: type=1400 audit(1790288510.903:976): avc: denied { write } for pid=9027 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 191.206133][ T5708] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 191.286259][ T5723] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 191.391100][ T5708] usb 8-1: Using ep0 maxpacket: 8 [ 191.434386][ T5723] usb 6-1: Using ep0 maxpacket: 8 [ 191.435933][ T5723] usb 6-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 191.438599][ T5723] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 191.438660][ T5723] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 191.438707][ T5723] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 191.438735][ T5723] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 191.462001][ T5723] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.462024][ T5723] usb 6-1: Product: syz [ 191.462038][ T5723] usb 6-1: Manufacturer: syz [ 191.462073][ T5723] usb 6-1: SerialNumber: syz [ 191.483001][ T5723] usb 6-1: config 0 descriptor?? [ 191.484952][ T9026] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 191.598972][ T9023] gtp0: entered promiscuous mode [ 191.598992][ T9023] gtp0: entered allmulticast mode [ 191.751478][ T5723] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 191.767581][ T5723] input: Griffin SoundKnob as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input22 [ 191.842182][ T9043] syzkaller1: entered promiscuous mode [ 191.842206][ T9043] syzkaller1: entered allmulticast mode [ 192.066339][ T5708] usb 8-1: unable to get BOS descriptor or descriptor too short [ 192.066380][ T5708] usb 8-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 0.40 [ 192.069500][ T5708] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 192.069533][ T5708] usb 8-1: can't read configurations, error -71 [ 192.165716][ C0] powermate: config urb returned -71 [ 192.167411][ C0] powermate: config urb returned -71 [ 192.167689][ C0] powermate: config urb returned -71 [ 192.167887][ C0] powermate: config urb returned -71 [ 192.175832][ T5723] usb 6-1: USB disconnect, device number 6 [ 192.175941][ C0] powermate 6-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 192.418450][ T30] audit: type=1400 audit(1790288512.213:977): avc: denied { write } for pid=9034 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.717997][ T30] audit: type=1400 audit(1790288512.513:978): avc: denied { write } for pid=9064 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.750272][ T9068] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1099'. [ 192.862029][ T9068] team1: entered promiscuous mode [ 192.862050][ T9068] team1: entered allmulticast mode [ 192.913904][ T25] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 193.067675][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 193.080421][ T25] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 193.081379][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.081431][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.081454][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 193.081493][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.137388][ T25] usb 3-1: config 0 descriptor?? [ 193.515243][ T9096] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1105'. [ 193.518627][ T9] libceph: connect (1)[c::]:6789 error -101 [ 193.521987][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 193.582717][ T9] libceph: connect (1)[c::]:6789 error -101 [ 193.582878][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 193.618062][ T25] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.000C/input/input23 [ 193.681570][ T30] audit: type=1400 audit(1790288513.473:979): avc: denied { write } for pid=9076 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.719954][ T25] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.000C/input/input24 [ 193.785563][ T5708] libceph: connect (1)[c::]:6789 error -101 [ 193.785736][ T5708] libceph: mon0 (1)[c::]:6789 connect error [ 193.845537][ T5708] libceph: connect (1)[c::]:6789 error -101 [ 193.845713][ T5708] libceph: mon0 (1)[c::]:6789 connect error [ 193.883702][ T25] kye 0003:0458:5011.000C: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 193.957801][ T30] audit: type=1400 audit(1790288513.753:980): avc: denied { write } for pid=9106 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.005537][ T7257] cxacru 5-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 194.290886][ T9092] ceph: No mds server is up or the cluster is laggy [ 194.295083][ T5708] libceph: connect (1)[c::]:6789 error -101 [ 194.295247][ T5708] libceph: mon0 (1)[c::]:6789 connect error [ 194.299475][ T9099] ceph: No mds server is up or the cluster is laggy [ 194.333900][ T48] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 194.358877][ T5708] libceph: connect (1)[c::]:6789 error -101 [ 194.359050][ T5708] libceph: mon0 (1)[c::]:6789 connect error [ 194.402744][ T9109] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 194.475144][ T9115] ================================================================== [ 194.475163][ T9115] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 194.475194][ T9115] Read of size 1 at addr ffff888027379920 by task syz.5.1108/9115 [ 194.475210][ T9115] [ 194.475222][ T9115] CPU: 0 UID: 0 PID: 9115 Comm: syz.5.1108 Tainted: G L syzkaller #0 PREEMPT(full) [ 194.475251][ T9115] Tainted: [L]=SOFTLOCKUP [ 194.475259][ T9115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 194.475273][ T9115] Call Trace: [ 194.475279][ T9115] [ 194.475288][ T9115] dump_stack_lvl+0x100/0x190 [ 194.475320][ T9115] print_report+0x13d/0x4b0 [ 194.475350][ T9115] ? __virt_addr_valid+0x239/0x430 [ 194.475374][ T9115] ? string+0x471/0x4d0 [ 194.475400][ T9115] kasan_report+0xdf/0x1c0 [ 194.475429][ T9115] ? string+0x471/0x4d0 [ 194.475457][ T9115] string+0x471/0x4d0 [ 194.475482][ T9115] ? __pfx_string+0x10/0x10 [ 194.475507][ T9115] ? mtree_range_walk+0x72b/0xb70 [ 194.475533][ T9115] ? lock_acquire+0x11c/0x380 [ 194.475555][ T9115] vsnprintf+0x422/0x1300 [ 194.475585][ T9115] ? __pfx_vsnprintf+0x10/0x10 [ 194.475611][ T9115] ? __lock_acquire+0x5c0/0x1f40 [ 194.475635][ T9115] seq_printf+0x1a4/0x250 [ 194.475656][ T9115] ? __pfx_num_to_str+0x10/0x10 [ 194.475684][ T9115] ? __pfx_seq_printf+0x10/0x10 [ 194.475706][ T9115] ? do_raw_spin_lock+0x128/0x260 [ 194.475733][ T9115] ? seq_put_decimal_ull_width+0x1db/0x3a0 [ 194.475763][ T9115] irq_seq_show+0x390/0x8b0 [ 194.475789][ T9115] seq_read_iter+0xbce/0x1270 [ 194.475817][ T9115] proc_reg_read_iter+0x220/0x310 [ 194.475846][ T9115] ? __pfx_proc_reg_read_iter+0x10/0x10 [ 194.475875][ T9115] vfs_read+0x82e/0xb40 [ 194.475896][ T9115] ? __pfx_vfs_read+0x10/0x10 [ 194.475914][ T9115] ? find_held_lock+0x2b/0x80 [ 194.475951][ T9115] ksys_read+0x12a/0x250 [ 194.475971][ T9115] ? __pfx_ksys_read+0x10/0x10 [ 194.475996][ T9115] do_syscall_64+0x123/0x790 [ 194.476026][ T9115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.476054][ T9115] RIP: 0033:0x7ff1fa39e159 [ 194.476071][ T9115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.476092][ T9115] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 194.476114][ T9115] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 194.476129][ T9115] RDX: 0000000000002020 