last executing test programs: 1.244099466s ago: executing program 3 (id=4756): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) mincore(&(0x7f0000001000/0x4000)=nil, 0x4000, &(0x7f0000000080)=""/60) 1.161528844s ago: executing program 3 (id=4761): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, 0x0, 0x0, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) socket$inet6(0xa, 0x2, 0x0) 1.110405119s ago: executing program 3 (id=4766): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r2) ptrace(0x4207, r2) ptrace(0x4208, r2) 1.026620807s ago: executing program 3 (id=4769): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) 978.998442ms ago: executing program 3 (id=4771): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd, 0x0, 0xfffff05b}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) 901.12294ms ago: executing program 3 (id=4772): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x304}, "fc674d000000f8f7", "c5689d28d97200", "2c71e7c6", "a0ca05c0707e52f4"}, 0x28) splice(r3, 0x0, r2, 0x0, 0x10000008ebc, 0x0) 646.649475ms ago: executing program 0 (id=4787): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) close_range(r0, 0xffffffffffffffff, 0x2) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r3, @ANYRES64=r2], 0x118) ioctl$KVM_X86_SETUP_MCE(r3, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x120020, 0x0) 617.009398ms ago: executing program 0 (id=4789): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r4, 0x0) socket$unix(0x1, 0x3, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r6, @ANYRES64=r5], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r6, 0x0) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r5, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 494.101001ms ago: executing program 0 (id=4800): ioctl$F2FS_IOC_SET_COMPRESS_OPTION(0xffffffffffffffff, 0x4002f516, &(0x7f00000001c0)={0xf, 0x81}) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x4]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc810}, 0x20000040) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r6, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) setsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0x7, 0x0, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r4, 0x10, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 366.928563ms ago: executing program 1 (id=4806): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) write(r0, 0x0, 0x0) 335.287357ms ago: executing program 0 (id=4808): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd, 0x0, 0xfffff05b}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) 326.044758ms ago: executing program 1 (id=4809): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00), 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) 308.551499ms ago: executing program 1 (id=4811): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) 253.174825ms ago: executing program 0 (id=4812): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(0xffffffffffffffff, 0x50009417, 0x0) 252.998335ms ago: executing program 4 (id=4813): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) 223.809788ms ago: executing program 1 (id=4814): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, r4, 0x1, 0x70bd2b, 0x25dfdbfc}, 0x14}}, 0x4000004) 220.179358ms ago: executing program 4 (id=4815): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f00000002c0)=0xffff, 0x4) 192.994821ms ago: executing program 2 (id=4816): rt_sigaction(0xd, 0x0, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x0, 0x0) 169.007763ms ago: executing program 4 (id=4817): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_PHYS(r2, 0x4008556c, 0x0) 168.694993ms ago: executing program 1 (id=4818): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) 160.293664ms ago: executing program 2 (id=4819): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x1d0, r3, 0x1, 0x70bd29, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x1a8, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}, {0x128, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x7, @private0, 0x157}}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "105850071e2ab631bd00cf795354cb2c626d8b5be606d39cd0bd2ce6ebd06eb3"}, @WGPEER_A_ALLOWEDIPS={0xbc, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3b}}, {0x5, 0x3, 0x1}}]}, {0x4}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x2}}]}, {0x70, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24}]}, {0x54, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "d454d5dd835fff58334762251fb458c0abd16089d30d58ca66a1769b8a83772c"}, @WGPEER_A_FLAGS={0x8, 0x3, 0x2}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}]}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x4004840}, 0x44000) 140.644366ms ago: executing program 4 (id=4820): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) rt_sigtimedwait(&(0x7f0000000080)={[0x2]}, 0x0, 0x0, 0x8) 128.729747ms ago: executing program 2 (id=4821): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000000)=0x8, 0x0) 115.274029ms ago: executing program 0 (id=4822): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) splice(r3, 0x0, r2, 0x0, 0x10000008ebc, 0x0) 115.035599ms ago: executing program 1 (id=4823): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 53.154865ms ago: executing program 4 (id=4824): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) syz_clone3(&(0x7f0000000340)={0x200000000, 0x0, 0x0, 0x0, {0x3a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0x58) 52.872095ms ago: executing program 2 (id=4825): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) 47.550766ms ago: executing program 4 (id=4826): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xd4000005, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f0000000180)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 37.817597ms ago: executing program 2 (id=4827): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x1010040, 0x0) 0s ago: executing program 2 (id=4828): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.207' (ED25519) to the list of known hosts. [ 18.415014][ T28] audit: type=1400 audit(1763061433.483:64): avc: denied { mounton } for pid=276 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.416044][ T276] cgroup: Unknown subsys name 'net' [ 18.418062][ T28] audit: type=1400 audit(1763061433.483:65): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.421713][ T28] audit: type=1400 audit(1763061433.493:66): avc: denied { unmount } for pid=276 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.421839][ T276] cgroup: Unknown subsys name 'devices' [ 18.540720][ T276] cgroup: Unknown subsys name 'hugetlb' [ 18.546313][ T276] cgroup: Unknown subsys name 'rlimit' [ 18.647940][ T28] audit: type=1400 audit(1763061433.713:67): avc: denied { setattr } for pid=276 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.671178][ T28] audit: type=1400 audit(1763061433.713:68): avc: denied { mounton } for pid=276 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 18.693703][ T278] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 18.696003][ T28] audit: type=1400 audit(1763061433.713:69): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 18.727492][ T28] audit: type=1400 audit(1763061433.773:70): avc: denied { relabelto } for pid=278 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.743764][ T276] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 18.753194][ T28] audit: type=1400 audit(1763061433.773:71): avc: denied { write } for pid=278 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.787048][ T28] audit: type=1400 audit(1763061433.803:72): avc: denied { read } for pid=276 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.812526][ T28] audit: type=1400 audit(1763061433.803:73): avc: denied { open } for pid=276 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.166132][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.173226][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.180596][ T284] device bridge_slave_0 entered promiscuous mode [ 20.187392][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.194642][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.202051][ T284] device bridge_slave_1 entered promiscuous mode [ 20.240913][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.247952][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.255367][ T285] device bridge_slave_0 entered promiscuous mode [ 20.278578][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.285642][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.292997][ T285] device bridge_slave_1 entered promiscuous mode [ 20.343904][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.350982][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.358364][ T286] device bridge_slave_0 entered promiscuous mode [ 20.365282][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.372352][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.379701][ T286] device bridge_slave_1 entered promiscuous mode [ 20.440825][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.447869][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.455220][ T287] device bridge_slave_0 entered promiscuous mode [ 20.471178][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.478203][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.485579][ T287] device bridge_slave_1 entered promiscuous mode [ 20.512276][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.519339][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.526569][ T290] device bridge_slave_0 entered promiscuous mode [ 20.534710][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.541780][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.549136][ T290] device bridge_slave_1 entered promiscuous mode [ 20.642164][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.649207][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.656648][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.663683][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.702521][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.709571][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.716817][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.723857][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.760713][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.767734][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.774962][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.781974][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.803985][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.811024][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.818357][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.825405][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.837717][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.844835][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.852094][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.859119][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.875841][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.883548][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.890851][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.897989][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.905599][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.913106][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.920425][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.927503][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.934707][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.941844][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.949966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.957343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.984168][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.991728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.999338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.007420][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.014441][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.021837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.030450][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.037446][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.053382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.061250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.069248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.077395][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.085989][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.093031][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.101555][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.109967][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.116975][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.126470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.134657][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.141687][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.178153][ T287] device veth0_vlan entered promiscuous mode [ 21.185340][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.193896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.202074][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.209483][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.216817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.225124][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.232150][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.239535][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.247620][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.254643][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.262063][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.270039][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.277879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.285887][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.293808][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.302169][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.309187][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.316460][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.323970][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.331389][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.339590][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.347638][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.354655][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.362160][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.370530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.378588][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.385603][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.392974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.400968][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.419679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.427753][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.435802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.443831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.452266][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.472051][ T284] device veth0_vlan entered promiscuous mode [ 21.482090][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.490704][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.498488][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.506572][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.514089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.530341][ T287] device veth1_macvtap entered promiscuous mode [ 21.541469][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.550009][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.558633][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.566991][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.575394][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.583459][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.591393][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.599319][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.607157][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.615421][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.623620][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.631057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.638481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.645985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.654649][ T285] device veth0_vlan entered promiscuous mode [ 21.662165][ T284] device veth1_macvtap entered promiscuous mode [ 21.670370][ T286] device veth0_vlan entered promiscuous mode [ 21.676812][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.684556][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.696625][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.704796][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.718315][ T290] device veth0_vlan entered promiscuous mode [ 21.725250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.733279][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.740835][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.748162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.757051][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.765368][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.773654][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.784350][ T285] device veth1_macvtap entered promiscuous mode [ 21.793444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.801216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.809556][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.818685][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.827573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.850095][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.858411][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.858692][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 21.871245][ T286] device veth1_macvtap entered promiscuous mode [ 21.887798][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.896692][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.904846][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.912837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.921149][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.929413][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.938456][ T290] device veth1_macvtap entered promiscuous mode [ 21.954517][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.977920][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.031260][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.054700][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.063755][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.073065][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.082292][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.090687][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.480860][ T390] overlayfs: missing 'lowerdir' [ 23.039733][ T414] overlayfs: missing 'lowerdir' [ 23.079232][ T345] syz.0.7 (345) used greatest stack depth: 22560 bytes left [ 23.444212][ T436] overlayfs: missing 'lowerdir' [ 23.730911][ T466] overlayfs: missing 'workdir' [ 24.034483][ T492] overlayfs: missing 'workdir' [ 24.312124][ T445] syz.4.55 (445) used greatest stack depth: 22528 bytes left [ 24.388104][ T510] overlayfs: missing 'workdir' [ 25.090976][ T540] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 25.138987][ T540] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 25.198972][ T540] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 25.566547][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 25.566561][ T28] audit: type=1400 audit(1763061440.633:110): avc: denied { create } for pid=557 comm="syz.0.112" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.640445][ T564] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 25.655582][ T28] audit: type=1400 audit(1763061440.663:111): avc: denied { ioctl } for pid=557 comm="syz.0.112" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16301 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.689198][ T564] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 25.725262][ T564] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 25.785978][ T28] audit: type=1400 audit(1763061440.853:112): avc: denied { create } for pid=585 comm="syz.0.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.895132][ T602] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 25.908464][ T602] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 25.930126][ T602] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 26.556693][ T730] netlink: 8 bytes leftover after parsing attributes in process `syz.0.193'. [ 26.741184][ T765] overlayfs: failed to resolve './file0': -2 [ 26.763220][ T769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.213'. [ 26.927825][ T798] overlayfs: failed to resolve './file0': -2 [ 27.116836][ T837] overlayfs: failed to resolve './file0': -2 [ 27.239207][ T849] netlink: 8 bytes leftover after parsing attributes in process `syz.4.232'. [ 27.343168][ T868] overlayfs: failed to resolve './file1': -2 [ 27.459065][ T882] netlink: 8 bytes leftover after parsing attributes in process `syz.4.270'. [ 27.537550][ T898] overlayfs: unrecognized mount option "/" or missing value [ 27.572061][ T902] overlayfs: failed to resolve './file1': -2 [ 27.684246][ T919] netlink: 8 bytes leftover after parsing attributes in process `syz.4.286'. [ 27.762053][ T930] overlayfs: failed to resolve './file1': -2 [ 28.203704][ T970] netlink: 8 bytes leftover after parsing attributes in process `syz.2.301'. [ 28.462685][ T28] audit: type=1400 audit(1763061443.533:113): avc: denied { setopt } for pid=996 comm="syz.2.325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.710445][ T1022] overlayfs: unrecognized mount option "/" or missing value [ 29.371201][ T1111] overlayfs: unrecognized mount option "/" or missing value [ 29.615155][ T1146] overlayfs: unrecognized mount option "/" or missing value [ 30.890297][ T1210] overlayfs: missing 'lowerdir' [ 31.982402][ T1238] overlayfs: missing 'lowerdir' [ 33.132099][ T1266] overlayfs: missing 'lowerdir' [ 33.539115][ T1288] overlayfs: unrecognized mount option "/" or missing value [ 34.299629][ T1294] overlayfs: missing 'lowerdir' [ 34.737783][ T1320] overlayfs: missing 'lowerdir' [ 34.910983][ T1328] overlayfs: unrecognized mount option "/" or missing value [ 35.105148][ T1346] overlayfs: missing 'lowerdir' [ 35.504272][ T1354] overlayfs: unrecognized mount option "/" or missing value [ 35.735662][ T1383] overlayfs: unrecognized mount option "/" or missing value [ 36.002103][ T1408] overlayfs: unrecognized mount option "/" or missing value [ 36.305167][ T1441] overlayfs: unrecognized mount option "/" or missing value [ 36.490427][ T1462] overlayfs: missing 'lowerdir' [ 37.256813][ T1500] overlayfs: missing 'lowerdir' [ 37.855421][ T1544] overlayfs: missing 'lowerdir' [ 37.882510][ T1546] overlayfs: unrecognized mount option "/" or missing value [ 38.201120][ T1565] overlayfs: missing 'workdir' [ 38.379834][ T1569] overlayfs: unrecognized mount option "/" or missing value [ 38.531966][ T1590] overlayfs: missing 'workdir' [ 38.627368][ T1602] overlayfs: unrecognized mount option "/" or missing value [ 38.725423][ T1618] overlayfs: missing 'workdir' [ 38.889878][ T1635] overlayfs: unrecognized mount option "/" or missing value [ 39.096766][ T1650] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 39.138986][ T1650] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 39.212662][ T1650] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 39.287071][ T1664] overlayfs: unrecognized mount option "/" or missing value [ 39.489500][ T1683] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 39.508790][ T1683] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 39.538969][ T1683] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 39.577161][ T1689] overlayfs: unrecognized mount option "/" or missing value [ 40.039880][ T1747] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 40.055199][ T1747] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 40.091982][ T1747] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 40.379365][ T1806] overlayfs: unrecognized mount option "/" or missing value [ 40.564667][ T1847] overlayfs: unrecognized mount option "/" or missing value [ 40.745411][ T1878] overlayfs: unrecognized mount option "/" or missing value [ 40.887044][ T28] audit: type=1400 audit(1763061455.953:114): avc: denied { setopt } for pid=1905 comm="syz.1.767" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.966376][ T1916] overlayfs: unrecognized mount option "/" or missing value [ 41.034012][ T1927] overlayfs: failed to resolve './file0': -2 [ 41.227748][ T1954] overlayfs: failed to resolve './file0': -2 [ 41.253345][ T1957] overlayfs: unrecognized mount option "/" or missing value [ 41.636501][ T1981] overlayfs: failed to resolve './file0': -2 [ 41.710102][ T1983] overlayfs: unrecognized mount option "/" or missing value [ 42.037879][ T2003] overlayfs: failed to resolve './file1': -2 [ 42.161796][ T2011] overlayfs: unrecognized mount option "/" or missing value [ 42.359508][ T28] audit: type=1400 audit(1763061457.433:115): avc: denied { read write } for pid=2025 comm="syz.4.826" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 42.389663][ T2026] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 42.429081][ T28] audit: type=1400 audit(1763061457.463:116): avc: denied { ioctl open } for pid=2025 comm="syz.4.826" path="/dev/kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 42.574633][ T2034] overlayfs: failed to resolve './file1': -2 [ 42.763299][ T2042] overlayfs: unrecognized mount option "/" or missing value [ 43.039315][ T2055] overlayfs: failed to resolve './file1': -2 [ 43.228100][ T2067] overlayfs: unrecognized mount option "/" or missing value [ 43.662402][ T2106] overlayfs: unrecognized mount option "/" or missing value [ 44.101027][ T2128] overlayfs: unrecognized mount option "/" or missing value [ 44.532709][ T2156] overlayfs: unrecognized mount option "/" or missing value [ 44.730519][ T2190] overlayfs: unrecognized mount option "/" or missing value [ 45.137403][ T2224] overlayfs: unrecognized mount option "/" or missing value [ 45.465518][ T2243] overlayfs: unrecognized mount option "/" or missing value [ 46.289019][ T2359] overlayfs: missing 'lowerdir' [ 46.705165][ T2382] overlayfs: missing 'lowerdir' [ 46.993862][ T2411] overlayfs: missing 'lowerdir' [ 47.082093][ T28] audit: type=1400 audit(1763061462.153:117): avc: denied { getopt } for pid=2414 comm="syz.3.