last executing test programs: 7.579316113s ago: executing program 0 (id=17): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b00001900078008000300000000000800020000000000080003000000000008000200000000000800030000000000040004"], 0x7c}}, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000004400)=0x5, 0x4) r4 = fsopen(&(0x7f0000000580)='tracefs\x00', 0x0) fcntl$dupfd(r4, 0x404, r4) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={0x20, 0x1, 0x1, 0x301, 0x0, 0x0, {0x0, 0x0, 0x2}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x24045085) 7.520311647s ago: executing program 0 (id=18): mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x2010800, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYRESHEX], 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x234, &(0x7f0000000340)={[{0x9f, 0x4e00, "7aaabda48bf45ddcbd7ad7955b586a715df0e03b1fdc9ee92625c4b41390635a5464214a0dd2bc3644f35c8c6a1ac728dd13c8e95624dcbc49b4ac390a6a9e7d33d7858288be49746190e450aedbc099f0c52b31424adc3bd36493cd74d2ca69eac1ba5ca8d291daf92b972ba7b57a1d277e3b4e234d879281745d8d47c3547989c5884228f2ba2f1e9318ef12202b00f96678bf88a9fb20a337f4f4fbd6e5"}, {0xa1, 0x4e00, "d10393b44b3a194aca1d411fd65844c23955e5db2d74c9cd352645a3ac2b2b05c7049c874fb5ea14f7763f553fba02374d4ba8eaf9441ce4f1033b4468b8f2cac76a83b917a91b6c0d0be67926ad5db51129e43baf92a285b830c4a241be1eafe6acb68d74983138bc5490ff520c678ab72ea0b038d143dabf499dc0910bbb67af07402a3550172d753f48f2cae5492300e19d9caf1b42c40fda2f3bd9da389487"}, {0xe1, 0x4e00, "755e35c626ecc043a35b252919fbb45e84ab2053635eb7f6aeae5e57630e34c9e6e14811595e293e7980f5309af1e326830de25911b77a8d6df4e807e1840c9121172d865353c36120ecb8ef2bb4fac42c3f1ccd8c953b6b4e027377686a1bae960908cf20aaf59a68067ef6e5b23a0a03e92e6faea88fa9412097114323f093f397f1102cec4ac5ffa6e47058f61c6939db345dec0f7845f51626791e8e59a52877db342185631fccd7c15014b9c1ebb6dafe6871b7435ca2e88937a8123da9fa3e77dd49aedef5ef56e409c6e3cf1d94782e6eab05a94c4974d3926bc6818c76"}]}) 4.454692117s ago: executing program 0 (id=36): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000008bd284200000000000001090224000100000000090400000132d20200092100000101220700090581030004000000"], 0x0) r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r3, &(0x7f00000000c0)=""/55, 0x37) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) landlock_create_ruleset(0x0, 0x0, 0x2) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x3ff, 0x8006}, 0x4) sendto$inet6(r4, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x0, 0x27, 0x7, {0x7, 0xc, "000000b008"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x8) 4.2299075s ago: executing program 1 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000003c0)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)={0x2, 0x13, 0x0, 0x6, 0x2, 0x0, 0xffffffff}, 0x10}}, 0x4000840) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="601004000000cf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000000)={0x0, 0x1, 0xff, 0x9}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000013c0)={0x44, &(0x7f00000011c0)={0x20, 0x14, 0x4, "0426fd98"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000fc0)={0x84, &(0x7f0000000c80)={0x20, 0x0, 0x4, "f670e000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000280)={0x14, &(0x7f00000004c0)={0x0, 0x23, 0xf9, {0xf9, 0x18, "669acda9939ea29083efb2943458302d4f3650c0076921a3227e40725f548d31f7799b94827aad7bef4943b0ddcf4ad438591f713912b72a169ad434132533b730d741ee15b369445131b5ecccb5e7ffde0f308705fd6cf765dccb169f10bfd092299f9373489d7d2d355c7079130b26dc28c0199e0531879e7bbe66cc0850d22beeb5409e4b5ca027dcd54e83f60b1cabfa740ca4eb56ae806234faaf419e23a47322134b79983d38eba053aa729c385a093fae7248d506d2bd537e06f602afeb2321098c73cd68ccafd7ff34a574661a2e84bbb3526dd590a8eeef22b2fcddd2850f9fbc8f6db38915cb05213094f0ab55b5f5713733"}}, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000840)={0x44, &(0x7f00000005c0)={0x40, 0x7, 0x45, "ff567e7171476771e005093597d353305790f62fdb326e463956f380639a62b8a6dbe514720f54c02039f5727f7fb1d675a217c76e8c8e35da246b0ab41200453da4985271"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x7e}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x55}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x6, 0x3, 0xc97, 0x8, 0x0, 0x8, 0x2, 0xfffffff7, 0x5, 0x7, 0x0, 0x9}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x99}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f00000007c0)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000000800)={0x20, 0x89, 0x2, 0x1}}) 2.082569677s ago: executing program 2 (id=48): epoll_create(0x8) socket$igmp(0x2, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0xffffffffffffff8b}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) pipe(&(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.935226716s ago: executing program 2 (id=49): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=@updpolicy={0x1fc, 0x13, 0x1, 0x70bd2b, 0x0, {{@in6=@private0, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x2b, 0x0, 0xee01}, {0x0, 0x0, 0x6}, {0x0, 0xfffffffffffffffc, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@tmpl={0x144, 0x5, [{{@in=@multicast1, 0x4d6, 0x33}, 0xa, @in=@broadcast, 0x3501, 0x3, 0x3, 0x2, 0x4, 0x9, 0x9}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d4, 0x32}, 0xa, @in=@multicast2, 0x3503, 0x4, 0x1, 0x5b, 0x5, 0x8}, {{@in6=@loopback, 0x4d6, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x2, 0xf8, 0x8, 0x2, 0x1}, {{@in6=@loopback, 0x4d4, 0x3c}, 0xa, @in6=@loopback, 0x3507, 0x0, 0x2, 0x9, 0x8659, 0x8, 0x1}, {{@in6=@mcast1, 0x4d3, 0x6c}, 0xa, @in6=@mcast2, 0x3504, 0x2, 0x0, 0x6, 0x8320, 0x1, 0x8001}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x4010}, 0x4000) 1.893909938s ago: executing program 2 (id=50): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) 1.838762491s ago: executing program 2 (id=51): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f0000000340)={0x20, 0x3, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x85, &(0x7f0000000540)="72ce8de1b7657b913306c9fe6704be7c7077467ddb9dfaad90b10cdeeba1641452c94769e07cc1dd762e8033000000b589780223e68fc187bb0fb5f90cb1f23bbef3b43838da9741d5bcc0e476b4715173164bf196bdec192d510018eec5f8bdecfed8b4d3d0083af8d0a1beaeabab1dedabf80be38c0a84158ebdfd55645fe28387808d5c") 1.435640055s ago: executing program 0 (id=52): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket(0x1e, 0x1, 0x0) connect$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r4 = socket(0x1e, 0x1, 0x0) sendmmsg$sock(r4, &(0x7f0000000600)=[{{&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x1}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{&(0x7f0000000080)=@tipc=@name={0x1e, 0x2, 0x1}, 0x80, 0x0}}], 0x2, 0x0) 1.18947264s ago: executing program 1 (id=57): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c802, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x30, 0x0, 0x81, 0xfffff00c}, {0x6, 0x0, 0x5, 0x12e}]}, 0x10) sendto$inet(r0, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) 1.163801942s ago: executing program 1 (id=58): r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x3ec, 0x1, 0x0, 0x0, {0x2}}, [], {0x14, 0x3f2, 0x1, 0x0, 0x0, {0xa}}}, 0x28}}, 0x4000000) 1.106575655s ago: executing program 1 (id=59): r0 = socket$inet6(0xa, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 530.814649ms ago: executing program 0 (id=63): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 530.638189ms ago: executing program 0 (id=64): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x803, 0x0) r1 = epoll_create1(0x0) ppoll(&(0x7f00000000c0)=[{r1, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 293.191743ms ago: executing program 3 (id=65): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@rights={{0x14, 0x1, 0x1, [r1]}}], 0x18, 0x4000000}, 0x0) recvmsg(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002d00)=""/78, 0x4e}, 0x0) 278.003954ms ago: executing program 3 (id=66): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x560f, &(0x7f0000000000)) 215.626108ms ago: executing program 3 (id=67): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$cont(0x18, r0, 0x2, 0x8) 215.314518ms ago: executing program 1 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'}) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x41, 0x0, 0x40, 0x0, 0x4, 0x7, 0xf3, 0x3, 0x2, 0x4, 0x6, 0xa, 0x0, 0x8, 0x5, 0x0, 0x7, 0x2, 0x0, '\x00', 0x3, 0x6}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]}) 215.121507ms ago: executing program 3 (id=69): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) eventfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 108.063854ms ago: executing program 3 (id=70): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000200)={0x8002, 0xf2d7, 0x6, 0xfffffff8, 0x6, "f072e96401ac8ff59f7dcb6105fe106a526548", 0x7, 0x1}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000080)) 92.462565ms ago: executing program 2 (id=71): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fstat(r0, 0x0) recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x12142, 0x0) 14.606139ms ago: executing program 3 (id=72): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x80, 0x1) mkdirat(r0, &(0x7f00000002c0)='./file0\x00', 0x40) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, 0x0) socket$key(0xf, 0x3, 