last executing test programs: 3.444580267s ago: executing program 3 (id=1219): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x20, {[@global=@item_012={0x2, 0x1, 0x9, "0100"}, @global=@item_012={0x2, 0x1, 0x0, "0100"}, @main=@item_4, @main=@item_012={0x0, 0x0, 0x8}, @global=@item_012={0x1, 0x1, 0x8, '8'}, @main=@item_4={0x3, 0x0, 0x9, "22110700"}, @local=@item_012={0x2, 0x2, 0x8, "3994"}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "ce9abc16"}]}}, 0x0}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x60, 0x0, 0x0) 2.88643057s ago: executing program 3 (id=1222): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="400000001f00d9daf79222eafdc7cc3e2a5f472a72010027bd7000fedbdf25fe8000000000000000000000000000bb000004d602006c007f0000010000000000"], 0x40}, 0x1, 0x0, 0x0, 0x5}, 0x40040) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x4e24, @loopback}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x184, 0x0, 0x0, 0xfdffffffffffffff, 0x0, &(0x7f0000000480)='bond_slave_0\x00', 0x0, 0x6000000, 0x3}) r2 = socket$packet(0x11, 0x2, 0x300) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r3, 0x4008af04, &(0x7f00000001c0)=&(0x7f0000000140)) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000780)=""/77, 0x0, 0x8080000}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f0000000200)='.\x00', 0x10000a0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@index_on}], [{@subj_role={'subj_role', 0x3d, 'blkio.bfq.io_wait_time_recursive\x00'}}, {@dont_measure}], 0x2c}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = socket(0x1e, 0x1, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x8a, &(0x7f0000000140)=0x7, 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x14, 0x3a, 0x229, 0x0, 0xfffffffd, {0xa}}, 0x14}, 0x1, 0x6000000}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(r4, &(0x7f0000000280)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$RTC_SET_TIME(r8, 0x4024700a, &(0x7f0000000040)={0x21, 0x9, 0x0, 0x2, 0x9, 0xca, 0x1, 0xf}) setsockopt$packet_int(r7, 0x107, 0xe, &(0x7f0000000000)=0x7, 0x4) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x0, 0x2000011, r2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x2, 0x7, 0xe, 0xe, 0x8, 0x2, 0x5, 0x7, 0x4, [0x5, 0x5, 0x8, 0x55, 0x8000, 0xe7, 0x1, 0x8]}}) 2.88620709s ago: executing program 3 (id=1223): r0 = fsopen(&(0x7f0000000080)='exfat\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ab43, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) 2.882670458s ago: executing program 3 (id=1224): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1={0xfc, 0x1, '\x00', 0x4}, 0x0, 0x8000}}) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000000480)={0x2, 0x3, 0x0, 0x0, 0xc, 0x0, 0x0, 0x4, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x6c, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e20}, @sadb_x_nat_t_type={0x1, 0x14, 0x3}]}, 0x60}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000640)={'ip6_vti0\x00', r4, 0x0, 0x0, 0x3, 0x0, 0x0, @loopback, @empty, 0x0, 0x0, 0x0, 0x6}}) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000280)=@newae={0x54, 0x1e, 0x4, 0x70bd27, 0x25dfdbff, {{@in=@broadcast, 0x4d6, 0xa, 0x33}, @in=@multicast1, 0xe, 0x9e}, [@srcaddr={0x14, 0xd, @in=@initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000140)="0f30c402fd3eecae660f38800a66b80c010f00d0662e3646d87213460f09b98c0900000f32b8010000000f01c12e644c0fc72f", 0x33}], 0x1, 0x41, 0x0, 0x0) r6 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000200)={@val={0xa, 0x9100}, @void, @eth={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x8, 0x3a, 0xff, @remote, @mcast2, {[], @echo_request={0x80, 0x0, 0x0, 0x0, 0x3}}}}}}}, 0x42) 2.794218168s ago: executing program 3 (id=1225): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000000c0)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="020a3f000700000026bd7000fedbdf2505001a0000000000000000000000000000000000fe8000000000000000000000000000142d0b9c"], 0x38}}, 0x400c800) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="300000000000000000000000070000008907"], 0x30}, 0x4000) r1 = socket$inet(0x2, 0x3, 0x5) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040), 0x208c0, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) connect$inet(r1, &(0x7f0000000340)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r3, 0x0, 0x41, &(0x7f00000003c0)={'filter\x00', 0x7, "f0a23923263408"}, &(0x7f0000000200)=0x2f) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x4, 0x4, 0x3c8, 0xe8, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@remote, @private=0xa010100, 0x0, 0xffffff00, 0x4, 0x7, {@empty, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@random="1e1106f2008e", {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x0, 0x8, 0xd, 0x8, 0x0, 0x6, 'batadv_slave_0\x00', 'bridge_slave_0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d0}}, {{@arp={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff000000, 0xff, 0xd, 0x5, {@empty, {[0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x6, 0x8a2d, 0x1002, 0x100, 0xa, 0xc, 'sit0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x290}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0xff03}}}, {{@arp={@multicast2, @multicast1, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@link_local}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 'xfrm0\x00', 'pim6reg\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0x40) 2.726439839s ago: executing program 3 (id=1226): unshare(0x60000600) r0 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000140)={0x79, 0xac}, 0x0) setreuid(0xee00, 0x0) setresuid(0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x87, 0x8, 0x4000006, 0x8, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x66, 0x0, 0x83, 0x4, 0x0, @multicast1, @private=0xa010102}}}}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_script(r2, &(0x7f0000020240), 0x10010) splice(r1, 0x0, r3, 0x0, 0x100000004, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="20001300110001000000000000000000100000e60b"], 0x20}], 0x1, 0x0, 0x0, 0x4040840}, 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='nsfs\x00', 0x8008, &(0x7f0000000240)='$\x17){&\x00') syz_usb_connect(0x1, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87e7000905880f020000000009050300000000000009050cfeffff01060209050f000000000000090507"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x40, r6, 0x1, 0x70bd29, 0xffffffff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x75}}}}, [@NL80211_ATTR_TX_RATES={0x18, 0x10d, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x14, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x8040000}, 0x44844) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r1, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x4c, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff7, 0x36}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0xbedf98bb109fa810) 1.24027743s ago: executing program 1 (id=1238): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.clone_children\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0xf) (async, rerun: 32) r2 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) sendmsg$netlink(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="20000000110001002dbd7000fcffffff0c00000008000000", @ANYRES32, @ANYBLOB="16002e00"], 0x20}], 0x1}, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) (async) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) process_mrelease(r5, 0x0) (async) ioctl$ASHMEM_GET_NAME(r3, 0x40047705, 0x0) (async) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x27}, 0x74) (async, rerun: 32) r8 = fsmount(r6, 0x0, 0x0) (rerun: 32) fchdir(r8) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) (async) prctl$PR_SET_SECCOMP(0xe, 0x0, 0x0) (async) write$binfmt_script(r3, &(0x7f00000000c0)={'#! ', '', [{0x20, 'freezer.self_freezing\x00'}, {0x20, 'cgroup.events\x00'}], 0xa, "7b920385fdb939ab6da719c227caab312b77ad3583666540f8f5f8869ba7287b1148f6f1966d116f0430fd2a03063ef335d009684e800e7932e99ebf6c40"}, 0x68) (async, rerun: 64) r9 = memfd_create(&(0x7f0000000400)='[\vx\'\xa5)\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\x01\x00\x00\x00\x00\xfb\xff\x00\x00\x81n-\xba\xfb\vb\xd3\xa1\xff3\xdc\x9e\xc7\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xda\xfe\xbe\xd0\x1e\xf9\x0e+\xe9\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x99\x83\xcd\b\xd1\x02R\xaap\x94\x8a\xcd_s\xd0\x95H\x03\xcaQ\xae\x80z8Z\xd2}\xf5\xe4\x9f5\x9b7\xaf\xb7o', 0x1) (async, rerun: 64) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r10, 0x29, 0x40, 0x0, &(0x7f0000000200)) (async) write$binfmt_script(r9, &(0x7f0000000080)={'#! ', './file0', [{0x20, '\t\x00\x00\x00\x00\x00\x00'}]}, 0x13) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) bind$unix(r12, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f00000005c0), 0x0, &(0x7f0000000300)=ANY=[@ANYRES64=r0, @ANYRES32=r0, @ANYRESDEC=r10], 0x18, 0x8010}}], 0x1, 0x0) (async) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) execveat(r9, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 1.200644713s ago: executing program 1 (id=1239): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0xc, 0x43}]}, 0x10) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001581c2908570b2885396d0102030109021b00010001000b0904c80201030102"], 0x0) listen(r0, 0x5) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz1\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x23, [0x9, 0x2, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x5, 0x8, 0x0, 0x6, 0xf5, 0x9, 0x39, 0x747d5a13, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x8, 0xf252, 0x4, 0x800, 0x300000, 0x7, 0x9, 0x4623b, 0x0, 0x0, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x3, 0xba55, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0xe, 0x4, 0x2, 0x0, 0x8, 0x9, 0x1, 0x199f, 0x8, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x40000005, 0x40, 0x9, 0x7, 0x5], [0x6, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0xf7, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x4, 0x100, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x12, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x7fc, 0xffff, 0x6, 0x96, 0xfffffffd, 0x101, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0x200, 0x5, 0x7, 0x6, 0x1000, 0x1, 0xffffffff, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xffff, 0xcd7, 0x7, 0x20, 0x7, 0x4, 0x8, 0x437, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3, 0x1000, 0x2, 0x10, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0xf5e, 0x5, 0x9, 0x2, 0x20000005, 0x80, 0x9, 0x9, 0x47, 0x2, 0x3, 0x4, 0x7, 0x6d7e, 0x403, 0x4, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0xffffffff, 0x4, 0x3, 0x6, 0x100fffe, 0x2005, 0x7, 0x4, 0xea, 0x9, 0x5, 0x2, 0xd9, 0xd, 0x7ff, 0x401, 0x5], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x9, 0x4, 0x50, 0xa, 0x763, 0xb, 0x402, 0x800, 0x2, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x1e0, 0x4, 0xe47, 0x3, 0x3, 0x4, 0x200, 0x1000, 0x403e, 0x2, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0xffffffff, 0x4, 0x4, 0x10, 0x0, 0x0, 0x8003, 0x1, 0xfffffff8, 0x401, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x7, 0xe, 0xffffffff, 0xe, 0x12908500, 0x133, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) read(r1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmmsg$inet(r2, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000040)="42ec6c4eba0e0db8912dde8ff2d341c9ca619478532a41947346bf7444594f32eca724f8c86d56198f179005ac933e00db06fbac2615dc68b01da4c312392a8002d3afa5172fe959fa", 0x49}], 0x1}}], 0x1, 0x480c5) close_range(r0, 0xffffffffffffffff, 0x0) r3 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x0, 0x2, 0x8}, 0x18) getsockopt$TIPC_CONN_TIMEOUT(r3, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r3) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000900)=@newsa={0xf0, 0x10, 0x1, 0x0, 0x0, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@dev={0xac, 0x14, 0x14, 0x28}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@private0={0xfc, 0x0, '\x00', 0xff}, 0x0, 0x6c}, @in6=@remote, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x40}}, 0xf0}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x64000400) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010027bd700002000000140000000c00018008000100", @ANYRES32=r8], 0x20}, 0x1, 0x0, 0x0, 0x144}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1.078084548s ago: executing program 1 (id=1242): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff8, 0x4002, 0x248, 0x401}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x80, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0x1, 0xa2b9, 0x6, 0x4, 0x7, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x2, 0x80000001, 0xa, 0x4, 0x12a3, 0x6, 0x8, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x206, 0x10001, 0x0, 0x8f, 0x4, 0x4, 0x16, 0x1, 0x5, 0x401, 0x3, 0x405, 0x200000a7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0xfffffffe, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffff, 0x9, 0x4], [0xe56, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000063, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x889, 0x4, 0xa6, 0x1000, 0x6, 0x200b398, 0x400001, 0x0, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x6, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7, 0x1, 0x1cb, 0x1, 0x1, 0x6, 0x400438, 0x2, 0x9, 0x95, 0x7fffffff, 0x404, 0xfffffff9, 0x1, 0x1000, 0xe, 0x5], [0x2, 0xfffffffe, 0xf, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x6, 0x18, 0x491, 0x8d3, 0x200006, 0x800d, 0x400, 0x2, 0x400, 0x41, 0x6, 0x1000, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x6, 0x10000, 0x3fc, 0x3e55, 0x4, 0xd3, 0x7, 0x3437, 0x3, 0xd, 0x7, 0x600, 0x101, 0xdd80, 0x60a0, 0x7b, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x2, 0x10002, 0xdffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x5, 0x40, 0x100, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x0, 0x3, 0x9d86, 0xd, 0x9, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x80, 0xfc, 0xd8d2, 0x7fffffff, 0x9, 0xc, 0x30d, 0x5, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x800, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x0, 0x4, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x9, 0x4, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') read$FUSE(r0, &(0x7f0000000440)={0x2020}, 0x2020) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x40000000000035, 0xfff, 0xc, 0x40000000000180, 0xffffffffffffffff, 