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.316532][ T2439] overlayfs: missing 'lowerdir' [ 47.590676][ T2464] overlayfs: missing 'lowerdir' [ 47.880822][ T2495] overlayfs: missing 'lowerdir' [ 48.775875][ T2555] overlayfs: unrecognized mount option "/" or missing value [ 49.059531][ T2582] overlayfs: unrecognized mount option "/" or missing value [ 49.230277][ T28] audit: type=1400 audit(1763061464.303:118): avc: denied { write } for pid=2593 comm="syz.1.1093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 49.258380][ T2603] overlayfs: missing 'lowerdir' [ 49.360162][ T2610] overlayfs: unrecognized mount option "/" or missing value [ 49.625358][ T2628] overlayfs: missing 'lowerdir' [ 49.823056][ T2651] overlayfs: missing 'lowerdir' [ 49.925937][ T2666] overlayfs: unrecognized mount option "/" or missing value [ 50.022580][ T2678] overlayfs: missing 'workdir' [ 50.110706][ T2694] overlayfs: unrecognized mount option "/" or missing value [ 50.312532][ T2711] overlayfs: missing 'workdir' [ 50.449349][ T2724] overlayfs: unrecognized mount option "/" or missing value [ 50.661872][ T2736] overlayfs: missing 'workdir' [ 50.991004][ T2747] overlayfs: unrecognized mount option "/" or missing value [ 51.060617][ T2761] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 51.085587][ T2761] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 51.105954][ T2761] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 51.250221][ T2779] overlayfs: unrecognized mount option "/" or missing value [ 51.360293][ T2789] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 51.388976][ T2789] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 51.424535][ T2789] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 51.520242][ T2802] overlayfs: unrecognized mount option "/" or missing value [ 51.802133][ T2823] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 51.839123][ T2823] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 51.871228][ T2823] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 51.949863][ T2828] overlayfs: unrecognized mount option "/" or missing value [ 52.192154][ T2856] overlayfs: unrecognized mount option "/" or missing value [ 52.501841][ T2882] overlayfs: unrecognized mount option "/" or missing value [ 54.659035][ T28] audit: type=1400 audit(1763061469.723:119): avc: denied { name_bind } for pid=3163 comm="syz.4.1365" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 54.720057][ T3176] overlayfs: missing 'lowerdir' [ 54.920817][ T3207] overlayfs: missing 'lowerdir' [ 55.167663][ T3235] overlayfs: missing 'lowerdir' [ 55.417754][ T28] audit: type=1400 audit(1763061470.483:120): avc: denied { create } for pid=3265 comm="syz.3.1415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 56.525680][ T28] audit: type=1400 audit(1763061471.593:121): avc: denied { create } for pid=3334 comm="syz.2.1447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 56.546681][ T3335] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1447'. [ 56.577588][ T28] audit: type=1400 audit(1763061471.613:122): avc: denied { write } for pid=3334 comm="syz.2.1447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 56.630897][ T28] audit: type=1400 audit(1763061471.613:123): avc: denied { nlmsg_write } for pid=3334 comm="syz.2.1447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 57.023346][ T3378] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1468'. [ 57.725011][ T3405] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1483'. [ 59.340886][ T28] audit: type=1400 audit(1763061474.413:124): avc: denied { connect } for pid=3458 comm="syz.1.1506" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 59.388968][ T28] audit: type=1400 audit(1763061474.413:125): avc: denied { write } for pid=3458 comm="syz.1.1506" laddr=fe80::13 lport=60 faddr=fe80::bb fport=19970 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 61.252545][ T28] audit: type=1400 audit(1763061476.323:126): avc: denied { ioctl } for pid=3533 comm="syz.4.1546" path="pid:[4026532468]" dev="nsfs" ino=4026532468 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 61.489023][ T3572] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1562'. [ 61.698804][ T3609] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1581'. [ 61.971111][ T3651] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1600'. [ 64.124873][ T28] audit: type=1400 audit(1763061479.193:127): avc: denied { mounton } for pid=3761 comm="syz.4.1655" path="/243/file0" dev="tmpfs" ino=1618 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 65.488453][ T28] audit: type=1400 audit(1763061480.553:128): avc: denied { mounton } for pid=3844 comm="syz.1.1692" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 66.234362][ T3972] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1755'. [ 66.409255][ T28] audit: type=1400 audit(1763061481.483:129): avc: denied { append } for pid=4004 comm="syz.4.1769" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 66.470173][ T28] audit: type=1400 audit(1763061481.523:130): avc: denied { nlmsg_write } for pid=4011 comm="syz.4.1773" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 66.613875][ T4035] 9pnet_fd: Insufficient options for proto=fd [ 66.726590][ T28] audit: type=1400 audit(1763061481.793:131): avc: denied { setopt } for pid=4046 comm="syz.3.1789" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 67.780105][ T4144] 9pnet_fd: Insufficient options for proto=fd [ 68.069164][ T4152] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1837'. [ 68.280915][ T4167] 9pnet_fd: Insufficient options for proto=fd [ 68.416467][ T4175] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1854'. [ 69.565524][ T4204] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1867'. [ 70.729748][ T4236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1882'. [ 70.824635][ T28] audit: type=1400 audit(1763061485.893:132): avc: denied { mounton } for pid=4243 comm="syz.2.1887" path="/syzcgroup/unified/syz2" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 71.008363][ T4268] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1898'. [ 72.104707][ T4335] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1930'. [ 72.659457][ T4383] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1955'. [ 73.089687][ T4411] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1968'. [ 73.274093][ T4439] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1981'. [ 73.470948][ T4471] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1996'. [ 75.109416][ T28] audit: type=1400 audit(1763061490.183:133): avc: denied { create } for pid=4573 comm="syz.2.2047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 75.143885][ T4577] ======================================================= [ 75.143885][ T4577] WARNING: The mand mount option has been deprecated and [ 75.143885][ T4577] and is ignored by this kernel. Remove the mand [ 75.143885][ T4577] option from the mount to silence this warning. [ 75.143885][ T4577] ======================================================= [ 75.148943][ T28] audit: type=1400 audit(1763061490.193:134): avc: denied { write } for pid=4573 comm="syz.2.2047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 75.303399][ T28] audit: type=1400 audit(1763061490.213:135): avc: denied { remount } for pid=4576 comm="syz.3.2048" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 75.307377][ T4577] binder: Bad value for 'context' [ 75.390480][ T28] audit: type=1400 audit(1763061490.403:136): avc: denied { map } for pid=4590 comm="syz.2.2056" path="socket:[35019]" dev="sockfs" ino=35019 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.472642][ T28] audit: type=1400 audit(1763061490.403:137): avc: denied { read } for pid=4590 comm="syz.2.2056" path="socket:[35019]" dev="sockfs" ino=35019 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.503487][ T4633] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2072'. [ 75.524565][ T4635] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2075'. [ 75.666885][ T4669] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2093'. [ 75.682723][ T4667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2090'. [ 76.220000][ T4788] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2148'. [ 76.336706][ T4808] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2157'. [ 76.419148][ T4816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2161'. [ 78.192616][ T4940] __nla_validate_parse: 3 callbacks suppressed [ 78.192631][ T4940] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2220'. [ 79.909883][ T5067] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2282'. [ 80.905499][ T5150] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2324'. [ 81.247363][ T5181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2337'. [ 81.441592][ T5211] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2351'. [ 81.777091][ T5240] binder: Bad value for 'context' [ 82.468260][ T28] audit: type=1400 audit(1763061497.533:138): avc: denied { read write } for pid=5283 comm="syz.3.2384" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 82.504164][ T28] audit: type=1400 audit(1763061497.533:139): avc: denied { open } for pid=5283 comm="syz.3.2384" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 82.530937][ T28] audit: type=1400 audit(1763061497.533:140): avc: denied { ioctl } for pid=5283 comm="syz.3.2384" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 82.748980][ T19] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 82.940309][ T19] usb 4-1: unable to get BOS descriptor or descriptor too short [ 82.952266][ T19] usb 4-1: config 7 has an invalid interface number: 205 but max is 2 [ 82.973117][ T19] usb 4-1: config 7 has an invalid interface number: 112 but max is 2 [ 82.992591][ T19] usb 4-1: config 7 has an invalid interface number: 81 but max is 2 [ 83.011840][ T19] usb 4-1: config 7 has no interface number 0 [ 83.017957][ T19] usb 4-1: config 7 has no interface number 1 [ 83.033498][ T19] usb 4-1: config 7 has no interface number 2 [ 83.040087][ T19] usb 4-1: config 7 interface 112 has no altsetting 0 [ 83.046941][ T19] usb 4-1: config 7 interface 81 has no altsetting 0 [ 83.060153][ T19] usb 4-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 83.072100][ T19] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.081254][ T19] usb 4-1: Product: syz [ 83.085474][ T19] usb 4-1: Manufacturer: syz [ 83.090519][ T19] usb 4-1: SerialNumber: syz [ 83.293044][ T5299] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2391'. [ 83.305579][ T19] snd-usb-audio: probe of 4-1:7.205 failed with error -2 [ 83.322756][ T19] snd-usb-audio: probe of 4-1:7.112 failed with error -2 [ 83.353639][ T19] snd-usb-audio: probe of 4-1:7.81 failed with error -2 [ 83.394018][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 83.410887][ T19] usb 4-1: USB disconnect, device number 2 [ 83.604278][ T5333] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2408'. [ 83.738405][ T5342] binder: Bad value for 'context' [ 85.513058][ T5482] binder: Bad value for 'context' [ 87.293130][ T5583] binder: Bad value for 'context' [ 87.770508][ T290] syz-executor (290) used greatest stack depth: 22272 bytes left [ 87.847978][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.857416][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.888123][ T5617] device bridge_slave_0 entered promiscuous mode [ 87.908122][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.934430][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.949644][ T5617] device bridge_slave_1 entered promiscuous mode [ 88.141665][ T28] audit: type=1400 audit(1763061503.213:141): avc: denied { create } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 88.184114][ T28] audit: type=1400 audit(1763061503.233:142): avc: denied { write } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 88.235412][ T28] audit: type=1400 audit(1763061503.233:143): avc: denied { read } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 88.259766][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.266807][ T5617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.274082][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.281112][ T5617] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.376723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.394311][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.419803][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.448433][ T43] device bridge_slave_1 left promiscuous mode [ 88.459063][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.477616][ T43] device bridge_slave_0 left promiscuous mode [ 88.489025][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.512540][ T43] device veth1_macvtap left promiscuous mode [ 88.526356][ T43] device veth0_vlan left promiscuous mode [ 88.676846][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 88.692655][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.699721][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.726252][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 88.736228][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.743301][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.771369][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 88.801099][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 88.809396][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 88.833514][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 88.862023][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 88.880713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 88.905254][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 88.923338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 88.949583][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 88.965149][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 88.995802][ T5617] device veth0_vlan entered promiscuous mode [ 88.997335][ T5688] binder: Bad value for 'context' [ 89.016175][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 89.033105][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 89.083738][ T5617] device veth1_macvtap entered promiscuous mode [ 89.114138][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 89.146449][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 89.172323][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 89.185848][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 89.194543][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 89.208002][ T5703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2580'. [ 89.558966][ T298] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 89.740305][ T298] usb 3-1: unable to get BOS descriptor or descriptor too short [ 89.759600][ T298] usb 3-1: config 7 has an invalid interface number: 205 but max is 2 [ 89.767775][ T298] usb 3-1: config 7 has an invalid interface number: 112 but max is 2 [ 89.786205][ T298] usb 3-1: config 7 has an invalid interface number: 81 but max is 2 [ 89.810043][ T298] usb 3-1: config 7 has no interface number 0 [ 89.816124][ T298] usb 3-1: config 7 has no interface number 1 [ 89.824037][ T298] usb 3-1: config 7 has no interface number 2 [ 89.830479][ T298] usb 3-1: config 7 interface 112 has no altsetting 0 [ 89.837429][ T298] usb 3-1: config 7 interface 81 has no altsetting 0 [ 89.851105][ T298] usb 3-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 89.868946][ T298] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.876982][ T298] usb 3-1: Product: syz [ 89.887064][ T298] usb 3-1: Manufacturer: syz [ 89.893549][ T298] usb 3-1: SerialNumber: syz [ 90.105685][ T298] snd-usb-audio: probe of 3-1:7.205 failed with error -2 [ 90.133954][ T298] snd-usb-audio: probe of 3-1:7.112 failed with error -2 [ 90.161085][ T298] snd-usb-audio: probe of 3-1:7.81 failed with error -2 [ 90.176784][ T298] usb 3-1: USB disconnect, device number 2 [ 90.182413][ T5302] udevd[5302]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 91.307498][ T28] audit: type=1400 audit(1763061506.373:144): avc: denied { create } for pid=5809 comm="syz.4.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.378928][ T28] audit: type=1400 audit(1763061506.373:145): avc: denied { bind } for pid=5809 comm="syz.4.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.437673][ T28] audit: type=1400 audit(1763061506.373:146): avc: denied { write } for pid=5809 comm="syz.4.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 92.348675][ T5846] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2646'. [ 92.679400][ T28] audit: type=1400 audit(1763061507.753:147): avc: denied { create } for pid=5870 comm="syz.3.2659" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 92.728926][ T28] audit: type=1400 audit(1763061507.753:148): avc: denied { setopt } for pid=5870 comm="syz.3.2659" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 92.939710][ T28] audit: type=1400 audit(1763061508.013:149): avc: denied { read } for pid=5874 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 92.979328][ T28] audit: type=1400 audit(1763061508.013:150): avc: denied { open } for pid=5874 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 93.165441][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.172587][ T5874] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.191946][ T5874] device bridge_slave_0 entered promiscuous mode [ 93.228307][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.260935][ T5874] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.268421][ T5874] device bridge_slave_1 entered promiscuous mode [ 93.545912][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.552992][ T5874] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.560279][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.567299][ T5874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.596170][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 93.609305][ T5672] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.623808][ T5672] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.660832][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 93.679184][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.686221][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.724237][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 93.742553][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.749615][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.779471][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 93.800289][ T43] device bridge_slave_1 left promiscuous mode [ 93.813132][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.839372][ T43] device bridge_slave_0 left promiscuous mode [ 93.845509][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.879722][ T43] device veth1_macvtap left promiscuous mode [ 93.887688][ T43] device veth0_vlan left promiscuous mode [ 94.051923][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 94.071655][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 94.103709][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 94.115184][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 94.148142][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 94.166201][ T5966] binder: Bad value for 'context' [ 94.171726][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 94.192858][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 94.210557][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 94.232518][ T5874] device veth0_vlan entered promiscuous mode [ 94.258415][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 94.279390][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 94.310652][ T5874] device veth1_macvtap entered promiscuous mode [ 94.343740][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 94.369405][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 94.399258][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 94.428028][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 94.446824][ T5672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 95.114707][ T6039] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2733'. [ 95.269517][ T6057] binder: Bad value for 'context' [ 95.414814][ T28] audit: type=1400 audit(1763061510.483:151): avc: denied { read } for pid=6070 comm="syz.3.2750" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 95.642956][ T6098] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2764'. [ 96.144604][ T6179] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2802'. [ 96.329991][ T6202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2812'. [ 96.340423][ T6199] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2813'. [ 96.434635][ T6230] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2826'. [ 96.655143][ T6246] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2833'. [ 96.847197][ T6260] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2840'. [ 97.188791][ T6308] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2863'. [ 97.261393][ T28] audit: type=1400 audit(1763061512.333:152): avc: denied { create } for pid=6321 comm="syz.1.2871" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 97.302349][ T28] audit: type=1400 audit(1763061512.353:153): avc: denied { connect } for pid=6321 comm="syz.1.2871" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 98.523892][ T6386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2902'. [ 99.949200][ T6435] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.956267][ T6435] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.994380][ T6435] device bridge_slave_0 entered promiscuous mode [ 100.024270][ T6435] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.047348][ T6435] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.079616][ T6435] device bridge_slave_1 entered promiscuous mode [ 100.292553][ T6435] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.299627][ T6435] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.306898][ T6435] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.313947][ T6435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.379589][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.402478][ T890] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.426644][ T890] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.447174][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 100.455494][ T890] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.462557][ T890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.500515][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.512127][ T890] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.519181][ T890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.526741][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.535885][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.549207][ T10] device bridge_slave_1 left promiscuous mode [ 100.555775][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.569697][ T10] device bridge_slave_0 left promiscuous mode [ 100.579077][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.598008][ T10] device veth1_macvtap left promiscuous mode [ 100.607238][ T10] device veth0_vlan left promiscuous mode [ 100.767642][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 100.778394][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 100.786630][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 100.795975][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 100.823521][ T6435] device veth0_vlan entered promiscuous mode [ 100.835664][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 100.844159][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 100.871111][ T6435] device veth1_macvtap entered promiscuous mode [ 100.885543][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 100.895414][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 100.913938][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 100.933721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 100.949152][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 101.597608][ T6572] __nla_validate_parse: 1 callbacks suppressed [ 101.597623][ T6572] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2982'. [ 101.903264][ T6602] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2996'. [ 102.084674][ T28] audit: type=1400 audit(1763061517.153:154): avc: denied { create } for pid=6622 