0x2) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000600)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x926, 0x3333, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x3, 0x10, 0x5, [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x2, 0x80, {0x9, 0x21, 0x7, 0x3, 0x1, {0x22, 0xf81}}, {{{0x9, 0x5, 0x81, 0x3, 0x48, 0xf, 0xb, 0x2}}}}}]}}]}}, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, &(0x7f0000000cc0)={0x24, 0x0, &(0x7f0000000c00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x80a}}, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(0xffffffffffffffff, 0x80089419, 0x0) r2 = openat(0xffffffffffffffff, 0x0, 0x250741, 0x90) clock_gettime(0x0, 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 14.43075ms ago: executing program 2 (id=73): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) unshare(0x64000600) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) socket$inet_udp(0x2, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x50000, 0x0, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000240)) socket$inet6_udplite(0xa, 0x2, 0x88) 0s ago: executing program 1 (id=74): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xa5) mount$incfs(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000040), 0x200000, &(0x7f0000000000)={[{@rlog_pages={'rlog_pages', 0x3d, 0xfffffffffffffffd}}]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.176' (ED25519) to the list of known hosts. [ 27.397678][ T36] audit: type=1400 audit(1770070581.490:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.401120][ T282] cgroup: Unknown subsys name 'net' [ 27.420521][ T36] audit: type=1400 audit(1770070581.490:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.447714][ T36] audit: type=1400 audit(1770070581.520:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.448285][ T282] cgroup: Unknown subsys name 'devices' [ 27.607380][ T282] cgroup: Unknown subsys name 'hugetlb' [ 27.613014][ T282] cgroup: Unknown subsys name 'rlimit' [ 27.707673][ T36] audit: type=1400 audit(1770070581.800:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.731064][ T36] audit: type=1400 audit(1770070581.800:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 27.755958][ T36] audit: type=1400 audit(1770070581.800:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 27.759838][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 27.787978][ T36] audit: type=1400 audit(1770070581.880:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.813522][ T36] audit: type=1400 audit(1770070581.880:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.841476][ T36] audit: type=1400 audit(1770070581.930:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.842674][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.867024][ T36] audit: type=1400 audit(1770070581.930:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.724246][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.731574][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.738776][ T289] bridge_slave_0: entered allmulticast mode [ 28.745480][ T289] bridge_slave_0: entered promiscuous mode [ 28.753218][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.760450][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.767708][ T289] bridge_slave_1: entered allmulticast mode [ 28.773958][ T289] bridge_slave_1: entered promiscuous mode [ 28.849859][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.857153][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.864370][ T290] bridge_slave_0: entered allmulticast mode [ 28.870792][ T290] bridge_slave_0: entered promiscuous mode [ 28.877603][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.884684][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.891855][ T290] bridge_slave_1: entered allmulticast mode [ 28.898325][ T290] bridge_slave_1: entered promiscuous mode [ 28.958552][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.965777][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.972867][ T291] bridge_slave_0: entered allmulticast mode [ 28.979253][ T291] bridge_slave_0: entered promiscuous mode [ 28.988694][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.995815][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.003080][ T291] bridge_slave_1: entered allmulticast mode [ 29.009427][ T291] bridge_slave_1: entered promiscuous mode [ 29.064128][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.071353][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.078564][ T295] bridge_slave_0: entered allmulticast mode [ 29.084999][ T295] bridge_slave_0: entered promiscuous mode [ 