0x80000000, 0xf2, 0x9, 0xfffffffffffff801, 0x2000000000007, 0x8, 0x7, 0x0, 0x3, 0x4, 0x3], 0x25000, 0x1144}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$BINDER_THREAD_EXIT(r5, 0x40046208, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='nr_inodes=1']) symlink(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='./file0/file0\x00') syz_usb_connect$printer(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100100000008f003040040000102030109022400010140b064090400f202070102000905010200020508080905770200"], 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r7, &(0x7f00000041c0)={0x2020}, 0x2020) poll(&(0x7f00000000c0)=[{r7, 0x1001}], 0x1, 0x4) 718.969559ms ago: executing program 0 (id=1243): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x23f) setuid(0xee01) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x120}, 0x18) unlinkat(r0, &(0x7f00000001c0)='./cgroup\x00', 0x0) mount$binderfs(&(0x7f00000000c0), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000200), 0x108002, &(0x7f0000000240)={[{@max={'max', 0x3d, 0x2}}, {@stats}, {@max={'max', 0x3d, 0x2}}], [{@fsmagic={'fsmagic', 0x3d, 0x6}}, {@pcr={'pcr', 0x3d, 0x17}}, {@smackfsfloor={'smackfsfloor', 0x3d, ']$'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}]}) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') (async) chmod(&(0x7f0000000180)='./file0\x00', 0x23f) (async) setuid(0xee01) (async) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x120}, 0x18) (async) unlinkat(r0, &(0x7f00000001c0)='./cgroup\x00', 0x0) (async) mount$binderfs(&(0x7f00000000c0), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000200), 0x108002, &(0x7f0000000240)={[{@max={'max', 0x3d, 0x2}}, {@stats}, {@max={'max', 0x3d, 0x2}}], [{@fsmagic={'fsmagic', 0x3d, 0x6}}, {@pcr={'pcr', 0x3d, 0x17}}, {@smackfsfloor={'smackfsfloor', 0x3d, ']$'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}]}) (async) 697.72465ms ago: executing program 0 (id=1244): setuid(0xee01) socket$nl_audit(0x10, 0x3, 0x9) r0 = socket$packet(0x11, 0x2, 0x300) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='coredump_filter\x00') write$P9_RREAD(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="270000006b7192411fc65c6bf5442aacad6713103505ce01f7a931f842446d64d459643a647d6768d82ef16a4400000000000000"], 0x32) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x101, 0x1) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x24000001}, 0x800) read(r5, &(0x7f0000000340)=""/209, 0xd1) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80040, 0xb1) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r7 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) pwritev2(r7, &(0x7f00000014c0)=[{&(0x7f00000002c0)='=', 0x1}], 0x1, 0xff, 0x1, 0x24) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)}, {0x0}], 0x2, 0x0, 0x18}}], 0x1, 0x4048004) pwritev(r6, &(0x7f0000000600)=[{&(0x7f0000000200)="0200fed908c5900000", 0x9}], 0x1000000000000041, 0xfffffffd, 0x7) r8 = openat$cgroup_procs(r2, &(0x7f0000000180)='tasks\x00', 0x2, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r9, 0x28, 0x0, 0x0, 0x17) pread64(r8, &(0x7f0000002840)=""/4089, 0xff9, 0x1) sendfile(r3, r3, 0x0, 0xa7f2) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x6, 0x10038, 0x1000, 0x37, 0x958e, 0x2, 0x5}, 0x1c) socket$inet6(0xa, 0x80002, 0x0) 610.450761ms ago: executing program 0 (id=1245): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x7f, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x6, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x4, 0x6, 0x3, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0xffe, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x4, 0x8009, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x7fffffff], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0xfc, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x2000009, 0x5, 0x2, 0x2, 0x9, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xb8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x6, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x5, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x0, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)={0x1, 0x0, [{0x1a0, 0x0, 0xfffffffffffff800}]}) 576.292566ms ago: executing program 1 (id=1246): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'hsr0\x00', {0x2, 0x0, @loopback}}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d80), r1) sendmsg$IEEE802154_DISASSOCIATE_REQ(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="010129b47000ffdbdf252a"], 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x4810) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x1) syz_clone3(&(0x7f00000006c0)={0x42000000, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'hsr0\x00', {0x2, 0x0, @loopback}}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d80), r1) (async) sendmsg$IEEE802154_DISASSOCIATE_REQ(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="010129b47000ffdbdf252a"], 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x4810) (async) openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$TCXONC(r3, 0x540a, 0x1) (async) syz_clone3(&(0x7f00000006c0)={0x42000000, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) (async) 463.062876ms ago: executing program 1 (id=1247): mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x4, 0x6031, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000000)={'vlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wake_lock', 0x202, 0xc4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syz_tun\x00', 0x8000}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001800090200ffe6000000000002"], 0x20}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r4 = socket(0x1e, 0x1, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r4, 0x10f, 0x8a, &(0x7f0000000140)=0x7, 0x4) sendfile(r1, r1, &(0x7f0000000280)=0xffffffff, 0x5) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TIOCSETD(r6, 0x80045440, &(0x7f0000000040)=0x15) r7 = socket$netlink(0x10, 0x3, 0x0) syz_open_dev$rtc(&(0x7f0000000180), 0x9, 0x80) sendmsg$netlink(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001300010002000000f6dbdf2507000000130000000800ff00", @ANYRES32, @ANYBLOB="749fc664528f24bc0a96200f0a44cc971cef04ef2f2910493dc05cc77c4848585561cf4a4e16620a40cc173caef68fe29ac4b1ef8a2e"], 0x20}], 0x1}, 0x0) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r5, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x9}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) 402.389039ms ago: executing program 1 (id=1248): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) getpgid(0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bff000/0x400000)=nil) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r3, &(0x7f0000000100)={0x9da, 0xff, 0x0, 0x0, 0xfd}, 0x8) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, 0x0}) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000200)={{0xeeef0000, 0x1, 0xb, 0xd, 0x8, 0x9, 0x6, 0x1, 0x0, 0x3, 0x5, 0xeb}, {0xdddd0000, 0x8000000, 0xa, 0xe, 0x5, 0x7, 0x4, 0x14, 0xec, 0x5, 0x0, 0x43}, {0xf000, 0xb000, 0xb, 0x8, 0x4, 0x9, 0x81, 0x3, 0x7c, 0xff, 0x4, 0x2}, {0x5000, 0x10000, 0x0, 0xfe, 0x6, 0xaa, 0x1, 0x0, 0xa, 0x4, 0x80, 0xe}, {0x0, 0x2000, 0xc, 0xff, 0x3, 0x9, 0x6, 0x7, 0x4, 0x6, 0x8, 0xfc}, {0x1000, 0x41000, 0x9, 0xb9, 0x9, 0x5, 0x4, 0x3, 0x7, 0x1, 0xfd, 0x1}, {0xd5dd0000, 0x0, 0xa, 0x1, 0xc, 0x8, 0x6, 0x1f, 0xa, 0x1, 0x14, 0xe}, {0x4, 0xdddcc004, 0xb, 0x21, 0x5, 0x8, 0x8, 0xc7, 0x7, 0x8, 0x43, 0x3}, {0xd000, 0x5}, {0xffff1000, 0x5}, 0x40010020, 0x0, 0xeeeef000, 0x40738, 0x8, 0x8000, 0xeeee0c00, [0xfffffffffffffffe, 0x3, 0x7, 0x5]}) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000740)={"d28cbffc70113aa16b365924c3128c89fe8764c41caa3ec7a095ce3692ae1fe3160c3dd483cc71d285c48c8fa445272281beb44357aa96da39f0ef45a90bfac537ba4c98038e0b871c2ba811d3d568ccdddd1e0e7edef9061d12bdd0fc1c83093613293d1779955c62df6a03c3a539051393b577bb6645c4ed2ddfd06df82c7359de2082e16a4c302d18db9ce698f22b519d55adbbe4881dda46ddbbab0a1ca428e404f0640e62eb7d76c8ca94cff34f26de20c2f44c22228eee44edcbec829ed8b5f24a8259fcc97d67b96441486cf9832274eff5271d3843178cd90827052ef8e6dee13ef4f8e23b8396f5bc4b03b8ee875350ac778233a13551f55cac915ce11f145063ef5b5111272d0859d6cdb62ab72a92f24d83ef5ff87aa8f6eae3986c403add562c0a17839921dea6186d3b71b3d466070a005541677a477392f9a499322ed2f09c6e1b401ad81bb6673274e7c344152c2617edc2f667329b51bcc9d235de56d8642823643e0107339044417e2708d10e7dafefb5b2e72f696e1dc37c48f3c9266c9c8d2e771aabd4b7e4e7c2bccde0345d5d43ad7a4d98e9e1e3e152784ca29d286fe783f3579055a428ab231b9e81d77bd8ca4007607cd2ff60953a2d68353c4cc677124b7431edca5f604841f3baa90d46235ddaa03f158dd78c219be7f0c53dddd4cea58ecac6cef53e7a5b347b0842bb163bd35e19d2ed1b67e63a7e82ac470619ae164c3949884286c101417e6deeff735b8b3b9109e47725bbd5c400b24489fec1afe6771d5c8871f7cd31e7390cef6dce398b8a1dd7213229d282cb581a71c04ca04e9eb516a197583ba8470b0df0b2158a076bf257520500a7bfb42766c883231c1a2a4527dabb5037f9fa00172bc8b9327494b553735a4ebbfb8c9e7f5034b442418c7490919f81308b4a73bd46d57e1ebcc3b6cf7d1ba20e55d06e40e5796e568c206d51adc1be7186cb80962e8dfa41c354acd9ad5fbf4c59b6fa6dd83aa9aa0a23210b057328efa4239b8211b3a5f21ce22a193eb93f69c4d525f53e733b397786d808b928297748a3d54e5bb71bab6139d5e2721d237f4c99896a2e398d049df2e9c63c424606fc73cece699407f3041826cc271a3cb44cc4d76ab77ddb15ef7dda76ddfa4830c5ba28cf7dcc154e88ef9f228a8158d6ae6fdc32ef2af1642e48d5218f10ba7c222e43da4e13f59e96ab4b467283b76d8b0c36665f02d943936041c00d7dbd2a3ab101aa56277b9ec5111428c047fb8b144f260b2fae62db101aad238ee50d222202969ed5929c2f8ab41e6e342ad1b0037be7e2d887f0563a722be94364dfe62482f7862da76fd58827712a1a80f69cc85f2fa9ba92cbfc48f7e4f11b2b87c71e6733a95d8ded91da74913fcf81bb1bb9cb8f380f402abf9df0990e0100750c49f9328238eced88d16068bce90b"}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f00000000c0)={0x8, 'pimreg\x00', {'virt_wifi0\x00'}, 0x4}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000500)={0x2, 0x0, @ioapic={0x100000, 0xfffffff6, 0xac, 0xfffefef8, 0x0, [{0x6, 0xa8, 0x1, '\x00', 0x9}, {0x8, 0x0, 0xad, '\x00', 0x8}, {0x3e, 0x3, 0xb, '\x00', 0xfe}, {0x3, 0x64, 0xff, '\x00', 0xf0}, {0x6, 0xfd, 0x27, '\x00', 0x7}, {0xfb, 0x8, 0x0, '\x00', 0x1b}, {0x9, 0x3, 0x9, '\x00', 0xe6}, {0x0, 0xcf, 0x3d, '\x00', 0xb}, {0x9, 0xf, 0x40, '\x00', 0x4}, {0xd, 0xd, 0x5, '\x00', 0x39}, {0x3, 0xa, 0x20, '\x00', 0x5}, {0x7, 0xa, 0x0, '\x00', 0x4}, {0x53, 0xc0, 0x5, '\x00', 0x4}, {0x6, 0xfe, 0x8, '\x00', 0xb}, {0xc, 0x6, 0x9, '\x00', 0xa9}, {0x0, 0xfd, 0x8, '\x00', 0x9}, {0x2, 0x5, 0x81, '\x00', 0x4}, {0xf9, 0x0, 0x1, '\x00', 0x8}, {0x1, 0x4, 0xff, '\x00', 0x6}, {0xd, 0x7a, 0x80, '\x00', 0x4}, {0xa, 0x9, 0x4, '\x00', 0x9}, {0x4, 0x1, 0x8, '\x00', 0xff}, {0x1, 0xf, 0x6, '\x00', 0x26}, {0xf, 0x4, 0x19, '\x00', 0x2}]}}) sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000180)=@caif=@util={0x25, "28c71b7a4b8e42ab5d81cc96ad26201a"}, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000340)="cfc7dd3ed5e9e66dbb23e2c42096dc76fea190a7569cb92e35cffd12b12c72d89d8728c9d5b9a5abfd29214032c3827c02ef46b47d5e3a62c9313ccb77fff11fb7d7c7cba3b97899c83c6d15d3d1d32bc1cc7f6e8d426241615d0980d139d0e7f5e0fa50128b281a26", 0x69}, {&(0x7f00000003c0)="32bdbd7cb591bd25836ebb1a3f4445d079915869219a54d6c750a63b664c2eb34470f77e8ae7365f461297739709be3b78b18dfa444b28d87a5412448f3d79e5e84bce1fd9b51752d7b6291f2a323f469c1d515fea11b9772923d9c44826ec3618ae3c5f18937d08121b1314e4875db9d54c702d3407fc3ebb2e1cd796c930c6e15b35cec29f742b3f1a43d62eab8d141b4bcd2f4e43a06a271fc53db0c8cdb9f2e7976d732aa24d2376af6951690117c8662756d0c0b05c70ad74cda9ea895bbfee927f149f121e9e5d", 0xca}, {&(0x7f0000000b40)="dd5e9be1306fcb8469fa8881424f960ce71af64373d11b9cfec8ba87e2e377d7410341604da76bfb873cd1f51a6b94f6ad5730844e4b6763e0a79c607076fdb07cf48180923066c258710608889f33a77bec28e0ce02a3f5faf3f76814d4bff0e573a9b6c4796a7ee8b3d572f592290f82a09eacce4a844d4a7103f18ce0800047168ae457b764b709148ee35b56ea6cf12194bbcf9ea58d7b8ff6262c525bd332b5664e5355c811ebd806dc8c5245a48b865b4beb0f4e68dbb98e221a364b2f3efd05430c778f327f9d5be90ccc42106c9f0c77269e6a4ce5205d6ff85523a955e938a6b836", 0xe6}, {&(0x7f0000000cc0)="bb673e138de8e9eeb4a33259eeed8d164946ef3df26e169e77220e889d26ad54b60b2c7d2dcfffc70525b65b7cfd0d2fc67b5517ef76b62779a451acdca1e27a3c9ea36d4f9f9aba0624", 0x4a}, {&(0x7f0000000d40)="a60c8c2e936eaf49a164f4bf095df627e9ee8ba97d56061c7426d2bc2745030f3356090cee6543ea6865e3476427d2eeba7bbcc597b1e0ad9dfc5dfb477a89f03a36fe564117d436f486190272d87db53f65489b848e19a6064553114847a1d46cf5752e97fd9e76952fb1c29b261439bf40e1525646cc67b9a802e6f9d745d2e0af484a1f1974ffea4e63c6fe0cd9e6549a91b434e3345ec589a823e650122c514449d27511122cf7754fb23c29c886887c065d4a8048bc9d49958b01e7e2174f6295", 0xc3}, {&(0x7f0000000e40)="5127717046a78af0a28722f4895504740c1488374764587e445760c6227ff62670535c7a8ddb2171848aca41ae9aed9b1a55a03e83e16b8be91a50cb85c8601453d7a1089bd2ce8bff939466bde89e41e27cf28bed4f7ff8f0763c8800a948dad3910252856d9d57b4ce939c51918d30b5d9f7507fd98bd7f9ed8ab843764c799558", 0x82}, {&(0x7f0000000100)}], 0x7, &(0x7f0000001180)=ANY=[@ANYBLOB="f0000000000000000c0100006affffff4987c123e4181f0ce4fbf4051657823ad591db780896c4667c371f9cd21d111bd9a26928b82e9a0da8fb6f84f7955064b934d9ba6a1a8b589e1cab9cbe50b051c8631dbc14ac9d0e6cef0173cc575d349e0c94a6c0c4b55f0d9f33083d0776e35a58d8b5d068fd98e996e36e0bc86e13040bfc837603000000000000003caa293a3b9c305bd596ccfdf6a2f37500f1effeae18771fab5843c7354ca865f5c88ae0637e6802f3b263c81a99524810efd7af620b09e6f03efff528bc8724c2b8329b87ed0674a13cc18fbc3f042879ed20abaf03d8dc33519390030f5e08951724903f0cd6c507a2910000"], 0xf0}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c80)=ANY=[@ANYBLOB="280000002100010000000000000000000a00000000000001016200000900178002c9a3"], 0x28}], 0x1}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) sendto$inet6(r6, &(0x7f0000001080)="5ec4de601a50b7044800ee9ebdaf697de8bf61b9598aa2e5cce7e7301e199c4452cc90b91a979cc5c3c18cf2939b2974865371395af885c738b036d1688f745c8cb22329fe6a942d72986f4c51ffec1a491446d2d2e39fc6a62a4012940636d6109fa73aa91fd4b47b91164fb645006250e2981401305b74c1eebec8188c771c00bfb651041af5bf6f3659cb9f6547d6e9e64a28c501d36e4be5c524f00f1adfa8dfbd916881f5044772f07313bfb4e4ab346bef4dac2ae40f194f6ecba2a40f1e18e9a33163402b89797894a7a8c7ea2fe7a950345240d41b3cfa4ffe4f3951d94f1658c8e773c0d32fa90edee9ee4e2243", 0xf2, 0x48000, &(0x7f0000000100)={0xa, 0x4e24, 0x607a250a, @loopback, 0x800}, 0x1c) syz_usb_connect$uac1(0x3, 