comm="syz.3.3006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 102.107078][ T6625] binder: Bad value for 'context' [ 102.406321][ T6649] binder: Bad value for 'context' [ 102.627492][ T6675] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 102.820424][ T6690] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3040'. [ 103.111284][ T284] syz-executor (284) used greatest stack depth: 20776 bytes left [ 103.300773][ T6713] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.307827][ T6713] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.345735][ T6713] device bridge_slave_0 entered promiscuous mode [ 103.369302][ T6713] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.382327][ T6713] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.390141][ T6713] device bridge_slave_1 entered promiscuous mode [ 103.582830][ T6713] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.589920][ T6713] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.597187][ T6713] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.604230][ T6713] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.682341][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.690956][ T890] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.709875][ T890] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.729791][ T10] device bridge_slave_1 left promiscuous mode [ 103.735902][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.759728][ T10] device bridge_slave_0 left promiscuous mode [ 103.783127][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.809209][ T10] device veth1_macvtap left promiscuous mode [ 103.825726][ T10] device veth0_vlan left promiscuous mode [ 104.010966][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.029643][ T890] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.036699][ T890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.065786][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.080656][ T890] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.087709][ T890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.130947][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.149839][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 104.178556][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.193495][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.207898][ T6713] device veth0_vlan entered promiscuous mode [ 104.219796][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 104.234039][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.249916][ T6713] device veth1_macvtap entered promiscuous mode [ 104.264731][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.282299][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.299781][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 104.315840][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 104.347139][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 104.387992][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 104.400853][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 104.429265][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 104.452896][ T890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 104.613002][ T6787] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3080'. [ 105.163999][ T6879] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3123'. [ 105.314046][ T6895] 9pnet_fd: Insufficient options for proto=fd [ 105.484790][ T6920] 9pnet_fd: Insufficient options for proto=fd [ 106.242524][ T6988] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3176'. [ 106.787163][ T7056] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3206'. [ 106.797282][ T28] audit: type=1400 audit(1763061521.873:155): avc: denied { read } for pid=7053 comm="syz.2.3205" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 106.820371][ T7054] binder: 7053:7054 ioctl c0306201 200000000040 returned -14 [ 106.875436][ T28] audit: type=1400 audit(1763061521.873:156): avc: denied { open } for pid=7053 comm="syz.2.3205" path="/dev/binderfs/binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 106.953576][ T28] audit: type=1400 audit(1763061521.893:157): avc: denied { ioctl } for pid=7053 comm="syz.2.3205" path="/dev/binderfs/binder1" dev="binder" ino=17 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 108.711014][ T7150] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3251'. [ 108.896084][ T7160] binder: 7159:7160 ioctl c0306201 200000000040 returned -14 [ 108.993460][ T7164] Zero length message leads to an empty skb [ 109.104981][ T7170] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3256'. [ 109.758934][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.888798][ T7195] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3275'. [ 109.940323][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 109.968934][ T24] usb 1-1: config 7 has an invalid interface number: 205 but max is 1 [ 109.980357][ T24] usb 1-1: config 7 has an invalid interface number: 112 but max is 1 [ 110.001620][ T24] usb 1-1: config 7 has no interface number 0 [ 110.007704][ T24] usb 1-1: config 7 has no interface number 1 [ 110.033519][ T24] usb 1-1: config 7 interface 112 has no altsetting 0 [ 110.067372][ T24] usb 1-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 110.076984][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.086026][ T24] usb 1-1: Product: syz [ 110.095904][ T24] usb 1-1: Manufacturer: syz [ 110.106574][ T24] usb 1-1: SerialNumber: syz [ 110.114075][ T7218] binder: Bad value for 'context' [ 110.122193][ T7222] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3286'. [ 110.333322][ T24] snd-usb-audio: probe of 1-1:7.205 failed with error -2 [ 110.360964][ T24] snd-usb-audio: probe of 1-1:7.112 failed with error -2 [ 110.377306][ T24] usb 1-1: USB disconnect, device number 2 [ 110.385010][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:7.112/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 111.089383][ T7250] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3302'. [ 111.713838][ T7281] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3313'. [ 111.920069][ T6] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 111.928967][ T7311] binder: 7309:7311 ioctl c0306201 200000000040 returned -14 [ 111.935375][ T7313] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3328'. [ 112.112224][ T6] usb 4-1: unable to get BOS descriptor or descriptor too short [ 112.122895][ T6] usb 4-1: config 7 has an invalid interface number: 205 but max is 1 [ 112.139134][ T6] usb 4-1: config 7 has an invalid interface number: 112 but max is 1 [ 112.160641][ T6] usb 4-1: config 7 has no interface number 0 [ 112.166841][ T6] usb 4-1: config 7 has no interface number 1 [ 112.173272][ T6] usb 4-1: config 7 interface 112 has no altsetting 0 [ 112.190242][ T6] usb 4-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 112.207962][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.223665][ T6] usb 4-1: Product: syz [ 112.237960][ T6] usb 4-1: Manufacturer: syz [ 112.242938][ T6] usb 4-1: SerialNumber: syz [ 112.456206][ T6] snd-usb-audio: probe of 4-1:7.205 failed with error -2 [ 112.471725][ T6] snd-usb-audio: probe of 4-1:7.112 failed with error -2 [ 112.492449][ T6] usb 4-1: USB disconnect, device number 3 [ 112.494747][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:7.112/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 112.526643][ T7348] binder: Bad value for 'context' [ 112.560316][ T7351] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3347'. [ 114.725242][ T28] audit: type=1400 audit(1763061529.793:158): avc: denied { create } for pid=7487 comm="syz.1.3410" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 114.763006][ T28] audit: type=1400 audit(1763061529.813:159): avc: denied { setopt } for pid=7487 comm="syz.1.3410" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 114.938319][ T28] audit: type=1400 audit(1763061530.003:160): avc: denied { bind } for pid=7504 comm="syz.1.3418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 114.977298][ T28] audit: type=1400 audit(1763061530.033:161): avc: denied { name_bind } for pid=7504 comm="syz.1.3418" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 115.018325][ T28] audit: type=1400 audit(1763061530.033:162): avc: denied { node_bind } for pid=7504 comm="syz.1.3418" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 115.097911][ T28] audit: type=1400 audit(1763061530.163:163): avc: denied { ioctl } for pid=7511 comm="syz.2.3421" path="socket:[50700]" dev="sockfs" ino=50700 ioctlcmd=0x745a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 115.166933][ T7518] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3425'. [ 115.782576][ T28] audit: type=1400 audit(1763061530.853:164): avc: denied { create } for pid=7537 comm="syz.2.3434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 115.802095][ T28] audit: type=1400 audit(1763061530.863:165): avc: denied { connect } for pid=7537 comm="syz.2.3434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 115.842190][ T28] audit: type=1400 audit(1763061530.913:166): avc: denied { bind } for pid=7544 comm="syz.2.3437" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 115.905347][ T7559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3444'. [ 116.043596][ T7584] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3456'. [ 116.356699][ T7641] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3483'. [ 116.418178][ T7648] binder: 7647:7648 ioctl c0306201 200000000040 returned -14 [ 116.640694][ T7678] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3501'. [ 117.239264][ T28] audit: type=1400 audit(1763061532.313:167): avc: denied { unmount } for pid=5874 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 117.709325][ T7768] binder: 7767:7768 ioctl c0306201 200000000040 returned -14 [ 118.658217][ T7829] binder: Bad value for 'context' [ 118.896340][ T7865] binder: 7864:7865 ioctl c0306201 200000000040 returned -14 [ 120.279811][ T7940] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3629'. [ 120.584776][ T7953] binder: Bad value for 'context' [ 121.198743][ T7977] binder: 7976:7977 ioctl c0306201 200000000040 returned -14 [ 121.297923][ T7980] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3649'. [ 121.541287][ T7987] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.548331][ T7987] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.564285][ T7987] device bridge_slave_0 entered promiscuous mode [ 121.577760][ T7987] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.592832][ T7987] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.600395][ T7987] device bridge_slave_1 entered promiscuous mode [ 121.797077][ T7987] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.804156][ T7987] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.811434][ T7987] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.818455][ T7987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.844789][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 121.871823][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.886736][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.931018][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 121.944624][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.951687][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.974235][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 121.991110][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.998163][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.012011][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 122.020139][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 122.050074][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 122.058852][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 122.067859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 122.075607][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 122.084241][ T7987] device veth0_vlan entered promiscuous mode [ 122.107922][ T7987] device veth1_macvtap entered promiscuous mode [ 122.121775][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 122.135059][ T890] device bridge_slave_1 left promiscuous mode [ 122.142342][ T890] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.157360][ T890] device bridge_slave_0 left promiscuous mode [ 122.164996][ T890] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.179465][ T890] device veth1_macvtap left promiscuous mode [ 122.188800][ T890] device veth0_vlan left promiscuous mode [ 122.293671][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 122.311097][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 123.057996][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 123.058010][ T28] audit: type=1400 