29.094317][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.101469][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.108624][ T295] bridge_slave_1: entered allmulticast mode [ 29.115007][ T295] bridge_slave_1: entered promiscuous mode [ 29.195421][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.202508][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.209875][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.217059][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.247701][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.254813][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.262203][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.269283][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.287959][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.295056][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.302361][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.309430][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.342219][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.349319][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.356640][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.364230][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.383551][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.390965][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.398493][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.406314][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.413695][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.420982][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.428341][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.435693][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.459997][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.467083][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.474733][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.481781][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.493128][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.500221][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.518746][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.525875][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.550272][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.557350][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.564986][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.572032][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.590546][ T291] veth0_vlan: entered promiscuous mode [ 29.605912][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.612997][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.636891][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.643964][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.657406][ T291] veth1_macvtap: entered promiscuous mode [ 29.668901][ T289] veth0_vlan: entered promiscuous mode [ 29.678272][ T290] veth0_vlan: entered promiscuous mode [ 29.706611][ T289] veth1_macvtap: entered promiscuous mode [ 29.726779][ T290] veth1_macvtap: entered promiscuous mode [ 29.733869][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 29.739106][ T295] veth0_vlan: entered promiscuous mode [ 29.802332][ T295] veth1_macvtap: entered promiscuous mode [ 29.857385][ T341] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 30.136236][ T369] fuse: Unknown parameter 'roovmode' [ 30.227587][ T374] netlink: 'syz.1.15': attribute type 4 has an invalid length. [ 30.235519][ T374] netlink: 17 bytes leftover after parsing attributes in process `syz.1.15'. [ 30.331730][ T380] netlink: 28 bytes leftover after parsing attributes in process `syz.0.17'. [ 30.465089][ T387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20'. [ 30.663498][ T397] netlink: 4 bytes leftover after parsing attributes in process `syz.2.23'. [ 30.694862][ T331] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.834445][ T31] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 30.842044][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.015598][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.025856][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 31.048275][ T31] usb 2-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 31.074634][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.094569][ T31] usb 2-1: config 0 descriptor?? [ 31.144624][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.238165][ T404] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=37892 sclass=netlink_xfrm_socket pid=404 comm=syz.2.25 [ 31.334795][ T395] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.394510][ T331] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.484475][ T395] usb 4-1: Using ep0 maxpacket: 8 [ 31.490757][ T395] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 31.500416][ T395] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.512331][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 31.519130][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 31.533754][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.547723][ T31] usb 2-1: USB disconnect, device number 2 [ 31.784479][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.835433][ T31] usb 4-1: USB disconnect, device number 2 [ 31.894554][ T331] usb usb1-port1: attempt power cycle [ 32.234519][ T331] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 32.255531][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.268858][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 32.297895][ T417] overlay: filesystem on ./bus not supported as upperdir [ 32.308053][ T417] overlay: filesystem on ./bus not supported as upperdir [ 32.317499][ T417] overlay: filesystem on ./bus not supported as upperdir [ 32.324877][ T417] overlay: Unknown parameter '' [ 32.387125][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.429663][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.440666][ T31] usb 2-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 32.442356][ T425] fuse: Unknown parameter '&$*jȧDIm8-qH{SIuQBCH_nϞrwpd' [ 32.449783][ T36] kauditd_printk_skb: 106 callbacks suppressed [ 32.449800][ T36] audit: type=1400 audit(1770070586.530:180): avc: denied { mounton } for pid=424 comm="syz.3.33" path="/4/file0" dev="tmpfs" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 32.449888][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.499176][ T31] usb 2-1: config 0 descriptor?? [ 32.634470][ T331] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 32.638251][ T87] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.655709][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.785710][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.794475][ T87] usb 3-1: Using ep0 maxpacket: 16 [ 32.802408][ T87] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 32.811642][ T87] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.819933][ T87] usb 3-1: Product: syz [ 32.824162][ T87] usb 3-1: Manufacturer: syz [ 32.828869][ T87] usb 3-1: SerialNumber: syz [ 32.840146][ T87] r8152-cfgselector 3-1: Unknown version 0x0000 [ 32.847935][ T87] r8152-cfgselector 3-1: config 0 descriptor?? [ 32.894690][ T331] usb usb1-port1: unable to enumerate USB device [ 32.907659][ T31] zeroplus 0003:0C12:0005.0001: unknown main item tag 0x0 [ 32.915922][ T31] zeroplus 0003:0C12:0005.0001: hidraw0: USB HID v0.02 Device [HID 0c12:0005] on usb-dummy_hcd.1-1/input0 [ 32.927867][ T31] zeroplus 0003:0C12:0005.0001: no inputs found [ 33.109510][ T412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.118140][ T412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.128660][ T31] usb 2-1: USB disconnect, device number 3 [ 33.256929][ T36] audit: type=1400 audit(1770070587.350:181): avc: denied { bind } for pid=420 comm="syz.2.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.277527][ T36] audit: type=1400 audit(1770070587.350:182): avc: denied { mount } for pid=420 comm="syz.2.31" name="/" dev="ramfs" ino=4643 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 33.282844][ T421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.309898][ T421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.319278][ T31] r8152-cfgselector 3-1: USB disconnect, device number 2 [ 33.397080][ T36] audit: type=1400 audit(1770070587.490:183): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 33.531294][ T36] audit: type=1400 audit(1770070587.620:184): avc: denied { create } for pid=439 comm="syz.3.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.551297][ T36] audit: type=1400 audit(1770070587.620:185): avc: denied { write } for pid=439 comm="syz.3.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.574464][ T36] audit: type=1400 audit(1770070587.620:186): avc: denied { read } for pid=439 comm="syz.3.37" dev="nsfs" ino=4026532578 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 33.597800][ T36] audit: type=1400 audit(1770070587.620:187): avc: denied { open } for pid=439 comm="syz.3.37" path="net:[4026532578]" dev="nsfs" ino=4026532578 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 33.620797][ T36] audit: type=1400 audit(1770070587.630:188): avc: denied { create } for pid=439 comm="syz.3.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 33.640094][ T36] audit: type=1400 audit(1770070587.630:189): avc: denied { connect } for pid=439 comm="syz.3.