0xa7, &(0x7f0000000040)=ANY=[@ANYBLOB="0872005dcb9e12ae7f919bea97df705598f6530525da18118b6ebbb7d810fe6e6b95982f5f779084a0c14cc7ee55753381542e917d3cae022f810fea8e7a173ba68bb1d24588d479373190a6fffe9115c3de3aa7b291e35e072e57a834d47d2a1b5a64bdfee6beccb2fe393df47e620b529d1d97dcbc04d1355e6ca4206becc5"], &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0}) 402.078038ms ago: executing program 0 (id=1249): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0xa5) mkdir(&(0x7f0000000440)='./file1\x00', 0x126) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@uuid_auto}]}) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@uuid_auto}]}) chdir(&(0x7f00000003c0)='./bus\x00') creat(&(0x7f0000000580)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0) rename(&(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='./file0\x00') setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000000), 0x4) 400.040748ms ago: executing program 0 (id=1250): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./bus\x00', &(0x7f0000000080), &(0x7f00000000c0), 0x2, 0x3) openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) 395.068025ms ago: executing program 0 (id=1251): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x20, {[@global=@item_012={0x2, 0x1, 0x9, "0100"}, @global=@item_012={0x2, 0x1, 0x0, "0100"}, @main=@item_4, @main=@item_012={0x0, 0x0, 0x8}, @global=@item_012={0x1, 0x1, 0x8, '8'}, @main=@item_4={0x3, 0x0, 0x9, "22110700"}, @local=@item_012={0x2, 0x2, 0x8, "3994"}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "ce9abc16"}]}}, 0x0}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x60, 0x0, 0x0) 271.482131ms ago: executing program 2 (id=1252): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e24, @loopback}}) (async) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xe) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000040)={0x2, 0x0, @ioapic={0x10000, 0xfffffff7, 0x8, 0x1428, 0x0, [{0x4, 0x6, 0x4, '\x00', 0x80}, {0x11, 0x8, 0x4, '\x00', 0x7}, {0x9f, 0xea, 0x40, '\x00', 0xc9}, {0x3, 0x5, 0x9, '\x00', 0x7f}, {0x0, 0x7f, 0x6, '\x00', 0x2}, {0x3, 0xf2, 0x1, '\x00', 0x5d}, {0x5, 0x0, 0x81, '\x00', 0x2}, {0x1, 0x7, 0x40, '\x00', 0x6}, {0x2, 0xc1, 0x5, '\x00', 0x8}, {0x7, 0x0, 0x0, '\x00', 0x7f}, {0x5, 0x7f, 0xf2, '\x00', 0x2}, {0x6, 0x7, 0x1, '\x00', 0xc4}, {0x0, 0x4, 0x5, '\x00', 0x1}, {0x81, 0x7, 0x1, '\x00', 0x1}, {0x1, 0x6f, 0x0, '\x00', 0x1}, {0x3, 0xe, 0x8, '\x00', 0x8}, {0x4, 0xfb, 0x3}, {0x6, 0x77, 0xb, '\x00', 0x7f}, {0x5, 0x4, 0x5, '\x00', 0x3}, {0x80, 0x4, 0xb, '\x00', 0x5}, {0x1, 0x5, 0x7, '\x00', 0xf}, {0x40, 0x80, 0x3, '\x00', 0xfd}, {0xd7, 0x0, 0x5, '\x00', 0x3c}, {0xfe, 0x4, 0x6, '\x00', 0x82}]}}) 214.493825ms ago: executing program 2 (id=1253): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000380), 0x682001, 0x0) fchdir(r0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmstat\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000200)={0x2020}, 0x2020) ioctl$TIOCSCTTY(r1, 0x540e, 0x3) ioctl$SNDRV_TIMER_IOCTL_CREATE(r1, 0xc02054a5, &(0x7f0000000140)={0x454, r1, 'id0\x00'}) r2 = socket(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f9, &(0x7f0000000a40)={'ip6gre0\x00', 0x0}) r4 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r4, &(0x7f0000002240)="7800000018001f07b9409b0dffff000d0216be040003060506014003430008001236cf00bf46d32360652b000000caaf6c26c277a34549935ade4a460c89b6ec0cff3943a59b3cb50b0ae854be4dc0c63359547f5090582a86c902000000004a3200637939cc1cd10400160012000200800000000000000000a3a1caa0e851636d6c8779ae2a2726df45539c94836f04dad6e98d2c9f7845dd13b661766e027ca417660518d3a0143c4f71efb90a0be0a10733780d0c907a866a14ec931a678e54b8feecfd23b747790841565fd0ebb2e90749346379651e308a0774b4d5e0d24db24c19d44b7a9eff301d04f6f09a09b25717b327e536deef", 0xf9, 0xee309b86a20d29ba, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)=0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000100)={@local, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, 0x10) syz_open_procfs$namespace(r5, &(0x7f00000000c0)='ns/time_for_children\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x245059, 0x0) 214.273465ms ago: executing program 2 (id=1254): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x39, 0x0, 0x101}}) write(r0, &(0x7f0000000280)="0600", 0x2) 212.585174ms ago: executing program 2 (id=1255): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x4) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r3) (async) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r3, @ANYRES32=r2]) (async) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, 0x0, 0x0, 0x50040, &(0x7f00000001c0)={0x11, 0x3, r5, 0x1, 0xd8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 164.937924ms ago: executing program 2 (id=1256): socket$inet6(0xa, 0x2, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000000), r1) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) (async) r3 = socket(0x2, 0x3, 0xff) sendto$inet(r3, 0x0, 0x0, 0xc0, &(0x7f0000000040)={0x2, 0x0, @dev}, 0x10) (async) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="01002abd70fdfcdbdf2504000000f6496eb1b41158c734934af8cb003a2801ff73d605cc255ab373dff2b6bb60d3f3c65db55904391ddd78393a6505a167c985722f8576cf49db82905d516a3d4b775013a0b096a9385648872e0bead5d007f365899bdbeca0ef34f78a8fe09d91688bd76447ef895f858d9dbecd081c7d6b475d391ab1e6b1ab326a24f5be8d7e7b1961c028f3fcec75c278daa89f"], 0x14}, 0x1, 0x0, 0x0, 0x841}, 0x20000000) 63.564509ms ago: executing program 2 (id=1257): ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, &(0x7f0000000100)=""/125, &(0x7f0000000180)=""/50, &(0x7f00000001c0)=""/46, 0x30000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = getpid() sendmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)="10", 0x1}], 0x1, &(0x7f0000000340)=[@cred={{0x1c, 0x1, 0x2, {r1}}}], 0x20}, 0x8841) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x16) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x20000, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000040)) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect$uac3(0x6, 0x102, &(0x7f0000000880)=ANY=[@ANYBLOB="12010002000000101e0400304000010203010902f0000301098001080b0202010030000904000000010130000a2401103500ff0000000b240502064b2db3e89eba0c240c0707faccf28cfc36f6142402020402040205000000090072009a0909000904010000010230000904010101010230001724010401000000feff000000000000000010090800080a24020207000002060417240103e10a0000f83f01000000000000000503030009090501093800017f000a252505000000070a000904020000010230000904020101010230000924020180800110ef062402010400102402020001ffff05ef2bad0d42f9fe0905820908000006010a2525000000000109002430300bbb43e4012ca26c5bfbbd0efca92e5d46bf9df60b6ea1b17be8b132d9d3d805854329260e32a98dbf5fb47570b99ffa854eb85769a1f0a2933625710ad34ed96e40a6c252422e8d52de99d3cd7c398bf58ed50c89fe830dcd959fcd9c"], &(0x7f0000000840)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x300, 0x0, 0x3, 0x4, 0x0, 0x8}, 0x5b, &(0x7f0000000700)={0x5, 0xf, 0x5b, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x1, 0x1, 0xf001}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "a7c77530f666686508f18b1044137994"}, @ssp_cap={0x10, 0x10, 0xa, 0x81, 0x1, 0x6, 0xf00f, 0x8, [0xf]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x5, 0x7f, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xd, 0x3, 0xcc, 0xec}, @ssp_cap={0x14, 0x10, 0xa, 0x91, 0x2, 0x1, 0xf00f, 0x4, [0x0, 0x7f8000]}]}, 0x1, [{0x8b, &(0x7f0000000780)=@string={0x8b, 0x3, "918f7fcfb42c4a0389d7d9cc41629862ad72144a3cd5661c69c6e0c64cb3a264a735c2057dbcba98ad1480068b617849386a48334227b6661ca5c508af3055eb0ebdcbfc7bc84876cd432366a61227806fe72a037319aff8a74d2061cb36347e6d5b8955e8a8860a75fe6c524ef61882b33929cd39eef4691ab9aa120aa26d1b3b9d026cb1f0257c3a"}}]}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="e99428bd7000fcdbdf2546000000080001"], 0x50}}, 0xc000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/timer_list\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000200)=""/82, 0x52, 0x2000000fc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000005a00"], 0x1c}], 0x1}, 0x80) r5 = socket$can_raw(0x1d, 0x3, 0x1) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000500)={0x0, 0x2}) r7 = dup(r5) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mprotect(&(0x7f0000001000/0x14000)=nil, 0x14000, 0x0) getsockname$unix(r7, 0x0, &(0x7f00000004c0)) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x1000}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r8, &(0x7f00000002c0)=ANY=[@ANYBLOB="000088e7bbbbbbbbbbbbaaaaaaaaaabb810020000806000108000604"], 0x32) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000a00)={{{@in6=@remote, @in=@dev}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000280)=0x5261be92a08ea23c) 0s ago: executing program 32 (id=1257): ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, &(0x7f0000000100)=""/125, &(0x7f0000000180)=""/50, &(0x7f00000001c0)=""/46, 0x30000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = getpid() sendmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)="10", 0x1}], 0x1, &(0x7f0000000340)=[@cred={{0x1c, 0x1, 0x2, {r1}}}], 0x20}, 0x8841) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x16) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x20000, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000040)) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect$uac3(0x6, 0x102, &(0x7f0000000880)=ANY=[@ANYBLOB="12010002000000101e0400304000010203010902f0000301098001080b0202010030000904000000010130000a2401103500ff0000000b240502064b2db3e89eba0c240c0707faccf28cfc36f6142402020402040205000000090072009a0909000904010000010230000904010101010230001724010401000000feff000000000000000010090800080a24020207000002060417240103e10a0000f83f01000000000000000503030009090501093800017f000a252505000000070a000904020000010230000904020101010230000924020180800110ef062402010400102402020001ffff05ef2bad0d42f9fe0905820908000006010a2525000000000109002430300bbb43e4012ca26c5bfbbd0efca92e5d46bf9df60b6ea1b17be8b132d9d3d805854329260e32a98dbf5fb47570b99ffa854eb85769a1f0a2933625710ad34ed96e40a6c252422e8d52de99d3cd7c398bf58ed50c89fe830dcd959fcd9c"], &(0x7f0000000840)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x300, 0x0, 0x3, 0x4, 0x0, 0x8}, 0x5b, &(0x7f0000000700)={0x5, 0xf, 0x5b, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x1, 0x1, 0xf001}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "a7c77530f666686508f18b1044137994"}, @ssp_cap={0x10, 0x10, 0xa, 0x81, 0x1, 0x6, 0xf00f, 0x8, [0xf]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x5, 0x7f, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xd, 0x3, 0xcc, 0xec}, @ssp_cap={0x14, 0x10, 0xa, 0x91, 0x2, 0x1, 0xf00f, 0x4, [0x0, 0x7f8000]}]}, 0x1, [{0x8b, &(0x7f0000000780)=@string={0x8b, 0x3, "918f7fcfb42c4a0389d7d9cc41629862ad72144a3cd5661c69c6e0c64cb3a264a735c2057dbcba98ad1480068b617849386a48334227b6661ca5c508af3055eb0ebdcbfc7bc84876cd432366a61227806fe72a037319aff8a74d2061cb36347e6d5b8955e8a8860a75fe6c524ef61882b33929cd39eef4691ab9aa120aa26d1b3b9d026cb1f0257c3a"}}]}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="e99428bd7000fcdbdf2546000000080001"], 0x50}}, 0xc000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/timer_list\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000200)=""/82, 0x52, 0x2000000fc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000005a00"], 0x1c}], 0x1}, 0x80) r5 = socket$can_raw(0x1d, 0x3, 0x1) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000500)={0x0, 0x2}) r7 = dup(r5) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mprotect(&(0x7f0000001000/0x14000)=nil, 0x14000, 0x0) getsockname$unix(r7, 0x0, &(0x7f00000004c0)) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x1000}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r8, &(0x7f00000002c0)=ANY=[@ANYBLOB="000088e7bbbbbbbbbbbbaaaaaaaaaabb810020000806000108000604"], 0x32) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000a00)={{{@in6=@remote, @in=@dev}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000280)=0x5261be92a08ea23c) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.71' (ED25519) to the list of known hosts. [ 24.376308][ T36] audit: type=1400 audit(1772289912.710:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.379582][ T283] cgroup: Unknown subsys name 'net' [ 24.399190][ T36] audit: type=1400 audit(1772289912.710:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.426649][ T36] audit: type=1400 audit(1772289912.740:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.427028][ T283] cgroup: Unknown subsys name 'devices' [ 24.535461][ T283] cgroup: Unknown subsys name 'hugetlb' [ 24.541163][ T283] cgroup: Unknown subsys name 'rlimit' [ 24.636199][ T36] audit: type=1400 audit(1772289912.970:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.659379][ T36] audit: type=1400 audit(1772289912.970:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.684121][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.684434][ T36] audit: type=1400 audit(1772289912.970:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.715912][ T36] audit: type=1400 audit(1772289913.020:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.741305][ T36] audit: type=1400 audit(1772289913.030:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.774432][ T36] audit: type=1400 audit(1772289913.110:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.775551][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.800095][ T36] audit: type=1400 audit(1772289913.110:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.652176][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.659476][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.666697][ T290] bridge_slave_0: entered allmulticast mode [ 25.672909][ T290] bridge_slave_0: entered promiscuous mode [ 25.684254][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.691388][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.698525][ T290] bridge_slave_1: entered allmulticast mode [ 25.704770][ T290] bridge_slave_1: entered promiscuous mode [ 25.726947][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.734115][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.741165][ T293] bridge_slave_0: entered allmulticast mode [ 25.747424][ T293] bridge_slave_0: entered promiscuous mode [ 25.760857][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.768094][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.775237][ T292] bridge_slave_0: entered allmulticast mode [ 25.781405][ T292] bridge_slave_0: entered promiscuous mode [ 25.787785][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.794897][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.801951][ T293] bridge_slave_1: entered allmulticast mode [ 25.808349][ T293] bridge_slave_1: entered promiscuous mode [ 25.827495][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.834671][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.841772][ T292] bridge_slave_1: entered allmulticast mode [ 25.848035][ T292] bridge_slave_1: entered promiscuous mode [ 25.856993][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.864073][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.871136][ T291] bridge_slave_0: entered allmulticast mode [ 25.877366][ T291] bridge_slave_0: entered promiscuous mode [ 25.886052][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.893117][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.900179][ T291] bridge_slave_1: entered allmulticast mode [ 25.906443][ T291] bridge_slave_1: entered promiscuous mode [ 26.045758][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.052919][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.060222][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.067264][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.076239][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.083318][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.090597][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.097805][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.122010][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.129167][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.136454][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.143509][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.170907][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.178105][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.185394][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.192441][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.217777][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.225261][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.232482][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.240067][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.247632][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.254939][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.262330][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.269638][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.284997][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.292143][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.299767][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.306845][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.324250][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.331376][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.344640][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.351689][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.364262][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.371411][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.397998][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.405132][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.426201][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.433382][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.440957][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.448021][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.468780][ T292] veth0_vlan: entered promiscuous mode [ 26.480759][ T290] veth0_vlan: entered promiscuous mode [ 26.494535][ T292] veth1_macvtap: entered promiscuous mode [ 26.503750][ T291] veth0_vlan: entered promiscuous mode [ 26.524760][ T291] veth1_macvtap: entered promiscuous mode [ 26.537647][ T290] veth1_macvtap: entered promiscuous mode [ 26.550652][ T293] veth0_vlan: entered promiscuous mode [ 26.578771][ T292] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.596783][ T293] veth1_macvtap: entered promiscuous mode [ 26.677931][ T341] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.883106][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.891145][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.953130][ T337] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.043099][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 27.049542][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.060843][ T10] usb 4-1: config 1 has an invalid interface number: 253 but max is 1 [ 27.069131][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.078939][ T10] usb 4-1: config 1 has an invalid descriptor of length 122, skipping remainder of the config [ 27.089419][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 27.098653][ T337] usb 3-1: device descriptor read/64, error -71 [ 27.105050][ T10] usb 4-1: config 1 has 3 interfaces, different from the descriptor's value: 2 [ 27.114182][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.122505][ T10] usb 4-1: config 1 has no interface number 2 [ 27.129241][ T9] usb 2-1: config 0 descriptor?? [ 27.134292][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.145559][ T10] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 27.158516][ T10] usb 4-1: config 1 interface 1 has no altsetting 0 [ 27.165783][ T9] hub 2-1:0.0: USB hub found [ 27.172053][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.181211][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.189352][ T10] usb 4-1: Product: syz [ 27.193585][ T10] usb 4-1: Manufacturer: syz [ 27.198228][ T10] usb 4-1: SerialNumber: syz [ 27.208887][ T10] cdc_ncm 4-1:1.253: CDC Union missing and no IAD found [ 27.216031][ T10] cdc_ncm 4-1:1.253: bind() failure [ 27.353045][ T337] usb 3-1: device descriptor read/64, error -71 [ 27.367794][ T9] hub 2-1:0.0: 1 port detected [ 27.415694][ T10] usb 4-1: USB disconnect, device number 2 [ 27.593077][ T337] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.733097][ T337] usb 3-1: device descriptor read/64, error -71 [ 27.973124][ T337] usb 3-1: device descriptor read/64, error -71 [ 28.093919][ T337] usb usb3-port1: attempt power cycle [ 28.182020][ T9] hub 2-1:0.0: activate --> -90 [ 28.382528][ T64] usb 2-1: USB disconnect, device number 2 [ 28.443100][ T337] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 28.464179][ T337] usb 3-1: device descriptor read/8, error -71 [ 28.604219][ T337] usb 3-1: device descriptor read/8, error -71 [ 28.844984][ T337] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 28.885514][ T337] usb 3-1: device descriptor read/8, error -71 [ 29.014170][ T337] usb 3-1: device descriptor read/8, error -71 [ 29.113746][ T387] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 29.121352][ T387] SELinux: failed to load policy [ 29.126779][ T337] usb usb3-port1: unable to enumerate USB device [ 29.153102][ T45] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 29.304275][ T45] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 29.312740][ T45] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 29.323056][ T45] usb 4-1: config 220 has no interface number 2 [ 29.329326][ T45] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 29.342847][ T45] usb 4-1: config 220 interface 0 has no altsetting 0 [ 29.349669][ T45] usb 4-1: config 220 interface 76 has no altsetting 0 [ 29.356557][ T45] usb 4-1: config 220 interface 1 has no altsetting 0 [ 29.364808][ T45] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 29.373940][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.381971][ T45] usb 4-1: Product: syz [ 29.386173][ T45] usb 4-1: Manufacturer: syz [ 29.390778][ T45] usb 4-1: SerialNumber: syz [ 29.393140][ T337] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.554922][ T337] usb 2-1: config 192 has an invalid descriptor of length 0, skipping remainder of the config [ 29.565305][ T337] usb 2-1: config 192 has 0 interfaces, different from the descriptor's value: 1 [ 29.576056][ T337] usb 2-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=56.c3 [ 29.585154][ T337] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.593381][ T337] usb 2-1: Product: syz [ 29.597555][ T337] usb 2-1: Manufacturer: syz [ 29.602157][ T337] usb 2-1: SerialNumber: syz [ 29.608832][ T363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.617467][ T363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.628329][ T45] usb 4-1: selecting invalid altsetting 0 [ 29.635907][ T45] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 29.642393][ T45] usb 4-1: No valid video chain found. [ 29.650257][ T45] usb 4-1: USB disconnect, device number 3 [ 29.810284][ T337] usb 2-1: USB disconnect, device number 3 [ 30.063050][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.083159][ T10] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 30.143204][ T36] kauditd_printk_skb: 58 callbacks suppressed [ 30.143220][ T36] audit: type=1400 audit(1772289918.480:132): avc: denied { append } for pid=399 comm="syz.3.20" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 30.193088][ T45] usb 1-1: device descriptor read/64, error -71 [ 30.227204][ T36] audit: type=1400 audit(1772289918.560:133): avc: denied { execute } for pid=402 comm="syz.3.21" name="file1" dev="tmpfs" ino=42 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 30.227242][ T403] process 'syz.3.21' launched './file1' with NULL argv: empty string added [ 30.250850][ T10] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 30.266150][ T10] usb 3-1: config 0 has no interface number 0 [ 30.266528][ T36] audit: type=1400 audit(1772289918.590:134): avc: denied { execute_no_trans } for pid=402 comm="syz.3.21" path="/4/file1" dev="tmpfs" ino=42 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 30.272269][ T10] usb 3-1: config 0 interface 41 has no altsetting 0 [ 30.306697][ T10] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 30.320669][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.330840][ T36] audit: type=1400 audit(1772289918.660:135): avc: denied { create } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 30.349929][ T10] usb 3-1: Product: syz [ 30.354139][ T10] usb 3-1: Manufacturer: syz [ 30.358749][ T10] usb 3-1: SerialNumber: syz [ 30.364938][ T407] netlink: 232 bytes leftover after parsing attributes in process `syz.3.22'. [ 30.371764][ T10] usb 3-1: config 0 descriptor?? [ 30.379019][ T36] audit: type=1400 audit(1772289918.690:136): avc: denied { create } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.400468][ T36] audit: type=1400 audit(1772289918.690:137): avc: denied { write } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.420584][ T36] audit: type=1400 audit(1772289918.690:138): avc: denied { nlmsg_write } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.433178][ T45] usb 1-1: device descriptor read/64, error -71 [ 30.444477][ T36] audit: type=1400 audit(1772289918.700:139): avc: denied { create } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 30.471858][ T36] audit: type=1400 audit(1772289918.700:140): avc: denied { bind } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 30.491019][ T36] audit: type=1400 audit(1772289918.700:141): avc: denied { nlmsg_read } for pid=404 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.656687][ T420] capability: warning: `syz.3.27' uses deprecated v2 capabilities in a way that may be insecure [ 30.693078][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.763088][ T337] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.823123][ T45] usb 1-1: device descriptor read/64, error -71 [ 30.923077][ T337] usb 2-1: Using ep0 maxpacket: 16 [ 30.929279][ T337] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.940035][ T337] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 30.949889][ T337] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 30.958989][ T337] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 30.967125][ T337] usb 2-1: SerialNumber: syz [ 30.974282][ T337] usb 2-1: 0:2 : does not exist [ 30.979201][ T337] usb 2-1: unit 49 not found! [ 31.003037][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 31.063196][ T45] usb 1-1: device descriptor read/64, error -71 [ 31.143054][ T9] usb 4-1: device descriptor read/64, error -71 [ 31.173197][ T45] usb usb1-port1: attempt power cycle [ 31.179451][ T415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.188075][ T415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.196291][ T337] usb 2-1: USB disconnect, device number 4 [ 31.383115][ T9] usb 4-1: device descriptor read/64, error -71 [ 31.513065][ T45] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 31.534123][ T45] usb 1-1: device descriptor read/8, error -71 [ 31.566750][ T10] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 31.579911][ T10] usb 3-1: USB disconnect, device number 6 [ 31.623090][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 31.664145][ T45] usb 1-1: device descriptor read/8, error -71 [ 31.758194][ T434] netlink: 'syz.1.31': attribute type 5 has an invalid length. [ 31.773096][ T9] usb 4-1: device descriptor read/64, error -71 [ 31.913053][ T45] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 31.934096][ T45] usb 1-1: device descriptor read/8, error -71 [ 32.013042][ T9] usb 4-1: device descriptor read/64, error -71 [ 32.023075][ T31] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 32.064219][ T45] usb 1-1: device descriptor read/8, error -71 [ 32.123167][ T9] usb usb4-port1: attempt power cycle [ 32.173158][ T45] usb usb1-port1: unable to enumerate USB device [ 32.180646][ T31] usb 2-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 32.191808][ T31] usb 2-1: config 0 interface 0 altsetting 11 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.201779][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 32.208449][ T31] usb 2-1: New USB device found, idVendor=056a, idProduct=0064, bcdDevice= 0.00 [ 32.217512][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.226529][ T31] usb 2-1: config 0 descriptor?? [ 32.463064][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 32.484777][ T9] usb 4-1: device descriptor read/8, error -71 [ 32.614140][ T9] usb 4-1: device descriptor read/8, error -71 [ 32.793114][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 32.799252][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 32.808338][ T31] usb 2-1: USB disconnect, device number 5 [ 32.863052][ T9] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 32.884837][ T9] usb 4-1: device descriptor read/8, error -71 [ 33.014238][ T9] usb 4-1: device descriptor read/8, error -71 [ 33.123179][ T9] usb usb4-port1: unable to enumerate USB device [ 33.233072][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 33.394262][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 33.404115][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 33.415478][ T10] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 33.424600][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.432590][ T10] usb 1-1: Product: syz [ 33.436811][ T10] usb 1-1: Manufacturer: syz [ 33.441500][ T10] usb 1-1: SerialNumber: syz [ 33.447249][ T10] usb 1-1: config 0 descriptor?? [ 33.452483][ T444] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.459678][ T444] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.483043][ T441] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 33.633035][ T441] usb 2-1: Using ep0 maxpacket: 8 [ 33.639336][ T441] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 33.647816][ T441] usb 2-1: config 179 has no interface number 0 [ 33.654264][ T441] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 33.665369][ T441] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 33.669314][ T444] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.676785][ T441] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 33.685070][ T444] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.695104][ T441] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 33.713523][ T441] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 33.726778][ T441] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 33.735863][ T441] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.744954][ T462] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 33.857998][ T466] netlink: 172 bytes leftover after parsing attributes in process `syz.3.41'. [ 34.123145][ T337] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 34.156982][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 34.156985][ T9] usb 2-1: USB disconnect, device number 6 [ 34.157020][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 34.253024][ T337] usb 4-1: device descriptor read/64, error -71 [ 34.306290][ T444] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 34.493029][ T337] usb 4-1: device descriptor read/64, error -71 [ 34.668526][ T471] Zero length message leads to an empty skb [ 34.733073][ T337] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 34.863028][ T337] usb 4-1: device descriptor read/64, error -71 [ 35.103024][ T337] usb 4-1: device descriptor read/64, error -71 [ 35.128723][ T495] mmap: syz.0.52 (495) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 35.213100][ T337] usb usb4-port1: attempt power cycle [ 35.335744][ T505] netlink: 84 bytes leftover after parsing attributes in process `syz.2.56'. [ 35.344641][ T506] netlink: 64 bytes leftover after parsing attributes in process `syz.2.56'. [ 35.381044][ T36] kauditd_printk_skb: 40 callbacks suppressed [ 35.381061][ T36] audit: type=1400 audit(1772289923.710:182): avc: denied { ioctl } for pid=509 comm="syz.2.58" path="socket:[4595]" dev="sockfs" ino=4595 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.412738][ T36] audit: type=1400 audit(1772289923.740:183): avc: denied { create } for pid=509 comm="syz.2.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 35.432055][ T36] audit: type=1400 audit(1772289923.740:184): avc: denied { setopt } for pid=509 comm="syz.2.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 35.451185][ T36] audit: type=1400 audit(1772289923.740:185): avc: denied { bind } for pid=509 comm="syz.2.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 35.470229][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 35.477808][ T36] audit: type=1400 audit(1772289923.740:186): avc: denied { ioctl } for pid=509 comm="syz.2.58" path="socket:[4603]" dev="sockfs" ino=4603 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 35.508798][ T36] audit: type=1400 audit(1772289923.840:187): avc: denied { bind } for pid=511 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.531783][ T36] audit: type=1400 audit(1772289923.840:188): avc: denied { read } for pid=511 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.563056][ T337] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 35.594374][ T337] usb 4-1: device descriptor read/8, error -71 [ 35.649936][ T36] audit: type=1400 audit(1772289923.980:189): avc: denied { accept } for pid=515 comm="syz.2.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.673061][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 35.680102][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.690995][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 35.699976][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 35.719485][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 35.728772][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.737031][ T9] usb 2-1: Manufacturer: é¨æª·å’¦á¬è…¶èµ³è™•ã§·èŽµàª–ꆪ￰鵖绗פֿç’㨜㆟േ陼⻒鑡༼渤è˜ê¿æ¬´ê§“䖖ﮣ攎徼ç¨ã° ì™½ìœ¨îŽ­ìž‹î“ŠÈ„问繱暈尩ã¢å ¦à¶Žë’‡î’¦ëŽ«è’˜ï°ºäƒƒë©ä ¤æ’•ç‘¸îŠ¨ã©é¹é’䘸ã¬å‘”ʹ춤뺲৭뛂á¬âŒë ˆà¦®å®«î¶‰×™ë…£ã¥Ÿá¼ƒæ ·á·¾ï¶•é“‰è¤›ïŸ£ [ 35.765060][ T337] usb 4-1: device descriptor read/8, error -71 [ 35.774540][ T36] audit: type=1400 audit(1772289924.110:190): avc: denied { lock } for pid=519 comm="syz.2.62" path="socket:[5198]" dev="sockfs" ino=5198 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 35.973672][ T499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.982645][ T499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.992280][ T9] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 35.999667][ T9] cdc_ncm 2-1:1.0: bind() failure [ 36.005142][ T337] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 36.014690][ T9] usb 2-1: USB disconnect, device number 7 [ 36.033949][ T337] usb 4-1: device descriptor read/8, error -71 [ 36.043064][ T31] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 36.164660][ T337] usb 4-1: device descriptor read/8, error -71 [ 36.193044][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 36.199392][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 36.208571][ T31] usb 3-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 36.218295][ T31] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 36.228072][ T31] usb 3-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 36.237830][ T31] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 36.247588][ T31] usb 3-1: config 1 interface 0 has no altsetting 0 [ 36.254348][ T31] usb 3-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 36.263464][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.273366][ T31] ums-sddr09 3-1:1.0: USB Mass Storage device detected [ 36.276520][ T337] usb usb4-port1: unable to enumerate USB device [ 36.475894][ T31] scsi host1: usb-storage 3-1:1.0 [ 36.683812][ T337] usb 3-1: USB disconnect, device number 7 [ 36.933045][ T36] audit: type=1400 audit(1772289925.260:191): avc: denied { getopt } for pid=536 comm="syz.3.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.999914][ T544] EXT4-fs: dax option not supported [ 37.058788][ T546] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.722059][ T571] syzkaller0: entered promiscuous mode [ 37.727710][ T571] syzkaller0: entered allmulticast mode [ 38.692463][ T604] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=604 comm=syz.2.92 [ 39.123244][ T10] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 39.191957][ T636] netlink: 'syz.0.104': attribute type 7 has an invalid length. [ 39.908439][ T688] syz.2.122 uses obsolete (PF_INET,SOCK_PACKET) [ 40.027737][ T703] netlink: 100 bytes leftover after parsing attributes in process `syz.0.127'. [ 40.521354][ T36] kauditd_printk_skb: 310 callbacks suppressed [ 40.521373][ T36] audit: type=1400 audit(1772289934.852:502): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.567466][ T36] audit: type=1400 audit(1772289934.892:503): avc: denied { mounton } for pid=731 comm="syz.2.137" path="/30/file0" dev="tmpfs" ino=173 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 40.598410][ T36] audit: type=1400 audit(1772289934.912:504): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.629743][ T36] audit: type=1400 audit(1772289934.922:505): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.654027][ T36] audit: type=1400 audit(1772289934.922:506): avc: denied { read write } for pid=739 comm="syz.0.138" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 40.681972][ T36] audit: type=1400 audit(1772289934.972:507): avc: denied { read } for pid=741 comm="syz.2.139" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 40.710109][ T36] audit: type=1400 audit(1772289935.012:508): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.712639][ T744] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 40.748208][ T36] audit: type=1400 audit(1772289935.072:509): avc: denied { bpf } for pid=743 comm="syz.2.140" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=0 [ 40.795782][ T36] audit: type=1400 audit(1772289935.072:510): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.815841][ T748] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=748 comm=syz.1.143 [ 40.821097][ T36] audit: type=1400 audit(1772289935.102:511): avc: denied { read write } for pid=745 comm="syz.1.141" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=0 [ 40.846174][ T749] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=749 comm=syz.1.143 [ 41.728961][ T788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=63 sclass=netlink_route_socket pid=788 comm=syz.0.156 [ 42.314938][ T804] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=804 comm=syz.1.160 [ 44.502229][ T888] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 44.829083][ T895] netlink: 'syz.1.192': attribute type 10 has an invalid length. [ 44.837082][ T895] netlink: 17 bytes leftover after parsing attributes in process `syz.1.192'. [ 45.073560][ T911] netlink: 64 bytes leftover after parsing attributes in process `syz.2.199'. [ 45.497636][ T926] netlink: 'syz.1.204': attribute type 28 has an invalid length. [ 45.505724][ T926] netlink: 'syz.1.204': attribute type 22 has an invalid length. [ 45.525280][ T36] kauditd_printk_skb: 964 callbacks suppressed [ 45.525296][ T36] audit: type=1400 audit(1772289939.852:1260): avc: denied { read } for pid=928 comm="syz.1.205" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=0 [ 45.554067][ T36] audit: type=1400 audit(1772289939.872:1261): avc: denied { read write } for pid=928 comm="syz.1.205" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 45.578235][ T36] audit: type=1400 audit(1772289939.912:1262): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 45.602460][ T36] audit: type=1400 audit(1772289939.912:1263): avc: denied { read write } for pid=930 comm="syz.3.206" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=0 [ 45.625861][ T36] audit: type=1400 audit(1772289939.912:1264): avc: denied { read } for pid=930 comm="syz.3.206" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 45.654259][ T36] audit: type=1400 audit(1772289939.912:1265): avc: denied { read } for pid=930 comm="syz.3.206" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 45.677465][ T36] audit: type=1400 audit(1772289939.912:1266): avc: denied { read } for pid=930 comm="syz.3.206" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 45.700387][ T36] audit: type=1400 audit(1772289939.912:1267): avc: denied { read write } for pid=930 comm="syz.3.206" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=0 [ 45.710960][ T939] netlink: 28 bytes leftover after parsing attributes in process `syz.2.209'. [ 45.724458][ T36] audit: type=1400 audit(1772289939.942:1268): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 45.756369][ T36] audit: type=1400 audit(1772289939.972:1269): avc: denied { name_bind } for pid=930 comm="syz.3.206" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=0 [ 46.225244][ T957] netlink: 'syz.0.215': attribute type 2 has an invalid length. [ 46.233084][ T957] netlink: 1 bytes leftover after parsing attributes in process `syz.0.215'. [ 47.330431][ T331] Bluetooth: hci1: Frame reassembly failed (-84) [ 49.123048][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 49.123055][ T1040] Bluetooth: hci0: command 0x1003 tx timeout [ 49.363050][ T1009] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 49.363057][ T55] Bluetooth: hci1: command 0x1003 tx timeout [ 50.308402][ T1112] netlink: 8 bytes leftover after parsing attributes in process `syz.0.270'. [ 50.824638][ T36] kauditd_printk_skb: 578 callbacks suppressed [ 50.824655][ T36] audit: type=1400 audit(1772289945.152:1685): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 50.855841][ T36] audit: type=1400 audit(1772289945.152:1686): avc: denied { create } for pid=1122 comm="syz.0.273" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=0 [ 50.877009][ T36] audit: type=1400 audit(1772289945.192:1687): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 50.887277][ T1125] netlink: 'syz.0.274': attribute type 25 has an invalid length. [ 50.910249][ T36] audit: type=1400 audit(1772289945.232:1688): avc: denied { read write } for pid=1124 comm="syz.0.274" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 50.933701][ T36] audit: type=1400 audit(1772289945.232:1689): avc: denied { read } for pid=1124 comm="syz.0.274" dev="nsfs" ino=4026532299 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=0 [ 51.191543][ T36] audit: type=1400 audit(1772289945.512:1690): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 51.215774][ T36] audit: type=1400 audit(1772289945.522:1691): avc: denied { create } for pid=1126 comm="syz.2.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=0 [ 51.240111][ T36] audit: type=1400 audit(1772289945.522:1692): avc: denied { read write } for pid=1126 comm="syz.2.275" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=0 [ 51.263532][ T36] audit: type=1400 audit(1772289945.522:1693): avc: denied { create } for pid=1126 comm="syz.2.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=0 [ 51.283965][ T36] audit: type=1400 audit(1772289945.522:1694): avc: denied { create } for pid=1126 comm="syz.2.