audit(1763061538.123:171): avc: denied { create } for pid=8072 comm="syz.0.3689" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 123.109813][ T28] audit: type=1400 audit(1763061538.133:172): avc: denied { sys_admin } for pid=8072 comm="syz.0.3689" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 123.154683][ T28] audit: type=1400 audit(1763061538.133:173): avc: denied { map } for pid=8072 comm="syz.0.3689" path="socket:[53965]" dev="sockfs" ino=53965 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 123.568933][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 123.750287][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 123.760172][ T24] usb 5-1: config 7 has an invalid interface number: 205 but max is 2 [ 123.768380][ T24] usb 5-1: config 7 has an invalid interface number: 112 but max is 2 [ 123.777522][ T24] usb 5-1: config 7 has an invalid interface number: 81 but max is 2 [ 123.785794][ T24] usb 5-1: config 7 has no interface number 0 [ 123.792040][ T24] usb 5-1: config 7 has no interface number 1 [ 123.798150][ T24] usb 5-1: config 7 has no interface number 2 [ 123.804520][ T24] usb 5-1: config 7 interface 112 has no altsetting 0 [ 123.811462][ T24] usb 5-1: config 7 interface 81 has no altsetting 0 [ 123.820031][ T24] usb 5-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 123.829165][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.837146][ T24] usb 5-1: Product: syz [ 123.841570][ T24] usb 5-1: Manufacturer: syz [ 123.846163][ T24] usb 5-1: SerialNumber: syz [ 123.899385][ T6] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 124.054579][ T24] snd-usb-audio: probe of 5-1:7.205 failed with error -2 [ 124.076942][ T24] snd-usb-audio: probe of 5-1:7.112 failed with error -2 [ 124.085240][ T6] usb 1-1: unable to get BOS descriptor or descriptor too short [ 124.091546][ T24] snd-usb-audio: probe of 5-1:7.81 failed with error -2 [ 124.094212][ T6] usb 1-1: config 7 has an invalid interface number: 205 but max is 2 [ 124.102242][ T24] usb 5-1: USB disconnect, device number 2 [ 124.114358][ T6] usb 1-1: config 7 has an invalid interface number: 112 but max is 2 [ 124.132454][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 124.132684][ T6] usb 1-1: config 7 has an invalid interface number: 81 but max is 2 [ 124.160461][ T6] usb 1-1: config 7 has no interface number 0 [ 124.172343][ T6] usb 1-1: config 7 has no interface number 1 [ 124.178502][ T6] usb 1-1: config 7 has no interface number 2 [ 124.184787][ T6] usb 1-1: config 7 interface 112 has no altsetting 0 [ 124.191988][ T6] usb 1-1: config 7 interface 81 has no altsetting 0 [ 124.200239][ T6] usb 1-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 124.209398][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.217417][ T6] usb 1-1: Product: syz [ 124.221879][ T6] usb 1-1: Manufacturer: syz [ 124.226512][ T6] usb 1-1: SerialNumber: syz [ 124.442836][ T6] snd-usb-audio: probe of 1-1:7.205 failed with error -2 [ 124.451937][ T6] snd-usb-audio: probe of 1-1:7.112 failed with error -2 [ 124.472686][ T6] snd-usb-audio: probe of 1-1:7.81 failed with error -2 [ 124.486840][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 124.504733][ T6] usb 1-1: USB disconnect, device number 3 [ 124.549563][ T8194] binder: 8193:8194 ioctl c0306201 200000000040 returned -14 [ 127.478940][ T5976] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 127.582306][ T8367] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3834'. [ 127.672869][ T5976] usb 2-1: unable to get BOS descriptor or descriptor too short [ 127.683722][ T8380] binder: Bad value for 'context' [ 127.689695][ T5976] usb 2-1: config 7 has an invalid interface number: 205 but max is 2 [ 127.702181][ T5976] usb 2-1: config 7 has an invalid interface number: 112 but max is 2 [ 127.710767][ T5976] usb 2-1: config 7 has an invalid interface number: 81 but max is 2 [ 127.720073][ T5976] usb 2-1: config 7 has no interface number 0 [ 127.726735][ T5976] usb 2-1: config 7 has no interface number 1 [ 127.733013][ T5976] usb 2-1: config 7 has no interface number 2 [ 127.739555][ T5976] usb 2-1: config 7 interface 112 has no altsetting 0 [ 127.757870][ T5976] usb 2-1: config 7 interface 81 has no altsetting 0 [ 127.774329][ T8390] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3846'. [ 127.784773][ T5976] usb 2-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 127.804111][ T5976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.813436][ T5976] usb 2-1: Product: syz [ 127.817707][ T5976] usb 2-1: Manufacturer: syz [ 127.823947][ T5976] usb 2-1: SerialNumber: syz [ 128.045902][ T5976] snd-usb-audio: probe of 2-1:7.205 failed with error -2 [ 128.060738][ T5976] snd-usb-audio: probe of 2-1:7.112 failed with error -2 [ 128.077994][ T5976] snd-usb-audio: probe of 2-1:7.81 failed with error -2 [ 128.093865][ T5976] usb 2-1: USB disconnect, device number 2 [ 128.106177][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 128.454400][ T8454] binder: 8453:8454 ioctl c0306201 200000000940 returned -14 [ 129.251287][ T8503] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3899'. [ 129.300163][ T8510] binder: Bad value for 'context' [ 129.938970][ T6] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 130.130235][ T6] usb 2-1: unable to get BOS descriptor or descriptor too short [ 130.149245][ T6] usb 2-1: config 7 has an invalid interface number: 205 but max is 1 [ 130.157417][ T6] usb 2-1: config 7 has an invalid interface number: 81 but max is 1 [ 130.182977][ T6] usb 2-1: config 7 has no interface number 0 [ 130.198942][ T6] usb 2-1: config 7 has no interface number 1 [ 130.205043][ T6] usb 2-1: config 7 interface 81 has no altsetting 0 [ 130.234885][ T6] usb 2-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 130.254212][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.268148][ T6] usb 2-1: Product: syz [ 130.278901][ T6] usb 2-1: Manufacturer: syz [ 130.283499][ T6] usb 2-1: SerialNumber: syz [ 130.512159][ T6] snd-usb-audio: probe of 2-1:7.205 failed with error -2 [ 130.537410][ T6] snd-usb-audio: probe of 2-1:7.81 failed with error -2 [ 130.562424][ T6] usb 2-1: USB disconnect, device number 3 [ 130.769354][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 131.299459][ T6] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 131.437715][ T28] audit: type=1400 audit(1763061546.503:174): avc: denied { setopt } for pid=8675 comm="syz.4.3981" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 131.490281][ T6] usb 2-1: unable to get BOS descriptor or descriptor too short [ 131.498797][ T6] usb 2-1: config 7 has an invalid interface number: 205 but max is 2 [ 131.528223][ T6] usb 2-1: config 7 has an invalid interface number: 112 but max is 2 [ 131.555574][ T6] usb 2-1: config 7 has an invalid interface number: 81 but max is 2 [ 131.574180][ T28] audit: type=1400 audit(1763061546.643:175): avc: denied { read write } for pid=8699 comm="syz.4.3991" name="vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 131.602971][ T6] usb 2-1: config 7 has no interface number 0 [ 131.619463][ T6] usb 2-1: config 7 has no interface number 1 [ 131.625534][ T6] usb 2-1: config 7 has no interface number 2 [ 131.636341][ T28] audit: type=1400 audit(1763061546.643:176): avc: denied { open } for pid=8699 comm="syz.4.3991" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 131.660389][ T6] usb 2-1: config 7 interface 112 has no altsetting 0 [ 131.667154][ T6] usb 2-1: config 7 interface 81 has no altsetting 0 [ 131.686801][ T28] audit: type=1400 audit(1763061546.643:177): avc: denied { ioctl } for pid=8699 comm="syz.4.3991" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 131.717148][ T6] usb 2-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 131.727409][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.736151][ T6] usb 2-1: Product: syz [ 131.740431][ T6] usb 2-1: Manufacturer: syz [ 131.745045][ T6] usb 2-1: SerialNumber: syz [ 131.959674][ T6] snd-usb-audio: probe of 2-1:7.205 failed with error -2 [ 131.978474][ T6] snd-usb-audio: probe of 2-1:7.112 failed with error -2 [ 131.999736][ T6] snd-usb-audio: probe of 2-1:7.81 failed with error -2 [ 132.015367][ T6] usb 2-1: USB disconnect, device number 4 [ 132.168438][ T28] audit: type=1400 audit(1763061547.233:178): avc: denied { ioctl } for pid=8775 comm="syz.0.4026" path="socket:[58135]" dev="sockfs" ino=58135 ioctlcmd=0x48de scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 132.239311][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 132.464787][ T8817] binder: 8816:8817 ioctl c0306201 200000000940 returned -14 [ 132.484128][ T28] audit: type=1400 audit(1763061547.553:179): avc: denied { wake_alarm } for pid=8818 comm="syz.1.4046" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 133.489606][ T8878] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4075'. [ 133.798963][ T24] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 133.990941][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 134.001124][ T24] usb 2-1: config 7 has an invalid interface number: 205 but max is 1 [ 134.018903][ T24] usb 2-1: config 7 has an invalid interface number: 81 but max is 1 [ 134.034783][ T24] usb 2-1: config 7 has no interface number 0 [ 134.045275][ T24] usb 2-1: config 7 has no interface number 1 [ 134.058932][ T24] usb 2-1: config 7 interface 81 has no altsetting 0 [ 134.077309][ T24] usb 2-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 134.095160][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.110960][ T24] usb 2-1: Product: syz [ 134.118997][ T24] usb 2-1: Manufacturer: syz [ 134.129016][ T24] usb 2-1: SerialNumber: syz [ 134.218951][ T8777] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 134.345250][ T24] snd-usb-audio: probe of 2-1:7.205 failed with error -2 [ 134.364733][ T24] snd-usb-audio: probe of 2-1:7.81 failed with error -2 [ 134.391590][ T24] usb 2-1: USB disconnect, device number 5 [ 134.394726][ T340] udevd[340]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 135.862350][ T8977] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4125'. [ 136.432514][ T9027] binder: Unknown parameter 'cont' [ 136.949222][ T6] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 137.140272][ T6] usb 3-1: unable to get BOS descriptor or descriptor too short [ 137.158808][ T6] usb 3-1: config 7 has an invalid interface number: 205 but max is 1 [ 137.186506][ T6] usb 3-1: config 7 has an invalid interface number: 81 but max is 1 [ 137.198998][ T6] usb 3-1: config 7 has no interface number 0 [ 137.216728][ T6] usb 3-1: config 7 has no interface number 1 [ 137.228580][ T6] usb 3-1: config 7 interface 81 has no altsetting 0 [ 137.245212][ T6] usb 3-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 137.266133][ T6] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.284343][ T6] usb 3-1: Product: syz [ 137.297470][ T6] usb 3-1: Manufacturer: syz [ 137.305717][ T6] usb 3-1: SerialNumber: syz [ 137.414043][ T9111] binder: Unknown parameter 'contex' [ 137.523862][ T6] snd-usb-audio: probe of 3-1:7.205 failed with error -2 [ 137.547366][ T6] snd-usb-audio: probe of 3-1:7.81 failed with error -2 [ 137.565388][ T6] usb 3-1: USB disconnect, device number 3 [ 137.576771][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 138.468910][ T24] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 138.665017][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 138.677798][ T24] usb 4-1: config 7 has an invalid interface number: 205 but max is 1 [ 138.700283][ T24] usb 4-1: config 7 has an invalid interface number: 81 but max is 1 [ 138.722646][ T24] usb 4-1: config 7 has no interface number 0 [ 138.736336][ T24] usb 4-1: config 7 has no interface number 1 [ 138.752723][ T24] usb 4-1: config 7 interface 81 has no altsetting 0 [ 138.772001][ T24] usb 4-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 138.796120][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.813927][ T24] usb 4-1: Product: syz [ 138.822493][ T24] usb 4-1: Manufacturer: syz [ 138.831503][ T24] usb 4-1: SerialNumber: syz [ 139.046930][ T24] snd-usb-audio: probe of 4-1:7.205 failed with error -2 [ 139.067605][ T24] snd-usb-audio: probe of 4-1:7.81 failed with error -2 [ 139.089946][ T24] usb 4-1: USB disconnect, device number 4 [ 139.097360][ T340] udevd[340]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 139.444026][ T9288] binder: 9287:9288 ioctl c0306201 200000000040 returned -14 [ 139.518963][ T60] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 139.566296][ T28] audit: type=1400 audit(1763061554.633:180): avc: denied { set_context_mgr } for pid=9305 comm="syz.4.4281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 139.711106][ T60] usb 1-1: unable to get BOS descriptor or descriptor too short [ 139.733674][ T60] usb 1-1: config 7 has an invalid interface number: 205 but max is 2 [ 139.758912][ T60] usb 1-1: config 7 has an invalid interface number: 112 but max is 2 [ 139.782307][ T60] usb 1-1: config 7 has an invalid interface number: 81 but max is 2 [ 139.798908][ T60] usb 1-1: config 7 has no interface number 0 [ 139.809032][ T60] usb 1-1: config 7 has no interface number 1 [ 139.827278][ T60] usb 1-1: config 7 has no interface number 2 [ 139.837366][ T60] usb 1-1: config 7 interface 112 has no altsetting 0 [ 139.864523][ T60] usb 1-1: config 7 interface 81 has no altsetting 0 [ 139.876798][ T60] usb 1-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 139.908899][ T60] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.937125][ T60] usb 1-1: Product: syz [ 139.941327][ T60] usb 1-1: Manufacturer: syz [ 139.945917][ T60] usb 1-1: SerialNumber: syz [ 140.163313][ T60] snd-usb-audio: probe of 1-1:7.205 failed with error -2 [ 140.181855][ T60] snd-usb-audio: probe of 1-1:7.112 failed with error -2 [ 140.206734][ T60] snd-usb-audio: probe of 1-1:7.81 failed with error -2 [ 140.220323][ T60] usb 1-1: USB disconnect, device number 4 [ 140.232723][ T340] udevd[340]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 141.538946][ T6] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 141.730276][ T6] usb 4-1: unable to get BOS descriptor or descriptor too short [ 141.749260][ T6] usb 4-1: config 7 has an invalid interface number: 81 but max is 0 [ 141.757346][ T6] usb 4-1: config 7 has no interface number 0 [ 141.783751][ T6] usb 4-1: config 7 interface 81 has no altsetting 0 [ 141.805300][ T6] usb 4-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 141.832037][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.858902][ T6] usb 4-1: Product: syz [ 141.863070][ T6] usb 4-1: Manufacturer: syz [ 141.876153][ T6] usb 4-1: SerialNumber: syz [ 142.095574][ T6] snd-usb-audio: probe of 4-1:7.81 failed with error -2 [ 142.111751][ T6] usb 4-1: USB disconnect, device number 5 [ 142.119113][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 143.205513][ T28] audit: type=1400 audit(1763061558.273:181): avc: denied { getopt } for pid=9541 comm="syz.2.4392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 144.437895][ T9710] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4471'. [ 144.499605][ T28] audit: type=1400 audit(1763061559.573:182): avc: denied { bind } for pid=9721 comm="syz.1.4478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 144.588934][ T60] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 144.688911][ T5972] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 144.780213][ T60] usb 5-1: unable to get BOS descriptor or descriptor too short [ 144.792558][ T60] usb 5-1: config 7 has an invalid interface number: 205 but max is 2 [ 144.802146][ T60] usb 5-1: config 7 has an invalid interface number: 112 but max is 2 [ 144.810606][ T60] usb 5-1: config 7 has an invalid interface number: 81 but max is 2 [ 144.818855][ T60] usb 5-1: config 7 has no interface number 0 [ 144.825463][ T60] usb 5-1: config 7 has no interface number 1 [ 144.831920][ T60] usb 5-1: config 7 has no interface number 2 [ 144.845567][ T60] usb 5-1: config 7 interface 112 has no altsetting 0 [ 144.852560][ T60] usb 5-1: config 7 interface 81 has no altsetting 0 [ 144.870462][ T60] usb 5-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 144.889092][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.890200][ T5972] usb 1-1: unable to get BOS descriptor or descriptor too short [ 144.904043][ T60] usb 5-1: Product: syz [ 144.913800][ T5972] usb 1-1: config 7 has an invalid interface number: 81 but max is 0 [ 144.916762][ T60] usb 5-1: Manufacturer: syz [ 144.926832][ T60] usb 5-1: SerialNumber: syz [ 144.937304][ T5972] usb 1-1: config 7 has no interface number 0 [ 144.951470][ T5972] usb 1-1: config 7 interface 81 has no altsetting 0 [ 144.968065][ T5972] usb 1-1: New USB device found, idVendor=0499, idProduct=1037, bcdDevice=29.5d [ 144.989326][ T5972] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.006452][ T5972] usb 1-1: Product: syz [ 145.016770][ T5972] usb 1-1: Manufacturer: syz [ 145.026878][ T5972] usb 1-1: SerialNumber: syz [ 145.126724][ T28] audit: type=1400 audit(1763061560.193:183): avc: denied { read } for pid=9757 comm="syz.1.4496" name="msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 145.147087][ T60] snd-usb-audio: probe of 5-1:7.205 failed with error -2 [ 145.158182][ T28] audit: type=1400 audit(1763061560.193:184): avc: denied { open } for pid=9757 comm="syz.1.4496" path="/dev/cpu/0/msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 145.189033][ T60] snd-usb-audio: probe of 5-1:7.112 failed with error -2 [ 145.208174][ T60] snd-usb-audio: probe of 5-1:7.81 failed with error -2 [ 145.225596][ T9761] udevd[9761]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 145.244184][ T60] usb 5-1: USB disconnect, device number 3 [ 145.250633][ T5972] snd-usb-audio: probe of 1-1:7.81 failed with error -2 [ 145.268271][ T5972] usb 1-1: USB disconnect, device number 5 [ 145.276372][ T9772] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 145.288820][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:7.81/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 145.370167][ T28] audit: type=1400 audit(1763061560.443:185): avc: denied { bind } for pid=9783 comm="syz.2.4508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 145.390189][ T28] audit: type=1400 audit(1763061560.443:186): avc: denied { name_bind } for pid=9783 comm="syz.2.4508" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 145.425732][ T28] audit: type=1400 audit(1763061560.443:187): avc: denied { node_bind } for pid=9783 comm="syz.2.4508" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 145.760583][ T28] audit: type=1400 audit(1763061560.833:188): avc: denied { setcurrent } for pid=9821 comm="syz.3.4528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 145.922284][ T28] audit: type=1400 audit(1763061560.993:189): avc: denied { mount } for pid=9839 comm="syz.3.4536" name="/" dev="ramfs" ino=63767 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 146.853458][ T9917] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 147.107942][ T28] audit: type=1400 audit(1763061562.173:190): avc: denied { load_policy } for pid=9933 comm="syz.4.4580" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 147.131068][ T9935] SELinux: policydb table sizes (0,0) do not match mine (6,7) [ 147.157857][ T9935] SELinux: failed to load policy [ 148.549920][ T28] audit: type=1400 audit(1763061563.623:191): avc: denied { read } for pid=10029 comm="syz.3.4622" name="event2" dev="devtmpfs" ino=277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 148.606949][ T28] audit: type=1400 audit(1763061563.643:192): avc: denied { open } for pid=10029 comm="syz.3.4622" path="/dev/input/event2" dev="devtmpfs" ino=277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 149.010618][T10085] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 149.926627][T10127] netlink: 92 bytes leftover after parsing attributes in process `syz.2.4670'. [ 150.208220][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 152.115391][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 152.115405][ T28] audit: type=1400 audit(1763061567.183:194): avc: denied { write } for pid=10208 comm="syz.0.4710" name="uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 152.205936][T10215] device pim6reg1 entered promiscuous mode [ 152.218967][ T8781] Bluetooth: hci0: command 0x1003 tx timeout [ 152.225127][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 152.231901][T10146] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 152.389149][T10238] binder: 10235:10238 ioctl c0306201 200000000940 returned -14 [ 152.646983][T10273] binder: 10272:10273 ioctl c0306201 200000000940 returned -14 [ 152.651287][T10277] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 152.750880][T10283] netlink: 92 bytes leftover after parsing attributes in process `syz.3.4744'. [ 153.008266][T10305] binder: 10304:10305 ioctl c0306201 200000000940 returned -14 [ 153.206308][T10326] SELinux: policydb table sizes (0,0) do not match mine (6,7) [ 153.238904][T10326] SELinux: failed to load policy [ 153.710122][ T28] audit: type=1400 audit(1763061568.783:195): avc: denied { map } for pid=10380 comm="syz.0.4789" path="/newroot/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 153.939749][ T28] audit: type=1400 audit(1763061569.013:196): avc: denied { bind } for pid=10400 comm="syz.0.4800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 154.044218][ T28] audit: type=1400 audit(1763061569.113:197): avc: denied { name_bind } for pid=10431 comm="syz.4.4813" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 154.298893][ C0] ================================================================== [ 154.306974][ C0] BUG: KASAN: use-after-free in __run_timers+0x32b/0x9a0 [ 154.314029][ C0] Write of size 8 at addr ffff88812e534a00 by task syz.4.4826/10461 [ 154.322006][ C0] [ 154.324330][ C0] CPU: 0 PID: 10461 Comm: syz.4.4826 Not tainted syzkaller #0 [ 154.331780][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 154.341832][ C0] Call Trace: [ 154.345092][ C0] [ 154.347914][ C0] __dump_stack+0x21/0x24 [ 154.352227][ C0] dump_stack_lvl+0xee/0x150 [ 154.356798][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 154.361802][ C0] ? update_rq_clock+0x536/0x5c0 [ 154.366720][ C0] ? __run_timers+0x32b/0x9a0 [ 154.371376][ C0] print_address_description+0x71/0x200 [ 154.376903][ C0] print_report+0x4a/0x60 [ 154.381214][ C0] kasan_report+0x122/0x150 [ 154.385699][ C0] ? __run_timers+0x32b/0x9a0 [ 154.390365][ C0] __asan_report_store8_noabort+0x17/0x20 [ 154.396064][ C0] __run_timers+0x32b/0x9a0 [ 154.400548][ C0] ? sched_clock+0x9/0x10 [ 154.404859][ C0] ? sched_clock_cpu+0x6e/0x250 [ 154.409695][ C0] ? calc_index+0x200/0x200 [ 154.414180][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 154.419361][ C0] run_timer_softirq+0x6a/0xf0 [ 154.424105][ C0] handle_softirqs+0x1d7/0x600 [ 154.428848][ C0] ? irqtime_account_irq+0xc4/0x240 [ 154.434033][ C0] __irq_exit_rcu+0x52/0xf0 [ 154.438516][ C0] irq_exit_rcu+0x9/0x10 [ 154.442736][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 154.448349][ C0] [ 154.451259][ C0] [ 154.454171][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 154.460156][ C0] RIP: 0010:_raw_spin_unlock_irq+0x48/0x70 [ 154.465943][ C0] Code: 74 12 48 89 fb 48 c7 c7 00 d3 ed 86 e8 51 46 c0 fc 48 89 df 48 83 3d a6 84 f9 01 00 74 26 e8 93 0c 00 00 90 fb bf 01 00 00 00 53 67 57 fc 65 8b 05 54 1f 0e 7b 85 c0 74 03 5b 5d c3 e8 14 2c [ 154.485530][ C0] RSP: 0000:ffffc90003b874a8 EFLAGS: 00000246 [ 154.491579][ C0] RAX: 0000000000000001 RBX: ffffea0004e1bb00 RCX: dffffc0000000000 [ 154.499527][ C0] RDX: ffffc900016aa000 RSI: ffffffff85909060 RDI: 0000000000000001 [ 154.507483][ C0] RBP: ffffc90003b874b0 R08: dffffc0000000000 R09: fffff940009c3761 [ 154.515431][ C0] R10: fffff940009c3761 R11: 1ffffd40009c3760 R12: 0000000000000001 [ 154.523378][ C0] R13: ffffc90003b87540 R14: 0000000000000cc0 R15: 0000000000000000 [ 154.531335][ C0] ? _raw_spin_unlock_irq+0x41/0x70 [ 154.536513][ C0] shmem_add_to_page_cache+0x68e/0xac0 [ 154.541952][ C0] ? put_page+0xb0/0xb0 [ 154.546088][ C0] shmem_get_folio_gfp+0x132c/0x2230 [ 154.551360][ C0] ? xas_load+0x39e/0x3b0 [ 154.555677][ C0] shmem_fault+0x1ae/0x650 [ 154.560072][ C0] ? __cfi_shmem_fault+0x10/0x10 [ 154.564991][ C0] ? __kasan_check_write+0x14/0x20 [ 154.570077][ C0] ? folio_unlock+0x4f/0x60 [ 154.574557][ C0] do_fault+0x1a6f/0x1df0 [ 154.578863][ C0] ? pte_marker_clear+0x220/0x220 [ 154.583865][ C0] ? check_preemption_disabled+0x81/0x120 [ 154.589560][ C0] ? memcg_rstat_updated+0x56/0x110 [ 154.594740][ C0] handle_mm_fault+0x12fa/0x2640 [ 154.599662][ C0] ? __cfi_handle_mm_fault+0x10/0x10 [ 154.604931][ C0] __get_user_pages+0x33d/0xd80 [ 154.609759][ C0] ? populate_vma_page_range+0x120/0x120 [ 154.615369][ C0] ? userfaultfd_unmap_complete+0x275/0x2d0 [ 154.621240][ C0] __mm_populate+0x2e4/0x420 [ 154.625806][ C0] ? __cfi___mm_populate+0x10/0x10 [ 154.630898][ C0] vm_mmap_pgoff+0x268/0x3f0 [ 154.635465][ C0] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 154.640558][ C0] ? xfd_validate_state+0x70/0x150 [ 154.645651][ C0] ksys_mmap_pgoff+0xf6/0x1d0 [ 154.650308][ C0] ? __kasan_check_write+0x14/0x20 [ 154.655397][ C0] __x64_sys_mmap+0xfa/0x110 [ 154.659966][ C0] x64_sys_call+0x8fd/0x9a0 [ 154.664446][ C0] do_syscall_64+0x4c/0xa0 [ 154.668842][ C0] ? clear_bhb_loop+0x30/0x80 [ 154.673504][ C0] ? clear_bhb_loop+0x30/0x80 [ 154.678159][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 154.684030][ C0] RIP: 0033:0x7f516158f6c9 [ 154.688429][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 154.708011][ C0] RSP: 002b:00007f51624a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 154.716402][ C0] RAX: ffffffffffffffda RBX: 00007f51617e5fa0 RCX: 00007f516158f6c9 [ 154.724349][ C0] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 154.732297][ C0] RBP: 00007f5161611f91 R08: ffffffffffffffff R09: 0000000000000000 [ 154.740248][ C0] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 154.748192][ C0] R13: 00007f51617e6038 R14: 00007f51617e5fa0 R15: 00007ffe74de7e58 [ 154.756142][ C0] [ 154.759136][ C0] [ 154.761441][ C0] Allocated by task 10146: [ 154.765830][ C0] kasan_set_track+0x4b/0x70 [ 154.770397][ C0] kasan_save_alloc_info+0x25/0x30 [ 154.775486][ C0] __kasan_kmalloc+0x95/0xb0 [ 154.780051][ C0] __kmalloc+0xb1/0x1e0 [ 154.784188][ C0] hci_alloc_dev_priv+0x27/0x1bd0 [ 154.789194][ C0] hci_uart_tty_ioctl+0x3d6/0xa20 [ 154.794195][ C0] tty_ioctl+0x8ef/0xc60 [ 154.798415][ C0] __se_sys_ioctl+0x12f/0x1b0 [ 154.803067][ C0] __x64_sys_ioctl+0x7b/0x90 [ 154.807630][ C0] x64_sys_call+0x58b/0x9a0 [ 154.812109][ C0] do_syscall_64+0x4c/0xa0 [ 154.816502][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 154.822374][ C0] [ 154.824671][ C0] Freed by task 10146: [ 154.828707][ C0] kasan_set_track+0x4b/0x70 [ 154.833273][ C0] kasan_save_free_info+0x31/0x50 [ 154.838278][ C0] ____kasan_slab_free+0x132/0x180 [ 154.843367][ C0] __kasan_slab_free+0x11/0x20 [ 154.848107][ C0] slab_free_freelist_hook+0xc2/0x190 [ 154.853462][ C0] __kmem_cache_free+0xb7/0x1b0 [ 154.858290][ C0] kfree+0x6f/0xf0 [ 154.861995][ C0] hci_release_dev+0x12a3/0x13b0 [ 154.866911][ C0] bt_host_release+0x82/0x90 [ 154.871480][ C0] device_release+0xa4/0x1d0 [ 154.876047][ C0] kobject_put+0x19d/0x280 [ 154.880439][ C0] put_device+0x1f/0x30 [ 154.884576][ C0] hci_dev_cmd+0x265/0x720 [ 154.888964][ C0] hci_sock_ioctl+0x41e/0x7f0 [ 154.893625][ C0] sock_do_ioctl+0x101/0x310 [ 154.898202][ C0] sock_ioctl+0x4d8/0x6e0 [ 154.902526][ C0] __se_sys_ioctl+0x12f/0x1b0 [ 154.907181][ C0] __x64_sys_ioctl+0x7b/0x90 [ 154.911753][ C0] x64_sys_call+0x58b/0x9a0 [ 154.916239][ C0] do_syscall_64+0x4c/0xa0 [ 154.920639][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 154.926519][ C0] [ 154.928822][ C0] Last potentially related work creation: [ 154.934509][ C0] kasan_save_stack+0x3a/0x60 [ 154.939169][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 154.944526][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 154.950320][ C0] insert_work+0x51/0x300 [ 154.954630][ C0] __queue_work+0x9b1/0xd30 [ 154.959113][ C0] queue_work_on+0xd2/0x140 [ 154.963599][ C0] __hci_cmd_sync_sk+0xa3e/0xcf0 [ 154.968516][ C0] hci_cmd_sync_status+0x53/0x120 [ 154.973520][ C0] hci_dev_cmd+0x628/0x720 [ 154.977914][ C0] hci_sock_ioctl+0x41e/0x7f0 [ 154.982572][ C0] sock_do_ioctl+0x101/0x310 [ 154.987145][ C0] sock_ioctl+0x4d8/0x6e0 [ 154.991454][ C0] __se_sys_ioctl+0x12f/0x1b0 [ 154.996107][ C0] __x64_sys_ioctl+0x7b/0x90 [ 155.000670][ C0] x64_sys_call+0x58b/0x9a0 [ 155.005152][ C0] do_syscall_64+0x4c/0xa0 [ 155.009551][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.015424][ C0] [ 155.017727][ C0] Second to last potentially related work creation: [ 155.024282][ C0] kasan_save_stack+0x3a/0x60 [ 155.028936][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 155.034292][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 155.040080][ C0] insert_work+0x51/0x300 [ 155.044384][ C0] __queue_work+0x9b1/0xd30 [ 155.048867][ C0] queue_work_on+0xd2/0x140 [ 155.053350][ C0] hci_cmd_timeout+0x191/0x200 [ 155.058094][ C0] process_one_work+0x71f/0xc40 [ 155.062916][ C0] worker_thread+0xa29/0x11f0 [ 155.067567][ C0] kthread+0x281/0x320 [ 155.072047][ C0] ret_from_fork+0x1f/0x30 [ 155.076443][ C0] [ 155.078748][ C0] The buggy address belongs to the object at ffff88812e534000 [ 155.078748][ C0] which belongs to the cache kmalloc-8k of size 8192 [ 155.092809][ C0] The buggy address is located 2560 bytes inside of [ 155.092809][ C0] 8192-byte region [ffff88812e534000, ffff88812e536000) [ 155.106246][ C0] [ 155.108551][ C0] The buggy address belongs to the physical page: [ 155.115027][ C0] page:ffffea0004b94c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e530 [ 155.125263][ C0] head:ffffea0004b94c00 order:3 compound_mapcount:0 compound_pincount:0 [ 155.133577][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 155.139639][ C0] raw: 4000000000010200 ffffea00043ff400 dead000000000002 ffff888100043500 [ 155.148199][ C0] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 155.156759][ C0] page dumped because: kasan: bad access detected [ 155.163151][ C0] page_owner tracks the page as allocated [ 155.168838][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 285, tgid 285 (syz-executor), ts 20115165375, free_ts 0 [ 155.189148][ C0] post_alloc_hook+0x1f5/0x210 [ 155.193895][ C0] prep_new_page+0x1c/0x110 [ 155.198378][ C0] get_page_from_freelist+0x2c7b/0x2cf0 [ 155.203905][ C0] __alloc_pages+0x1c3/0x450 [ 155.208475][ C0] alloc_slab_page+0x6e/0xf0 [ 155.213049][ C0] new_slab+0x98/0x3d0 [ 155.217101][ C0] ___slab_alloc+0x6bd/0xb20 [ 155.221669][ C0] __slab_alloc+0x5e/0xa0 [ 155.225977][ C0] __kmem_cache_alloc_node+0x203/0x2c0 [ 155.231416][ C0] __kmalloc+0xa1/0x1e0 [ 155.235551][ C0] ops_init+0x89/0x4a0 [ 155.239597][ C0] setup_net+0x4ab/0xcb0 [ 155.243815][ C0] copy_net_ns+0x355/0x5c0 [ 155.248208][ C0] create_new_namespaces+0x3a2/0x660 [ 155.253477][ C0] unshare_nsproxy_namespaces+0x120/0x170 [ 155.259178][ C0] ksys_unshare+0x4ac/0x7b0 [ 155.263664][ C0] page_owner free stack trace missing [ 155.269004][ C0] [ 155.271300][ C0] Memory state around the buggy address: [ 155.276902][ C0] ffff88812e534900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 155.284932][ C0] ffff88812e534980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 155.292966][ C0] >ffff88812e534a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 155.300995][ C0] ^ [ 155.305032][ C0] ffff88812e534a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 155.313071][ C0] ffff88812e534b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 155.321111][ C0] ================================================================== [ 155.329141][ C0] Disabling lock debugging due to kernel taint [ 155.335304][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 155.346987][ C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 155.355369][ C0] CPU: 0 PID: 10461 Comm: syz.4.4826 Tainted: G B syzkaller #0 [ 155.364277][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 155.374307][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 155.379577][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 a8 dc 28 00 4c 89 ff e8 b0 09 ad 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 1c 51 6d 00 49 8b 7d 00 e8 93 05 [ 155.399157][ C0] RSP: 0000:ffffc90000007c70 EFLAGS: 00010046 [ 155.405202][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffff888111895100 [ 155.413159][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 155.421106][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 155.429054][ C0] R10: ffffed1025ca6939 R11: 1ffff11025ca6939 R12: dffffc0000000000 [ 155.437000][ C0] R13: 0000000000000000 R14: ffff88812e5349c8 R15: 0000000000000008 [ 155.446445][ C0] FS: 00007f51624a06c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 155.455367][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.461939][ C0] CR2: 00000000000000db CR3: 00000001237c9000 CR4: 00000000003506b0 [ 155.469904][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155.477857][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155.485807][ C0] Call Trace: [ 155.489064][ C0] [ 155.491894][ C0] delayed_work_timer_fn+0x61/0x80 [ 155.496992][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 155.502782][ C0] call_timer_fn+0x46/0x2a0 [ 155.507271][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 155.513061][ C0] __run_timers+0x667/0x9a0 [ 155.517554][ C0] ? calc_index+0x200/0x200 [ 155.522038][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 155.527224][ C0] run_timer_softirq+0x6a/0xf0 [ 155.531977][ C0] handle_softirqs+0x1d7/0x600 [ 155.536738][ C0] ? irqtime_account_irq+0xc4/0x240 [ 155.541921][ C0] __irq_exit_rcu+0x52/0xf0 [ 155.546409][ C0] irq_exit_rcu+0x9/0x10 [ 155.550634][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 155.556253][ C0] [ 155.559166][ C0] [ 155.562079][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 155.568042][ C0] RIP: 0010:_raw_spin_unlock_irq+0x48/0x70 [ 155.573829][ C0] Code: 74 12 48 89 fb 48 c7 c7 00 d3 ed 86 e8 51 46 c0 fc 48 89 df 48 83 3d a6 84 f9 01 00 74 26 e8 93 0c 00 00 90 fb bf 01 00 00 00 53 67 57 fc 65 8b 05 54 1f 0e 7b 85 c0 74 03 5b 5d c3 e8 14 2c [ 155.593417][ C0] RSP: 0000:ffffc90003b874a8 EFLAGS: 00000246 [ 155.599468][ C0] RAX: 0000000000000001 RBX: ffffea0004e1bb00 RCX: dffffc0000000000 [ 155.607421][ C0] RDX: ffffc900016aa000 RSI: ffffffff85909060 RDI: 0000000000000001 [ 155.615369][ C0] RBP: ffffc90003b874b0 R08: dffffc0000000000 R09: fffff940009c3761 [ 155.623321][ C0] R10: fffff940009c3761 R11: 1ffffd40009c3760 R12: 0000000000000001 [ 155.631269][ C0] R13: ffffc90003b87540 R14: 0000000000000cc0 R15: 0000000000000000 [ 155.639221][ C0] ? _raw_spin_unlock_irq+0x41/0x70 [ 155.644404][ C0] shmem_add_to_page_cache+0x68e/0xac0 [ 155.649846][ C0] ? put_page+0xb0/0xb0 [ 155.653984][ C0] shmem_get_folio_gfp+0x132c/0x2230 [ 155.659253][ C0] ? xas_load+0x39e/0x3b0 [ 155.663571][ C0] shmem_fault+0x1ae/0x650 [ 155.667978][ C0] ? __cfi_shmem_fault+0x10/0x10 [ 155.672897][ C0] ? __kasan_check_write+0x14/0x20 [ 155.677982][ C0] ? folio_unlock+0x4f/0x60 [ 155.682467][ C0] do_fault+0x1a6f/0x1df0 [ 155.686773][ C0] ? pte_marker_clear+0x220/0x220 [ 155.691775][ C0] ? check_preemption_disabled+0x81/0x120 [ 155.697468][ C0] ? memcg_rstat_updated+0x56/0x110 [ 155.702649][ C0] handle_mm_fault+0x12fa/0x2640 [ 155.707574][ C0] ? __cfi_handle_mm_fault+0x10/0x10 [ 155.712847][ C0] __get_user_pages+0x33d/0xd80 [ 155.717679][ C0] ? populate_vma_page_range+0x120/0x120 [ 155.723287][ C0] ? userfaultfd_unmap_complete+0x275/0x2d0 [ 155.729163][ C0] __mm_populate+0x2e4/0x420 [ 155.733729][ C0] ? __cfi___mm_populate+0x10/0x10 [ 155.738906][ C0] vm_mmap_pgoff+0x268/0x3f0 [ 155.743471][ C0] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 155.748557][ C0] ? xfd_validate_state+0x70/0x150 [ 155.753648][ C0] ksys_mmap_pgoff+0xf6/0x1d0 [ 155.758302][ C0] ? __kasan_check_write+0x14/0x20 [ 155.763390][ C0] __x64_sys_mmap+0xfa/0x110 [ 155.767955][ C0] x64_sys_call+0x8fd/0x9a0 [ 155.772434][ C0] do_syscall_64+0x4c/0xa0 [ 155.776826][ C0] ? clear_bhb_loop+0x30/0x80 [ 155.781483][ C0] ? clear_bhb_loop+0x30/0x80 [ 155.786143][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.792012][ C0] RIP: 0033:0x7f516158f6c9 [ 155.796400][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 155.815979][ C0] RSP: 002b:00007f51624a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 155.824369][ C0] RAX: ffffffffffffffda RBX: 00007f51617e5fa0 RCX: 00007f516158f6c9 [ 155.832324][ C0] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 155.840269][ C0] RBP: 00007f5161611f91 R08: ffffffffffffffff R09: 0000000000000000 [ 155.848218][ C0] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 155.856163][ C0] R13: 00007f51617e6038 R14: 00007f51617e5fa0 R15: 00007ffe74de7e58 [ 155.864111][ C0] [ 155.867116][ C0] Modules linked in: [ 155.870995][ C0] ---[ end trace 0000000000000000 ]--- [ 155.876419][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 155.881686][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 a8 dc 28 00 4c 89 ff e8 b0 09 ad 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 1c 51 6d 00 49 8b 7d 00 e8 93 05 [ 155.901266][ C0] RSP: 0000:ffffc90000007c70 EFLAGS: 00010046 [ 155.907306][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffff888111895100 [ 155.915251][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 155.923198][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 155.931143][ C0] R10: ffffed1025ca6939 R11: 1ffff11025ca6939 R12: dffffc0000000000 [ 155.939092][ C0] R13: 0000000000000000 R14: ffff88812e5349c8 R15: 0000000000000008 [ 155.947065][ C0] FS: 00007f51624a06c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 155.955969][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.962530][ C0] CR2: 00000000000000db CR3: 00000001237c9000 CR4: 00000000003506b0 [ 155.970480][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155.978424][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155.986372][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 155.993827][ C0] Kernel Offset: disabled [ 155.998127][ C0] Rebooting in 86400 seconds..