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 33.804610][ T395] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 33.834449][ T87] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.904610][ T433] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 33.955567][ T395] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.966965][ T395] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 33.984454][ T395] usb 1-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 33.986167][ T87] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.993611][ T395] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.012137][ T87] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 34.012482][ T395] usb 1-1: config 0 descriptor?? [ 34.021140][ T87] usb 4-1: New USB device found, idVendor=056a, idProduct=0028, bcdDevice= 0.00 [ 34.035149][ T87] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.040564][ T437] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.050670][ T87] usb 4-1: config 0 descriptor?? [ 34.064560][ T433] usb 2-1: Using ep0 maxpacket: 32 [ 34.070798][ T433] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 34.079061][ T433] usb 2-1: config 0 has no interface number 0 [ 34.085212][ T433] usb 2-1: config 0 interface 184 has no altsetting 0 [ 34.093233][ T433] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 34.102329][ T433] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.110403][ T433] usb 2-1: Product: syz [ 34.114644][ T433] usb 2-1: Manufacturer: syz [ 34.119259][ T433] usb 2-1: SerialNumber: syz [ 34.125029][ T433] usb 2-1: config 0 descriptor?? [ 34.125891][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.138613][ T433] smsc75xx v1.0.0 [ 34.285627][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.296596][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.306447][ T31] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 34.315545][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.324482][ T31] usb 3-1: config 0 descriptor?? [ 34.539044][ T433] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 34.549991][ T433] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 34.559738][ T433] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 34.570126][ T433] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 34.936193][ T451] fuse: Unknown parameter 'ma_read' [ 34.943160][ T31] hid-led 0003:27B8:01ED.0002: probe with driver hid-led failed with error -71 [ 34.953400][ T31] usb 3-1: USB disconnect, device number 3 [ 35.684569][ T464] capability: warning: `syz.2.45' uses 32-bit capabilities (legacy support in use) [ 36.254443][ T331] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 36.405600][ T331] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.416865][ T331] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 36.425949][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.435068][ T331] usb 3-1: config 0 descriptor?? [ 36.447520][ T433] usb 1-1: USB disconnect, device number 6 [ 36.622570][ T433] usb 4-1: USB disconnect, device number 3 [ 36.696585][ T31] usb 2-1: USB disconnect, device number 4 [ 36.846327][ T331] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 36.858630][ T331] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.0003/input/input4 [ 36.938071][ T331] keytouch 0003:0926:3333.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 37.261802][ T433] usb 3-1: USB disconnect, device number 4 [ 37.667248][ T525] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.681511][ T36] kauditd_printk_skb: 22 callbacks suppressed [ 37.681528][ T36] audit: type=1400 audit(1770070591.770:212): avc: denied { ioctl } for pid=524 comm="syz.1.68" path="socket:[4937]" dev="sockfs" ino=4937 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.712324][ T36] audit: type=1400 audit(1770070591.780:213): avc: denied { read write } for pid=526 comm="syz.3.69" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.736664][ T36] audit: type=1400 audit(1770070591.780:214): avc: denied { open } for pid=526 comm="syz.3.69" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.761069][ T36] audit: type=1400 audit(1770070591.790:215): avc: denied { ioctl } for pid=526 comm="syz.3.69" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.819153][ T36] audit: type=1400 audit(1770070591.910:216): avc: denied { read } for pid=532 comm="syz.2.