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=0 [ 51.441852][ T1137] netlink: 393 bytes leftover after parsing attributes in process `syz.0.280'. [ 52.061596][ T1174] netlink: 'syz.0.293': attribute type 27 has an invalid length. [ 52.070999][ T1174] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 52.098333][ T1176] netlink: 'syz.0.294': attribute type 12 has an invalid length. [ 52.416281][ T1199] netlink: 328 bytes leftover after parsing attributes in process `syz.1.304'. [ 52.426161][ T1200] netlink: 64 bytes leftover after parsing attributes in process `syz.1.304'. [ 52.766766][ T1249] veth1_macvtap: left promiscuous mode [ 52.772347][ T1249] macsec0: entered promiscuous mode [ 52.778957][ T1249] veth1_macvtap: entered promiscuous mode [ 52.784835][ T1249] macsec0: left promiscuous mode [ 53.424217][ T1289] netlink: 'syz.2.335': attribute type 4 has an invalid length. [ 53.432013][ T1289] netlink: 'syz.2.335': attribute type 5 has an invalid length. [ 53.439844][ T1289] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.335'. [ 53.487183][ T1297] syz.2.338: attempt to access beyond end of device [ 53.487183][ T1297] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 54.315150][ T1340] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.325437][ T1340] bridge_slave_0 (unregistering): left allmulticast mode [ 54.332548][ T1340] bridge_slave_0 (unregistering): left promiscuous mode [ 54.343923][ T1340] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.674332][ T1379] netlink: 316 bytes leftover after parsing attributes in process `syz.2.365'. [ 54.685932][ T1379] netlink: 316 bytes leftover after parsing attributes in process `syz.2.365'. [ 55.835859][ T36] kauditd_printk_skb: 544 callbacks suppressed [ 55.835877][ T36] audit: type=1400 audit(1772289950.162:2239): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 55.866442][ T36] audit: type=1400 audit(1772289950.172:2240): avc: denied { create } for pid=1410 comm="syz.2.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=0 [ 55.886069][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 55.892705][ T36] audit: type=1400 audit(1772289950.172:2241): avc: denied { create } for pid=1410 comm="syz.2.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=0 [ 55.912943][ T36] audit: type=1400 audit(1772289950.172:2242): avc: denied { read } for pid=1410 comm="syz.2.375" dev="nsfs" ino=4026532469 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=0 [ 56.090794][ T36] audit: type=1400 audit(1772289950.412:2243): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 56.945230][ T36] audit: type=1400 audit(1772289951.272:2244): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 56.975445][ T36] audit: type=1400 audit(1772289951.302:2245): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 56.999531][ T36] audit: type=1400 audit(1772289951.312:2246): avc: denied { read write } for pid=1422 comm="syz.3.378" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=0 [ 57.023845][ T36] audit: type=1400 audit(1772289951.312:2247): avc: denied { create } for pid=1422 comm="syz.3.378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=0 [ 57.043450][ T36] audit: type=1400 audit(1772289951.352:2248): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 57.923159][ T55] Bluetooth: hci0: command 0x1003 tx timeout [ 57.923159][ T1009] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 59.755366][ T1549] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1549 comm=syz.2.427 [ 60.886440][ T36] kauditd_printk_skb: 324 callbacks suppressed [ 60.886458][ T36] audit: type=1400 audit(1772289955.212:2573): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 60.916944][ T36] audit: type=1400 audit(1772289955.232:2574): avc: denied { read write } for pid=1589 comm="syz.1.442" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=0 [ 60.941524][ T36] audit: type=1400 audit(1772289955.232:2575): avc: denied { read write } for pid=1589 comm="syz.1.442" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=0 [ 60.965512][ T36] audit: type=1400 audit(1772289955.232:2576): avc: denied { mounton } for pid=1589 comm="syz.1.442" path="/137/file0" dev="tmpfs" ino=761 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 60.988187][ T36] audit: type=1400 audit(1772289955.232:2577): avc: denied { mounton } for pid=1589 comm="syz.1.442" path="/137/file0" dev="tmpfs" ino=761 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 61.018149][ T36] audit: type=1400 audit(1772289955.232:2578): avc: denied { create } for pid=1589 comm="syz.1.442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=0 [ 61.040359][ T36] audit: type=1400 audit(1772289955.232:2579): avc: denied { mounton } for pid=1589 comm="syz.1.442" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0 [ 61.065419][ T36] audit: type=1400 audit(1772289955.232:2580): avc: denied { mounton } for pid=1589 comm="syz.1.442" path="/137/bus" dev="tmpfs" ino=760 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 61.088003][ T36] audit: type=1400 audit(1772289955.252:2581): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 61.112349][ T36] audit: type=1400 audit(1772289955.262:2582): avc: denied { create } for pid=1591 comm="syz.1.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=0 [ 61.158010][ T1612] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 61.166230][ T1612] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 61.260345][ T1615] netlink: 12 bytes leftover after parsing attributes in process `syz.0.451'. [ 62.983028][ T1687] pim6reg1: entered promiscuous mode [ 62.988407][ T1687] pim6reg1: entered allmulticast mode [ 64.616760][ T1787] cgroup: fork rejected by pids controller in /syz1 [ 65.622664][ T1887] netlink: 'syz.3.532': attribute type 11 has an invalid length. [ 65.642450][ T1889] netlink: 'syz.3.533': attribute type 6 has an invalid length. [ 65.995483][ T36] kauditd_printk_skb: 311 callbacks suppressed [ 65.995501][ T36] audit: type=1400 audit(1772289960.322:2894): avc: denied { read write } for pid=293 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 66.026058][ T36] audit: type=1400 audit(1772289960.332:2895): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 66.050309][ T36] audit: type=1400 audit(1772289960.342:2896): avc: denied { read write } for pid=1897 comm="syz.2.536" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 66.073847][ T36] audit: type=1400 audit(1772289960.352:2897): avc: denied { read write } for pid=1897 comm="syz.2.536" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 66.097376][ T36] audit: type=1400 audit(1772289960.352:2898): avc: denied { read } for pid=1899 comm="syz.0.537" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 66.120076][ T36] audit: type=1400 audit(1772289960.352:2899): avc: denied { read } for pid=1899 comm="syz.0.537" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 66.143417][ T36] audit: type=1400 audit(1772289960.362:2900): avc: denied { read } for pid=1899 comm="syz.0.537" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 66.166263][ T36] audit: type=1400 audit(1772289960.382:2901): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 66.190766][ T36] audit: type=1400 audit(1772289960.392:2902): avc: denied { read } for pid=1901 comm="syz.0.538" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 66.213558][ T36] audit: type=1400 audit(1772289960.532:2903): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 67.225138][ T1987] netlink: 4 bytes leftover after parsing attributes in process `syz.0.560'. [ 68.386017][ T2025] netlink: 'syz.1.574': attribute type 5 has an invalid length. [ 68.393823][ T2025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.574'. [ 69.409920][ T2064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.589'. [ 69.741785][ T2076] syzkaller1: entered promiscuous mode [ 69.747461][ T2076] syzkaller1: entered allmulticast mode [ 69.838752][ T2089] 2N: renamed from vcan0 (while UP) [ 69.970848][ T2097] netlink: 4 bytes leftover after parsing attributes in process `syz.3.600'. [ 69.994668][ T2099] netlink: 'syz.1.601': attribute type 29 has an invalid length. [ 70.003043][ T2099] netlink: 'syz.1.601': attribute type 3 has an invalid length. [ 70.010819][ T2101] binfmt_misc: register: failed to install interpreter file ./file0 [ 70.010839][ T2099] netlink: 'syz.1.601': attribute type 4 has an invalid length. [ 70.026833][ T2099] netlink: 'syz.1.601': attribute type 6 has an invalid length. [ 70.034688][ T2099] netlink: 'syz.1.601': attribute type 7 has an invalid length. [ 70.042483][ T2099] netlink: 'syz.1.601': attribute type 5 has an invalid length. [ 70.050262][ T2099] netlink: 'syz.1.601': attribute type 15 has an invalid length. [ 70.058053][ T2099] netlink: 60942 bytes leftover after parsing attributes in process `syz.1.601'. [ 70.139471][ T2117] x_tables: unsorted underflow at hook 4 [ 71.039064][ T36] kauditd_printk_skb: 500 callbacks suppressed [ 71.039082][ T36] audit: type=1400 audit(1772289965.365:3404): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 71.069393][ T36] audit: type=1400 audit(1772289965.385:3405): avc: denied { create } for pid=2227 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=0 [ 71.088861][ T36] audit: type=1400 audit(1772289965.385:3406): avc: denied { create } for pid=2227 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=0 [ 71.108315][ T36] audit: type=1400 audit(1772289965.395:3407): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 71.132482][ T36] audit: type=1400 audit(1772289965.415:3408): avc: denied { mounton } for pid=2229 comm="syz.1.636" path="/190/file0" dev="tmpfs" ino=1056 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 71.155018][ T36] audit: type=1400 audit(1772289965.415:3409): avc: denied { mount } for pid=2229 comm="syz.1.636" name="/" dev="configfs" ino=2308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=0 [ 71.177713][ T36] audit: type=1400 audit(1772289965.415:3410): avc: denied { write } for pid=2229 comm="syz.1.636" name="001" dev="devtmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=0 [ 71.200431][ T36] audit: type=1400 audit(1772289965.445:3411): avc: denied { read write } for pid=292 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 71.224549][ T36] audit: type=1400 audit(1772289965.465:3412): avc: denied { read write } for pid=2231 comm="syz.1.637" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 71.248103][ T36] audit: type=1400 audit(1772289965.535:3413): avc: denied { read write } for pid=290 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 71.429576][ T2242] syz.3.642 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 71.966917][ T2303] netlink: 'syz.3.652': attribute type 4 has an invalid length. [ 71.974641][ T2303] netlink: 17 bytes leftover after parsing attributes in process `syz.3.652'. [ 73.102361][ T2343] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=2343 comm=syz.0.666 [ 73.764130][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 73.823648][ T2396] FAULT_INJECTION: forcing a failure. [ 73.823648][ T2396] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 73.836791][ T2396] CPU: 0 UID: 0 PID: 2396 Comm: syz.0.686 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 73.836823][ T2396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 73.836845][ T2396] Call Trace: [ 73.836851][ T2396] [ 73.836856][ T2396] __dump_stack+0x21/0x30 [ 73.836877][ T2396] dump_stack_lvl+0x140/0x1c0 [ 73.836894][ T2396] ? __cfi_dump_stack_lvl+0x10/0x10 [ 73.836911][ T2396] ? find_vma+0xd3/0x120 [ 73.836928][ T2396] dump_stack+0x19/0x20 [ 73.836944][ T2396] should_fail_ex+0x3d7/0x530 [ 73.836958][ T2396] should_fail+0xf/0x20 [ 73.836970][ T2396] should_fail_usercopy+0x1e/0x30 [ 73.836985][ T2396] _copy_from_user+0x20/0xa0 [ 73.837002][ T2396] io_submit_one+0xe3/0x1980 [ 73.837024][ T2396] ? lookup_ioctx+0x360/0x360 [ 73.837044][ T2396] ? asm_exc_page_fault+0x2b/0x30 [ 73.837067][ T2396] ? __asan_memset+0x39/0x50 [ 73.837083][ T2396] ? blk_start_plug+0x71/0x1c0 [ 73.837099][ T2396] __se_sys_io_submit+0x17f/0x3f0 [ 73.837118][ T2396] ? __x64_sys_io_submit+0xa0/0xa0 [ 73.837136][ T2396] ? ksys_write+0x1f3/0x260 [ 73.837154][ T2396] ? __kasan_check_read+0x15/0x20 [ 73.837170][ T2396] __x64_sys_io_submit+0x7f/0xa0 [ 73.837188][ T2396] x64_sys_call+0x1c95/0x2ee0 [ 73.837207][ T2396] do_syscall_64+0x57/0xf0 [ 73.837220][ T2396] ? clear_bhb_loop+0x50/0xa0 [ 73.837232][ T2396] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 73.837253][ T2396] RIP: 0033:0x7f9a3f19c799 [ 73.837271][ T2396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.837282][ T2396] RSP: 002b:00007f9a3ff87028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 73.837297][ T2396] RAX: ffffffffffffffda RBX: 00007f9a3f415fa0 RCX: 00007f9a3f19c799 [ 73.837307][ T2396] RDX: 0000200000001640 RSI: 0000000000000016 RDI: 00007f9a3ff64000 [ 73.837316][ T2396] RBP: 00007f9a3ff87090 R08: 0000000000000000 R09: 0000000000000000 [ 73.837325][ T2396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.837333][ T2396] R13: 00007f9a3f416038 R14: 00007f9a3f415fa0 R15: 00007ffd7eaaf578 [ 73.837345][ T2396] [ 74.531255][ T2412] netlink: 'syz.2.691': attribute type 9 has an invalid length. [ 74.702516][ T2425] FAULT_INJECTION: forcing a failure. [ 74.702516][ T2425] name failslab, interval 1, probability 0, space 0, times 1 [ 74.715251][ T2425] CPU: 0 UID: 0 PID: 2425 Comm: syz.0.697 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 74.715279][ T2425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 74.715291][ T2425] Call Trace: [ 74.715299][ T2425] [ 74.715310][ T2425] __dump_stack+0x21/0x30 [ 74.715331][ T2425] dump_stack_lvl+0x140/0x1c0 [ 74.715348][ T2425] ? __cfi_dump_stack_lvl+0x10/0x10 [ 74.715365][ T2425] ? __cfi_handle_mm_fault+0x10/0x10 [ 74.715385][ T2425] dump_stack+0x19/0x20 [ 74.715401][ T2425] should_fail_ex+0x3d7/0x530 [ 74.715415][ T2425] should_failslab+0xac/0x100 [ 74.715435][ T2425] kmem_cache_alloc_noprof+0x42/0x410 [ 74.715452][ T2425] ? io_submit_one+0x157/0x1980 [ 74.715474][ T2425] io_submit_one+0x157/0x1980 [ 74.715499][ T2425] ? lookup_ioctx+0x360/0x360 [ 74.715519][ T2425] ? asm_exc_page_fault+0x2b/0x30 [ 74.715542][ T2425] ? __asan_memset+0x39/0x50 [ 74.715558][ T2425] ? blk_start_plug+0x71/0x1c0 [ 74.715574][ T2425] __se_sys_io_submit+0x17f/0x3f0 [ 74.715593][ T2425] ? __x64_sys_io_submit+0xa0/0xa0 [ 74.715611][ T2425] ? ksys_write+0x1f3/0x260 [ 74.715628][ T2425] ? __kasan_check_read+0x15/0x20 [ 74.715644][ T2425] __x64_sys_io_submit+0x7f/0xa0 [ 74.715663][ T2425] x64_sys_call+0x1c95/0x2ee0 [ 74.715682][ T2425] do_syscall_64+0x57/0xf0 [ 74.715694][ T2425] ? clear_bhb_loop+0x50/0xa0 [ 74.715707][ T2425] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 74.715727][ T2425] RIP: 0033:0x7f9a3f19c799 [ 74.715738][ T2425] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.715750][ T2425] RSP: 002b:00007f9a3ff87028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 74.715764][ T2425] RAX: ffffffffffffffda RBX: 00007f9a3f415fa0 RCX: 00007f9a3f19c799 [ 74.715774][ T2425] RDX: 0000200000001640 RSI: 0000000000000016 RDI: 00007f9a3ff64000 [ 74.715783][ T2425] RBP: 00007f9a3ff87090 R08: 0000000000000000 R09: 0000000000000000 [ 74.715792][ T2425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 74.715800][ T2425] R13: 00007f9a3f416038 R14: 00007f9a3f415fa0 R15: 00007ffd7eaaf578 [ 74.715812][ T2425] [ 75.105116][ T2441] cgroup: fork rejected by pids controller in /syz0 [ 75.241951][ T2582] FAULT_INJECTION: forcing a failure. [ 75.241951][ T2582] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 75.301685][ T2582] CPU: 1 UID: 0 PID: 2582 Comm: syz.0.707 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 75.301726][ T2582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 75.301739][ T2582] Call Trace: [ 75.301747][ T2582] [ 75.301755][ T2582] __dump_stack+0x21/0x30 [ 75.301799][ T2582] dump_stack_lvl+0x140/0x1c0 [ 75.301824][ T2582] ? __cfi_dump_stack_lvl+0x10/0x10 [ 75.301851][ T2582] ? check_stack_object+0x12b/0x150 [ 75.301878][ T2582] dump_stack+0x19/0x20 [ 75.301902][ T2582] should_fail_ex+0x3d7/0x530 [ 75.301924][ T2582] should_fail+0xf/0x20 [ 75.301943][ T2582] should_fail_usercopy+0x1e/0x30 [ 75.301966][ T2582] _copy_to_user+0x24/0xa0 [ 75.301992][ T2582] simple_read_from_buffer+0xed/0x160 [ 75.302026][ T2582] proc_fail_nth_read+0x1aa/0x220 [ 75.302047][ T2582] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 75.302068][ T2582] ? __cfi_blk_mq_flush_plug_list+0x10/0x10 [ 75.302091][ T2582] ? bpf_lsm_file_permission+0xd/0x20 [ 75.302111][ T2582] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 75.302132][ T2582] vfs_read+0x289/0xcb0 [ 75.302157][ T2582] ? __cfi_vfs_read+0x10/0x10 [ 75.302180][ T2582] ? __kasan_check_write+0x18/0x20 [ 75.302204][ T2582] ? mutex_lock+0x97/0x1d0 [ 75.302228][ T2582] ? __cfi_mutex_lock+0x10/0x10 [ 75.302251][ T2582] ? __fget_files+0x2c5/0x340 [ 75.302282][ T2582] ksys_read+0x145/0x260 [ 75.302306][ T2582] ? __cfi_ksys_read+0x10/0x10 [ 75.302331][ T2582] ? __kasan_check_read+0x15/0x20 [ 75.302355][ T2582] __x64_sys_read+0x7f/0x90 [ 75.302380][ T2582] x64_sys_call+0x2638/0x2ee0 [ 75.302408][ T2582] do_syscall_64+0x57/0xf0 [ 75.302426][ T2582] ? clear_bhb_loop+0x50/0xa0 [ 75.302446][ T2582] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 75.302477][ T2582] RIP: 0033:0x7f9a3f15cfce [ 75.302494][ T2582] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 75.302510][ T2582] RSP: 002b:00007f9a3ff86fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 75.302532][ T2582] RAX: ffffffffffffffda RBX: 00007f9a3ff876c0 RCX: 00007f9a3f15cfce [ 75.302548][ T2582] RDX: 000000000000000f RSI: 00007f9a3ff870a0 RDI: 0000000000000003 [ 75.302562][ T2582] RBP: 00007f9a3ff87090 R08: 0000000000000000 R09: 0000000000000000 [ 75.302575][ T2582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 75.302587][ T2582] R13: 00007f9a3f416038 R14: 00007f9a3f415fa0 R15: 00007ffd7eaaf578 [ 75.302606][ T2582] [ 75.742506][ T2602] can0: slcan on ptm1. [ 75.763026][ T55] Bluetooth: hci0: command 0x1003 tx timeout [ 75.773061][ T1009] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 75.891050][ T2611] netlink: 5 bytes leftover after parsing attributes in process `syz.3.718'. [ 75.910491][ T2611] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 76.028790][ T2615] netlink: 8 bytes leftover after parsing attributes in process `syz.3.720'. [ 76.042999][ T36] kauditd_printk_skb: 1936 callbacks suppressed [ 76.043017][ T36] audit: type=1400 audit(1772289970.365:5350): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 76.076981][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 76.083811][ T150] audit: audit_lost=128 audit_rate_limit=0 audit_backlog_limit=64 [ 76.093004][ T291] audit: audit_backlog=65 > audit_backlog_limit=64 [ 76.099597][ T150] audit: backlog limit exceeded [ 76.104663][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 76.111428][ T36] audit: type=1400 audit(1772289970.395:5351): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 76.123165][ T291] audit: audit_lost=129 audit_rate_limit=0 audit_backlog_limit=64 [ 76.132849][ T150] audit: audit_lost=130 audit_rate_limit=0 audit_backlog_limit=64 [ 76.148180][ T150] audit: backlog limit exceeded [ 76.235992][ T2620] netlink: 'syz.3.721': attribute type 5 has an invalid length. [ 76.258708][ T2620] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.721'. [ 76.283231][ T2600] can0 (unregistered): slcan off ptm1. [ 77.120189][ T2651] ªªªªªª: renamed from vlan0 (while UP) [ 77.572183][ T2683] IPv6: NLM_F_CREATE should be specified when creating new route [ 77.674528][ T2689] capability: warning: `syz.2.748' uses 32-bit capabilities (legacy support in use) [ 78.164157][ T2708] netlink: 'syz.3.755': attribute type 10 has an invalid length. [ 78.172049][ T2708] netlink: 5 bytes leftover after parsing attributes in process `syz.3.755'. [ 78.184629][ T2708] bridge_slave_1: left promiscuous mode [ 78.190785][ T2708] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.343858][ T2725] netlink: 4 bytes leftover after parsing attributes in process `syz.2.760'. [ 78.352679][ T2725] bridge_slave_1: left allmulticast mode [ 78.393001][ T2725] bridge_slave_1: left promiscuous mode [ 78.398647][ T2725] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.433353][ T2725] bridge_slave_0: left allmulticast mode [ 78.439020][ T2725] bridge_slave_0: left promiscuous mode [ 78.453129][ T2725] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.914169][ T2737] netlink: 4 bytes leftover after parsing attributes in process `syz.1.764'. [ 78.953469][ T2737] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2737 comm=syz.1.764 [ 79.157652][ T2741] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=2741 comm=syz.2.766 [ 79.648451][ T2759] netlink: 24 bytes leftover after parsing attributes in process `syz.3.773'. [ 80.525759][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 80.737808][ T2789] netlink: 'syz.1.785': attribute type 16 has an invalid length. [ 80.745842][ T2789] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.785'. [ 81.053018][ T36] kauditd_printk_skb: 46184 callbacks suppressed [ 81.053036][ T36] audit: type=1400 audit(1772289975.375:51310): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 81.071724][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 81.087421][ T150] audit: audit_lost=206 audit_rate_limit=0 audit_backlog_limit=64 [ 81.088562][ T290] audit: audit_backlog=65 > audit_backlog_limit=64 [ 81.096176][ T150] audit: backlog limit exceeded [ 81.101804][ T290] audit: audit_lost=207 audit_rate_limit=0 audit_backlog_limit=64 [ 81.107412][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 81.114501][ T36] audit: type=1400 audit(1772289975.385:51311): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 81.121554][ T150] audit: audit_lost=208 audit_rate_limit=0 audit_backlog_limit=64 [ 81.142198][ T290] audit: backlog limit exceeded [ 82.128607][ T2880] netlink: 'syz.1.817': attribute type 4 has an invalid length. [ 82.137558][ T2880] netlink: 3649 bytes leftover after parsing attributes in process `syz.1.817'. [ 82.165742][ T2880] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2880 comm=syz.1.817 [ 82.563003][ T1009] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 83.115307][ T2904] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2904 comm=syz.3.825 [ 86.063025][ T36] kauditd_printk_skb: 43385 callbacks suppressed [ 86.063041][ T36] audit: type=1400 audit(1772289980.395:93646): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 86.081905][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 86.097884][ T150] audit: audit_lost=559 audit_rate_limit=0 audit_backlog_limit=64 [ 86.105974][ T36] audit: type=1400 audit(1772289980.395:93647): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 86.109598][ T150] audit: backlog limit exceeded [ 86.127249][ T36] audit: type=1400 audit(1772289980.395:93648): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 86.133311][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 86.153235][ T36] audit: type=1400 audit(1772289980.395:93649): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 86.159637][ T150] audit: audit_lost=560 audit_rate_limit=0 audit_backlog_limit=64 [ 86.180800][ T36] audit: type=1400 audit(1772289980.395:93650): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 86.302880][ T3021] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=63 sclass=netlink_route_socket pid=3021 comm=syz.1.869 [ 87.242920][ T3084] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.892'. [ 88.444408][ T3117] netlink: 9 bytes leftover after parsing attributes in process `syz.0.903'. [ 88.454474][ T3117] gretap0: entered promiscuous mode [ 88.770408][ T3150] can0: slcan on ptm1. [ 88.814134][ T3148] can0 (unregistered): slcan off ptm1. [ 89.617406][ T3160] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3160 comm=syz.2.918 [ 89.630132][ T3161] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3161 comm=syz.2.918 [ 90.243071][ T1009] Bluetooth: hci0: command 0x1003 tx timeout [ 90.245096][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 90.696666][ T3196] netlink: 4 bytes leftover after parsing attributes in process `syz.0.931'. [ 90.827043][ T3208] netlink: 'syz.0.937': attribute type 29 has an invalid length. [ 91.073262][ T36] kauditd_printk_skb: 42854 callbacks suppressed [ 91.073297][ T36] audit: type=1400 audit(1772289985.395:136096): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 91.118380][ T36] audit: type=1400 audit(1772289985.395:136097): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 91.142568][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 91.151309][ T36] audit: type=1400 audit(1772289985.395:136098): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 91.163035][ T150] audit: audit_lost=697 audit_rate_limit=0 audit_backlog_limit=64 [ 91.174483][ T292] audit: audit_backlog=65 > audit_backlog_limit=64 [ 91.187268][ T292] audit: audit_lost=698 audit_rate_limit=0 audit_backlog_limit=64 [ 91.192114][ T3212] audit: audit_backlog=65 > audit_backlog_limit=64 [ 91.195432][ T36] audit: type=1400 audit(1772289985.425:136099): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 91.202446][ T150] audit: backlog limit exceeded [ 91.857040][ T3256] .N: renamed from veth0_to_bond (while UP) [ 93.485924][ T3355] vlan0: entered allmulticast mode [ 93.495662][ T3355] veth0_vlan: entered allmulticast mode [ 94.588194][ T3401] netlink: 'syz.1.1008': attribute type 58 has an invalid length. [ 94.624058][ T3400] netlink: 'syz.1.1008': attribute type 58 has an invalid length. [ 95.374287][ T3427] netlink: 'syz.0.1020': attribute type 27 has an invalid length. [ 95.405995][ T3427] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.083019][ T36] kauditd_printk_skb: 39213 callbacks suppressed [ 96.083069][ T36] audit: type=1400 audit(1772289990.405:174884): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 96.099651][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 96.110733][ T36] audit: type=1400 audit(1772289990.415:174885): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 96.117958][ T150] audit: audit_lost=842 audit_rate_limit=0 audit_backlog_limit=64 [ 96.138515][ T36] audit: type=1400 audit(1772289990.415:174886): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 96.167245][ T36] audit: type=1400 audit(1772289990.415:174887): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 96.172905][ T150] audit: backlog limit exceeded [ 96.189272][ T36] audit: type=1400 audit(1772289990.415:174888): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 96.203981][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 96.218820][ T3442] audit: audit_backlog=65 > audit_backlog_limit=64 [ 96.747563][ T3454] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1031'. [ 98.656645][ T3525] pim6reg1: entered promiscuous mode [ 98.662214][ T3525] pim6reg1: entered allmulticast mode [ 98.750185][ T3533] netlink: 'syz.3.1059': attribute type 10 has an invalid length. [ 101.093031][ T36] kauditd_printk_skb: 46350 callbacks suppressed [ 101.093050][ T36] audit: type=1400 audit(1772289995.415:220803): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 101.120915][ T36] audit: type=1400 audit(1772289995.425:220804): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 101.136013][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 101.142546][ T36] audit: type=1400 audit(1772289995.425:220805): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 101.148891][ T150] audit: audit_lost=989 audit_rate_limit=0 audit_backlog_limit=64 [ 101.170063][ T36] audit: type=1400 audit(1772289995.425:220806): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 101.177605][ T150] audit: backlog limit exceeded [ 101.198992][ T36] audit: type=1400 audit(1772289995.425:220807): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 101.204743][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 101.224920][ T36] audit: type=1400 audit(1772289995.425:220808): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.103022][ T36] kauditd_printk_skb: 55799 callbacks suppressed [ 106.103041][ T36] audit: type=1400 audit(1772290000.425:276171): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.121516][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 106.131146][ T36] audit: type=1400 audit(1772290000.435:276172): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.137328][ T150] audit: audit_lost=1136 audit_rate_limit=0 audit_backlog_limit=64 [ 106.158646][ T36] audit: type=1400 audit(1772290000.435:276173): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.166710][ T150] audit: backlog limit exceeded [ 106.187760][ T36] audit: type=1400 audit(1772290000.435:276174): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.193475][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 106.213286][ T36] audit: type=1400 audit(1772290000.435:276175): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 106.220326][ T150] audit: audit_lost=1137 audit_rate_limit=0 audit_backlog_limit=64 [ 106.376207][ T3547] netlink: 'syz.1.1063': attribute type 58 has an invalid length. [ 108.451129][ T3655] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1104'. [ 