RSI: 00002000000043c0 RDI: 0000000000000005 [ 194.476143][ T9115] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 194.476157][ T9115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 194.476170][ T9115] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 194.476191][ T9115] [ 194.476198][ T9115] [ 194.476202][ T9115] Allocated by task 8887: [ 194.476217][ T9115] kasan_save_stack+0x30/0x50 [ 194.476241][ T9115] kasan_save_track+0x14/0x30 [ 194.476262][ T9115] __kasan_kmalloc+0xaa/0xb0 [ 194.476283][ T9115] __kmalloc_node_noprof+0x342/0x880 [ 194.476302][ T9115] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 194.476328][ T9115] __vmalloc_node_noprof+0xad/0xf0 [ 194.476351][ T9115] __vmalloc_noprof+0xa3/0x120 [ 194.476373][ T9115] bpf_prog_alloc_no_stats+0x59/0x690 [ 194.476397][ T9115] bpf_prog_alloc+0x3b/0x200 [ 194.476416][ T9115] bpf_prog_load+0x49e/0x2a80 [ 194.476439][ T9115] __sys_bpf+0x1f46/0x4a30 [ 194.476455][ T9115] __x64_sys_bpf+0xce/0x140 [ 194.476472][ T9115] do_syscall_64+0x123/0x790 [ 194.476498][ T9115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.476517][ T9115] [ 194.476521][ T9115] Freed by task 5748: [ 194.476529][ T9115] kasan_save_stack+0x30/0x50 [ 194.476549][ T9115] kasan_save_track+0x14/0x30 [ 194.476569][ T9115] kasan_save_free_info+0x3b/0x70 [ 194.476596][ T9115] __kasan_slab_free+0x5f/0x80 [ 194.476615][ T9115] kfree+0x22b/0x6d0 [ 194.476639][ T9115] vfree+0x11d/0x6d0 [ 194.476659][ T9115] bpf_prog_free_deferred+0x53e/0x700 [ 194.476684][ T9115] process_one_work+0xac7/0x1b10 [ 194.476710][ T9115] worker_thread+0x5ef/0xe50 [ 194.476736][ T9115] kthread+0x373/0x450 [ 194.476759][ T9115] ret_from_fork+0x730/0xd60 [ 194.476779][ T9115] ret_from_fork_asm+0x1a/0x30 [ 194.476797][ T9115] [ 194.476801][ T9115] The buggy address belongs to the object at ffff888027379920 [ 194.476801][ T9115] which belongs to the cache kmalloc-8 of size 8 [ 194.476815][ T9115] The buggy address is located 0 bytes inside of [ 194.476815][ T9115] freed 8-byte region [ffff888027379920, ffff888027379928) [ 194.476833][ T9115] [ 194.476843][ T9115] The buggy address belongs to the physical page: [ 194.476852][ T9115] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027379920 pfn:0x27379 [ 194.476870][ T9115] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 194.476888][ T9115] page_type: f5(slab) [ 194.476905][ T9115] raw: 00fff00000000200 ffff88801c034500 ffffea0001f71d90 ffffea0000d9b290 [ 194.476927][ T9115] raw: ffff888027379920 0000000000800079 00000000f5000000 0000000000000000 [ 194.476938][ T9115] page dumped because: kasan: bad access detected [ 194.476950][ T9115] page_owner tracks the page as allocated [ 194.476957][ T9115] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4221862754 [ 194.476986][ T9115] post_alloc_hook+0xfd/0x120 [ 194.477015][ T9115] get_page_from_freelist+0x110d/0x35d0 [ 194.477033][ T9115] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 194.477058][ T9115] new_slab+0xa9/0x6e0 [ 194.477073][ T9115] refill_objects+0xe3/0x410 [ 194.477089][ T9115] __pcs_replace_empty_main+0x35e/0x650 [ 194.477119][ T9115] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 194.477142][ T9115] kstrdup+0x51/0xe0 [ 194.477156][ T9115] kstrdup_const+0x63/0x80 [ 194.477171][ T9115] kvasprintf_const+0x10f/0x1a0 [ 194.477192][ T9115] kobject_set_name_vargs+0x5a/0x140 [ 194.477214][ T9115] dev_set_name+0xc7/0x100 [ 194.477230][ T9115] tty_register_device_attr+0x2fb/0x7f0 [ 194.477251][ T9115] tty_register_driver+0x769/0xb50 [ 194.477271][ T9115] pty_init+0x65d/0xdc0 [ 194.477295][ T9115] do_one_initcall+0x11c/0x6f0 [ 