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.902282][ T539] ------------[ cut here ]------------ [ 37.907874][ T539] WARNING: CPU: 1 PID: 539 at mm/page_alloc.c:5234 __alloc_pages_noprof+0x109/0x7e0 [ 37.917438][ T539] Modules linked in: [ 37.921428][ T539] CPU: 1 UID: 0 PID: 539 Comm: syz.1.74 Not tainted syzkaller #0 d2070f6ccd239e5a47ec9c1c2f682235c3170fcc [ 37.932919][ T539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 37.943071][ T539] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 37.949221][ T539] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 9a b7 0b 06 00 0f 85 c2 00 00 00 c6 05 8d b7 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 37.969038][ T539] RSP: 0018:ffffc9000b997860 EFLAGS: 00010246 [ 37.975186][ T539] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 [ 37.983197][ T539] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b997918 [ 37.991236][ T539] RBP: ffffc9000b997988 R08: ffffc9000b997917 R09: 0000000000000000 [ 37.999277][ T539] R10: ffffc9000b997900 R11: fffff52001732f23 R12: ffffc9000b9978a0 [ 38.007320][ T539] R13: dffffc0000000000 R14: 1ffff92001732f10 R15: 0000000000000000 [ 38.015447][ T539] FS: 00007fa4cd5896c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.024486][ T539] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.031117][ T539] CR2: 00007fa4cc6708c0 CR3: 000000011a578000 CR4: 00000000003526b0 [ 38.039155][ T539] Call Trace: [ 38.042470][ T539] [ 38.045496][ T539] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.051619][ T539] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 38.057429][ T539] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 38.063113][ T539] ___kmalloc_large_node+0x81/0x210 [ 38.068417][ T539] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 38.074091][ T539] __kmalloc_large_node_noprof+0x1e/0xd0 [ 38.079810][ T539] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 38.085524][ T539] __kmalloc_noprof+0x326/0x500 [ 38.090432][ T539] ? __cfi_lockref_get+0x10/0x10 [ 38.095449][ T539] incfs_realloc_mount_info+0xa7/0x4d0 [ 38.100950][ T539] ? incfs_add_sysfs_node+0x118/0x230 [ 38.106400][ T539] incfs_alloc_mount_info+0x478/0x5f0 [ 38.111816][ T539] incfs_mount_fs+0x3ca/0x970 [ 38.116575][ T539] ? __cfi_incfs_mount_fs+0x10/0x10 [ 38.121815][ T539] ? vfs_parse_fs_string+0x10f/0x180 [ 38.127258][ T539] ? selinux_capable+0x38/0x50 [ 38.132073][ T539] legacy_get_tree+0x106/0x1b0 [ 38.136946][ T539] ? __cfi_incfs_mount_fs+0x10/0x10 [ 38.142229][ T539] vfs_get_tree+0xa1/0x290 [ 38.146767][ T539] do_new_mount+0x251/0xb30 [ 38.151320][ T539] ? security_capable+0x44/0x130 [ 38.156336][ T539] path_mount+0x682/0x1010 [ 38.160801][ T539] __se_sys_mount+0x2bf/0x480 [ 38.165557][ T539] ? __x64_sys_mount+0xf0/0xf0 [ 38.170382][ T539] ? __kasan_check_write+0x18/0x20 [ 38.175565][ T539] ? fpregs_restore_userregs+0x11c/0x260 [ 38.181235][ T539] __x64_sys_mount+0xc3/0xf0 [ 38.185909][ T539] x64_sys_call+0x2021/0x2ee0 [ 38.190632][ T539] do_syscall_64+0x57/0xf0 [ 38.195121][ T539] ? clear_bhb_loop+0x50/0xa0 [ 38.199846][ T539] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.205837][ T539] RIP: 0033:0x7fa4cc79aeb9 [ 38.210308][ T539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.229984][ T539] RSP: 002b:00007fa4cd589028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 38.238477][ T539] RAX: ffffffffffffffda RBX: 00007fa4cca15fa0 RCX: 00007fa4cc79aeb9 [ 38.246512][ T539] RDX: 0000200000000040 RSI: 0000200000000200 RDI: 0000200000000180 [ 38.254554][ T539] RBP: 00007fa4cc808c1f R08: 0000200000000000 R09: 0000000000000000 [ 38.262571][ T539] R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000 [ 38.270667][ T539] R13: 00007fa4cca16038 R14: 00007fa4cca15fa0 R15: 00007ffc5a401d98 [ 38.278709][ T539] [ 38.281776][ T539] ---[ end trace 0000000000000000 ]--- [ 38.287852][ T539] incfs: Error allocating mount info. -12 [ 38.293663][ T539] incfs: mount failed -12 [ 38.414440][ T331] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 38.565994][ T331] usb 4-1: unable to get BOS descriptor or descriptor too short [ 38.574203][ T331] usb 4-1: not running at top speed; connect to a high speed hub [ 38.583070][ T331] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 72, setting to 64 [ 38.594147][ T331] usb 4-1: config 1 interface 0 has no altsetting 0 [ 38.602530][ T331] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 38.612151][ T331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.620436][ T331] usb 4-1: Product: syz [ 38.624871][ T331] usb 4-1: Manufacturer: syz [ 38.629540][ T331] usb 4-1: SerialNumber: syz [ 38.636917][ T537] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 39.048346][ T331] usbhid 4-1:1.0: can't add hid device: -71 [ 39.054461][ T331] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 39.065034][ T331] usb 4-1: USB disconnect, device number 4