109.070633][ T3680] netlink: 'syz.1.1113': attribute type 16 has an invalid length. [ 110.175194][ T3736] netlink: 'syz.3.1134': attribute type 16 has an invalid length. [ 110.183346][ T3736] netlink: 'syz.3.1134': attribute type 3 has an invalid length. [ 110.191299][ T3736] netlink: 64054 bytes leftover after parsing attributes in process `syz.3.1134'. [ 111.112972][ T36] kauditd_printk_skb: 47664 callbacks suppressed [ 111.113029][ T36] audit: type=1400 audit(1772290005.435:323224): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 111.130138][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 111.141280][ T36] audit: type=1400 audit(1772290005.445:323225): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 111.147211][ T150] audit: audit_lost=1343 audit_rate_limit=0 audit_backlog_limit=64 [ 111.168684][ T36] audit: type=1400 audit(1772290005.445:323226): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 111.176174][ T150] audit: backlog limit exceeded [ 111.202276][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 111.208860][ T150] audit: audit_lost=1344 audit_rate_limit=0 audit_backlog_limit=64 [ 111.213532][ T36] audit: type=1400 audit(1772290005.445:323227): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 111.223542][ T150] audit: backlog limit exceeded [ 111.504914][ T3806] netlink: 'syz.0.1162': attribute type 13 has an invalid length. [ 111.732600][ T3827] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=3827 comm=syz.3.1167 [ 111.747096][ T3827] netlink: 'syz.3.1167': attribute type 8 has an invalid length. [ 116.123016][ T36] kauditd_printk_skb: 50793 callbacks suppressed [ 116.123033][ T36] audit: type=1400 audit(1772290010.445:373934): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 116.150753][ T36] audit: type=1400 audit(1772290010.455:373935): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 116.164402][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 116.172289][ T36] audit: type=1400 audit(1772290010.455:373936): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 116.178555][ T150] audit: audit_lost=1374 audit_rate_limit=0 audit_backlog_limit=64 [ 116.199867][ T36] audit: type=1400 audit(1772290010.455:373937): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 116.207499][ T150] audit: backlog limit exceeded [ 116.228777][ T36] audit: type=1400 audit(1772290010.455:373938): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 116.234435][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 116.256694][ T36] audit: type=1400 audit(1772290010.455:373939): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 119.659543][ T3853] netlink: 'syz.2.1180': attribute type 27 has an invalid length. [ 120.509239][ T3876] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1189'. [ 120.649200][ T3888] sit0: entered promiscuous mode [ 120.658353][ T3888] netlink: 'syz.2.1194': attribute type 1 has an invalid length. [ 120.667133][ T3888] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1194'. [ 121.133352][ T36] kauditd_printk_skb: 54667 callbacks suppressed [ 121.133368][ T36] audit: type=1400 audit(1772290015.455:428161): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 121.149566][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 121.161180][ T3928] audit: audit_backlog=65 > audit_backlog_limit=64 [ 121.168390][ T150] audit: audit_lost=1524 audit_rate_limit=0 audit_backlog_limit=64 [ 121.175395][ T3928] audit: audit_lost=1525 audit_rate_limit=0 audit_backlog_limit=64 [ 121.182536][ T150] audit: backlog limit exceeded [ 121.189738][ T36] audit: type=1400 audit(1772290015.465:428162): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 121.195753][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 121.216122][ T3928] audit: backlog limit exceeded [ 121.223888][ T150] audit: audit_lost=1526 audit_rate_limit=0 audit_backlog_limit=64 [ 121.274218][ T3937] can0: slcan on ptm0. [ 121.823460][ T3934] can0 (unregistered): slcan off ptm0. [ 122.909414][ T3990] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 122.915531][ T3990] syzkaller1: Linktype set failed because interface is up [ 123.034641][ T3997] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1232'. [ 123.043623][ T3997] z00ªX¹¦: renamed from gretap0 (while UP) [ 123.050268][ T3997] z00ªX¹¦: entered allmulticast mode [ 125.372632][ T331] veth1_macvtap: left promiscuous mode [ 125.384350][ T331] veth0_vlan: left promiscuous mode [ 125.664879][ T331] ------------[ cut here ]------------ [ 125.670490][ T331] WARNING: CPU: 0 PID: 331 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 125.680543][ T331] Modules linked in: [ 125.684480][ T331] CPU: 0 UID: 0 PID: 331 Comm: kworker/u8:4 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 125.696140][ T331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 125.706222][ T331] Workqueue: netns cleanup_net [ 125.711014][ T331] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 125.717033][ T331] Code: e8 e1 99 db fc 4b 83 3c 3e 00 75 19 e8 b5 b7 83 fc 49 81 ff f8 07 00 00 74 1b e8 a7 b7 83 fc 49 83 c7 08 eb c9 e8 9c b7 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 125.736686][ T331] RSP: 0018:ffffc9000b8dfb90 EFLAGS: 00010293 [ 125.742778][ T331] RAX: ffffffff8503e7c4 RBX: ffff88810beb4700 RCX: ffff888131aca600 [ 125.750785][ T331] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888103f50000 [ 125.758781][ T331] RBP: ffffc9000b8dfbb0 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 125.766792][ T331] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: dffffc0000000000 [ 125.774905][ T331] R13: dffffc0000000000 R14: ffff888103f50000 R15: 0000000000000000 [ 125.782891][ T331] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 125.791853][ T331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.798491][ T331] CR2: 00007f50219ffffc CR3: 000000010b38e000 CR4: 00000000003526b0 [ 125.806510][ T331] Call Trace: [ 125.809805][ T331] [ 125.812745][ T331] cleanup_net+0x6bd/0xc90 [ 125.817191][ T331] ? __cfi_cleanup_net+0x10/0x10 [ 125.822145][ T331] ? __schedule+0x1357/0x1ea0 [ 125.826863][ T331] ? kick_pool+0xb9/0x550 [ 125.831227][ T331] process_scheduled_works+0x7d4/0x1020 [ 125.836850][ T331] worker_thread+0xc70/0x10b0 [ 125.841557][ T331] ? __cfi_try_to_wake_up+0x10/0x10 [ 125.846790][ T331] kthread+0x2c9/0x370 [ 125.850872][ T331] ? __cfi_worker_thread+0x10/0x10 [ 125.856020][ T331] ? __cfi_kthread+0x10/0x10 [ 125.860627][ T331] ret_from_fork+0x64/0xa0 [ 125.865095][ T331] ? __cfi_kthread+0x10/0x10 [ 125.869706][ T331] ret_from_fork_asm+0x1a/0x30 [ 125.874510][ T331] [ 125.877553][ T331] ---[ end trace 0000000000000000 ]--- [ 125.943790][ T10] usb 1-1: USB disconnect, device number 6 [ 125.954768][ T331] ------------[ cut here ]------------ [ 125.960253][ T331] WARNING: CPU: 0 PID: 331 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 125.970387][ T331] Modules linked in: [ 125.974324][ T331] CPU: 0 UID: 0 PID: 331 Comm: kworker/u8:4 Tainted: G W syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 125.987471][ T331] Tainted: [W]=WARN [ 125.991307][ T331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 126.001403][ T331] Workqueue: netns cleanup_net [ 126.006223][ T331] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 126.012329][ T331] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 60 b7 83 fc 49 81 ff f8 07 00 00 74 1b e8 52 b7 83 fc 49 83 c7 08 eb c5 e8 47 b7 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 37 b7 83 fc 5b 41 5c 41 5e 41 [ 126.031966][ T331] RSP: 0018:ffffc9000b8dfb90 EFLAGS: 00010293 [ 126.038079][ T331] RAX: ffffffff8503e819 RBX: ffff888103f50800 RCX: ffff888131aca600 [ 126.046105][ T331] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888103f50808 [ 126.054124][ T331] RBP: ffffc9000b8dfbb0 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 126.062118][ T331] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: dffffc0000000000 [ 126.070138][ T331] R13: dffffc0000000000 R14: ffff888103f50000 R15: 0000000000000008 [ 126.078165][ T331] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 126.087129][ T331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.093758][ T331] CR2: 0000557a70fcfaf8 CR3: 000000010b38e000 CR4: 00000000003526b0 [ 126.101751][ T331] Call Trace: [ 126.105056][ T331] [ 126.108002][ T331] cleanup_net+0x6bd/0xc90 [ 126.112442][ T331] ? __cfi_cleanup_net+0x10/0x10 [ 126.117436][ T331] ? __schedule+0x1357/0x1ea0 [ 126.122132][ T331] ? kick_pool+0xb9/0x550 [ 126.126505][ T331] process_scheduled_works+0x7d4/0x1020 [ 126.132108][ T331] worker_thread+0xc70/0x10b0 [ 126.136853][ T331] ? __cfi_try_to_wake_up+0x10/0x10 [ 126.142067][ T331] kthread+0x2c9/0x370 [ 126.143174][ T36] kauditd_printk_skb: 47003 callbacks suppressed [ 126.143209][ T36] audit: type=1400 audit(1772290020.475:473899): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 126.146189][ T331] ? __cfi_worker_thread+0x10/0x10 [ 126.153785][ T36] audit: type=1400 audit(1772290020.475:473900): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 126.173597][ T331] ? __cfi_kthread+0x10/0x10 [ 126.204418][ T331] ret_from_fork+0x64/0xa0 [ 126.208859][ T331] ? __cfi_kthread+0x10/0x10 [ 126.211966][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 126.213477][ T331] ret_from_fork_asm+0x1a/0x30 [ 126.224781][ T331] [ 126.227827][ T331] ---[ end trace 0000000000000000 ]--- [ 126.233088][ T150] audit: audit_lost=1949 audit_rate_limit=0 audit_backlog_limit=64 [ 126.242302][ T150] audit: backlog limit exceeded [ 126.259308][ T36] audit: type=1400 audit(1772290020.485:473901): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 126.282068][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 126.305482][ T331] ------------[ cut here ]------------ [ 126.310972][ T331] WARNING: CPU: 0 PID: 331 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 [ 126.313100][ T150] audit: audit_lost=1950 audit_rate_limit=0 audit_backlog_limit=64 [ 126.320543][ T331] Modules linked in: [ 126.332263][ T331] CPU: 0 UID: 0 PID: 331 Comm: kworker/u8:4 Tainted: G W syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 126.333038][ T36] audit: type=1400 audit(1772290020.485:473902): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 126.345406][ T331] Tainted: [W]=WARN [ 126.370301][ T331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 126.380393][ T331] Workqueue: netns cleanup_net [ 126.385304][ T331] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 126.391040][ T331] Code: 3c 20 00 74 08 48 89 df e8 8f 63 f6 fc 48 8b 3b e8 27 9e e1 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 c3 b7 00 cc e8 52 81 9e fc <0f> 0b e9 b0 fd ff ff e8 46 81 9e fc 0f 0b e9 18 fe ff ff e8 3a 81 [ 126.410739][ T331] RSP: 0018:ffffc9000b8dfb70 EFLAGS: 00010293 [ 126.416863][ T331] RAX: ffffffff84e91e0e RBX: ffff88810beb4700 RCX: ffff888131aca600 [ 126.424870][ T331] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888131aca600 [ 126.432856][ T331] RBP: ffffc9000b8dfb98 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 126.440853][ T331] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: 1ffffffff0fa6870 [ 126.448867][ T331] R13: dffffc0000000000 R14: ffff88810beb5300 R15: dffffc0000000000 [ 126.456866][ T331] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 126.465858][ T331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.472466][ T331] CR2: 00007ffdd96f5e14 CR3: 000000010b38e000 CR4: 00000000003526b0 [ 126.480488][ T331] Call Trace: [ 126.483106][ T36] audit: type=1400 audit(1772290020.505:473903): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 126.483828][ T331] [ 126.507833][ T331] xfrm_net_exit+0x31/0x80 [ 126.512287][ T331] cleanup_net+0x6bd/0xc90 [ 126.516737][ T331] ? __cfi_cleanup_net+0x10/0x10 [ 126.521690][ T331] ? __schedule+0x1357/0x1ea0 [ 126.526417][ T331] ? kick_pool+0xb9/0x550 [ 126.530762][ T331] process_scheduled_works+0x7d4/0x1020 [ 126.536352][ T331] worker_thread+0xc70/0x10b0 [ 126.541053][ T331] ? __cfi_try_to_wake_up+0x10/0x10 [ 126.546312][ T331] kthread+0x2c9/0x370 [ 126.550406][ T331] ? __cfi_worker_thread+0x10/0x10 [ 126.555556][ T331] ? __cfi_kthread+0x10/0x10 [ 126.560160][ T331] ret_from_fork+0x64/0xa0 [ 126.564613][ T331] ? __cfi_kthread+0x10/0x10 [ 126.569213][ T331] ret_from_fork_asm+0x1a/0x30 [ 126.574028][ T331] [ 126.577057][ T331] ---[ end trace 0000000000000000 ]--- [ 126.646552][ T331] bridge_slave_1: left allmulticast mode [ 126.652571][ T331] bridge_slave_1: left promiscuous mode [ 126.658527][ T331] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.667653][ T331] bridge_slave_0: left allmulticast mode [ 126.681546][ T331] bridge_slave_0: left promiscuous mode [ 126.691514][ T331] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.699533][ T331] bridge_slave_0: left allmulticast mode [ 126.705342][ T331] bridge_slave_0: left promiscuous mode [ 126.711072][ T331] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.719269][ T331] bridge_slave_1: left allmulticast mode [ 126.724947][ T331] bridge_slave_1: left promiscuous mode [ 126.730559][ T331] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.984471][ T331] veth1_macvtap: left promiscuous mode [ 126.990002][ T331] veth0_vlan: left promiscuous mode [ 126.996017][ T331] veth1_macvtap: left promiscuous mode [ 127.001577][ T331] veth0_vlan: left promiscuous mode [ 131.152960][ T36] kauditd_printk_skb: 51346 callbacks suppressed [ 131.152977][ T36] audit: type=1400 audit(1772290025.475:524910): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 131.180677][ T36] audit: type=1400 audit(1772290025.485:524911): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 131.193995][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 131.202188][ T36] audit: type=1400 audit(1772290025.485:524912): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 131.208426][ T150] audit: audit_lost=2064 audit_rate_limit=0 audit_backlog_limit=64 [ 131.229702][ T36] audit: type=1400 audit(1772290025.485:524913): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 131.237394][ T150] audit: backlog limit exceeded [ 131.259206][ T36] audit: type=1400 audit(1772290025.485:524914): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0 [ 131.264644][ T150] audit: audit_backlog=65 > audit_backlog_limit=64 [ 131.284963][ T36] audit: type=1400 audit(1772290025.485:524915): avc: denied { read } for pid=150 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=0