194.477315][ T9115] page_owner free stack trace missing [ 194.477321][ T9115] [ 194.477326][ T9115] Memory state around the buggy address: [ 194.477334][ T9115] ffff888027379800: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 194.477347][ T9115] ffff888027379880: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 194.477361][ T9115] >ffff888027379900: fa fc fc fc fa fc fc fc 05 fc fc fc fa fc fc fc [ 194.477371][ T9115] ^ [ 194.477380][ T9115] ffff888027379980: 00 fc fc fc 05 fc fc fc 00 fc fc fc fa fc fc fc [ 194.477393][ T9115] ffff888027379a00: fa fc fc fc 04 fc fc fc 00 fc fc fc 00 fc fc fc [ 194.477403][ T9115] ================================================================== [ 194.477417][ T9115] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 195.140984][ T9115] CPU: 0 UID: 0 PID: 9115 Comm: syz.5.1108 Tainted: G L syzkaller #0 PREEMPT(full) [ 195.151822][ T9115] Tainted: [L]=SOFTLOCKUP [ 195.156126][ T9115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 195.166164][ T9115] Call Trace: [ 195.169425][ T9115] [ 195.172335][ T9115] dump_stack_lvl+0x100/0x190 [ 195.177010][ T9115] vpanic+0x553/0x970 [ 195.180973][ T9115] ? __pfx_vpanic+0x10/0x10 [ 195.185457][ T9115] ? __pfx_vprintk_emit+0x10/0x10 [ 195.190479][ T9115] ? string+0x471/0x4d0 [ 195.194626][ T9115] panic+0xd1/0xe0 [ 195.198331][ T9115] ? __pfx_panic+0x10/0x10 [ 195.202735][ T9115] ? end_report.part.0+0x23/0x90 [ 195.207693][ T9115] ? rcu_is_watching+0x13/0xc0 [ 195.212448][ T9115] ? end_report.part.0+0x23/0x90 [ 195.217392][ T9115] check_panic_on_warn.cold+0x19/0x34 [ 195.222748][ T9115] end_report.part.0+0x3a/0x90 [ 195.227505][ T9115] kasan_report.cold+0xe/0x18 [ 195.232174][ T9115] ? string+0x471/0x4d0 [ 195.236319][ T9115] string+0x471/0x4d0 [ 195.240288][ T9115] ? __pfx_string+0x10/0x10 [ 195.244777][ T9115] ? mtree_range_walk+0x72b/0xb70 [ 195.249787][ T9115] ? lock_acquire+0x11c/0x380 [ 195.254447][ T9115] vsnprintf+0x422/0x1300 [ 195.258768][ T9115] ? __pfx_vsnprintf+0x10/0x10 [ 195.263517][ T9115] ? __lock_acquire+0x5c0/0x1f40 [ 195.268445][ T9115] seq_printf+0x1a4/0x250 [ 195.272772][ T9115] ? __pfx_num_to_str+0x10/0x10 [ 195.277616][ T9115] ? __pfx_seq_printf+0x10/0x10 [ 195.282452][ T9115] ? do_raw_spin_lock+0x128/0x260 [ 195.287482][ T9115] ? seq_put_decimal_ull_width+0x1db/0x3a0 [ 195.293283][ T9115] irq_seq_show+0x390/0x8b0 [ 195.297776][ T9115] seq_read_iter+0xbce/0x1270 [ 195.302444][ T9115] proc_reg_read_iter+0x220/0x310 [ 195.307478][ T9115] ? __pfx_proc_reg_read_iter+0x10/0x10 [ 195.313021][ T9115] vfs_read+0x82e/0xb40 [ 195.317161][ T9115] ? __pfx_vfs_read+0x10/0x10 [ 195.321821][ T9115] ? find_held_lock+0x2b/0x80 [ 195.326498][ T9115] ksys_read+0x12a/0x250 [ 195.330720][ T9115] ? __pfx_ksys_read+0x10/0x10 [ 195.335468][ T9115] do_syscall_64+0x123/0x790 [ 195.340056][ T9115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.345929][ T9115] RIP: 0033:0x7ff1fa39e159 [ 195.350330][ T9115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.369931][ T9115] RSP: 002b:00007ff1fb25c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 195.378326][ T9115] RAX: ffffffffffffffda RBX: 00007ff1fa625fa0 RCX: 00007ff1fa39e159 [ 195.386283][ T9115] RDX: 0000000000002020 RSI: 00002000000043c0 RDI: 0000000000000005 [ 195.394238][ T9115] RBP: 00007ff1fa43506b R08: 0000000000000000 R09: 0000000000000000 [ 195.402193][ T9115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 195.410148][ T9115] R13: 00007ff1fa626038 R14: 00007ff1fa625fa0 R15: 00007ffc587e1438 [ 195.418113][ T9115] [ 195.421337][ T9115] Kernel Offset: disabled [ 195.425644][ T9115] Rebooting in 86400 seconds..