last executing test programs: 7.698614675s ago: executing program 0 (id=1): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x38, 0x1403, 0x405, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000f00)='ns/net\x00') sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001200)={0x24, 0x1402, 0x405, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r1}]}, 0x24}}, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000500)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000600)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1234, 0x0, @loopback}, r3}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000700)={0x7, 0x8, 0xfa00, {r3, 0x10}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000800)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000a00)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x1234, 0x0, @loopback}, 0xffffffffffffffff, 0x3e8}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000b00)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000c00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}, 0x120) 7.436641064s ago: executing program 2 (id=3): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0xa) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000001000)=@IORING_OP_ACCEPT={0xd, 0x4, 0x1, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x1}}) io_uring_enter(0xffffffffffffffff, 0xb, 0x0, 0x0, 0x0, 0x0) 7.321008794s ago: executing program 2 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='0\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='processors\n', 0xb) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='mem\n', 0x4) 6.781969014s ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000800)='./dev\x00', &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000a00)=@filename='./dev/nullb1\x00', &(0x7f0000000c00)='./mnt\x00', &(0x7f0000000d00)='zonefs\x00', 0x0, 0x0) 6.73384062s ago: executing program 0 (id=14): syz_usb_connect(0x5, 0x9f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109000201000007250100000000090401020101020000072401010101000b2402010202100180bb0009050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x100], [0x1]], '\x00', [{0x8, 0x8, 0x0, 0x0, 0x1}, {0x10, 0x10, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xbb80, 0xbb80, 0x0, 0x0, 0x1}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}], '\x00', 0xffffffff}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) 4.395679222s ago: executing program 0 (id=24): syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401e041c4000000000000109021b0001010080fa0904000001ffffff00090581010004010000"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000040)={0x1}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080), 0x0, 0x2) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f00000000c0)=0x1) 2.093523355s ago: executing program 0 (id=42): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/lirc0\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0100000002000000", 0x8) 1.338431403s ago: executing program 3 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/net/netfilter\x00', 0x10000, 0x0) getdents64(r0, &(0x7f0000000100), 0x1000) 1.305267862s ago: executing program 4 (id=52): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='5\x00', 0x2) 1.165118804s ago: executing program 3 (id=54): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x3, 0x46d, 0x1234, 0x0, 0x0, "0600ff0901a10185100901150026ff0075089506810009019100851109019513810009019100c0"}}, 0x13f) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00010200"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x14, "11ff020100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000380)={0xc, {0x7, "10ff001102005a"}}, 0xd) write$UHID_INPUT2(r0, &(0x7f00000003c0)={0xc, {0x14, "11ff022100"/20}}, 0x1a) 1.163942265s ago: executing program 4 (id=55): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/cluster/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='127.0.0.1\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='7777\x00', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/local\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='1\x00', 0x1) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='512\x00', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x2, 0x0) write(r5, &(0x7f0000000440)='255\x00', 0x3) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x2, 0x0) write(r6, &(0x7f00000004c0)='1\x00', 0x1) close(r6) mknodat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x61c0, 0x700) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./backing_file\x00', 0x42, 0x1ff) fallocate(r8, 0x0, 0x0, 0x100000) ioctl$LOOP_SET_FD(r7, 0x4c00, r8) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r9, &(0x7f00000005c0)='3\x00', 0x1) (async) close(r9) 1.082152985s ago: executing program 4 (id=56): r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1\x00', 0x2) 1.010356792s ago: executing program 4 (id=57): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x38, 0x1403, 0x405, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000f00)='ns/net\x00') sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001200)={0x24, 0x1402, 0x405, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r1}]}, 0x24}}, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000500)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000600)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1234, 0x0, @loopback}, r3}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000700)={0x7, 0x8, 0xfa00, {r3, 0x10}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000800)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000b00)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000c00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}, 0x120) 861.94222ms ago: executing program 1 (id=60): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='5\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='4\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='4096\x00', 0x5) 711.797774ms ago: executing program 1 (id=61): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./dev\x00', 0x0, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000a00)=@filename='./dev/nullb1\x00', &(0x7f0000000c00)='./mnt\x00', &(0x7f0000000d00)='zonefs\x00', 0x0, 0x0) 651.216681ms ago: executing program 1 (id=62): openat(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x2, 0x0) 569.030062ms ago: executing program 1 (id=63): r0 = syz_io_uring_setup(0x20, 0x0, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000001000)=@IORING_OP_ACCEPT={0xd, 0x4, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x1}}) io_uring_enter(r0, 0xb, 0x0, 0x0, 0x0, 0x0) 568.771286ms ago: executing program 1 (id=64): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='5\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='4\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='4096\x00', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:0\x00', 0x4) write(r4, &(0x7f0000000380)='1:1\x00', 0x4) write(r4, &(0x7f00000003c0)='1:2\x00', 0x4) 318.547707ms ago: executing program 1 (id=65): r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000110)={0x84, &(0x7f0000000210)={0x40, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000310), 0x0, 0x2) 278.061236ms ago: executing program 3 (id=66): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='5\x00', 0x2) 199.130232ms ago: executing program 3 (id=67): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/cluster/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='127.0.0.1\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='7777\x00', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/local\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='1\x00', 0x1) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='512\x00', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x2, 0x0) write(r5, &(0x7f0000000440)='255\x00', 0x3) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x2, 0x0) write(r6, &(0x7f00000004c0)='1\x00', 0x1) close(r6) mknodat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x61c0, 0x700) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./backing_file\x00', 0x42, 0x1ff) fallocate(r8, 0x0, 0x0, 0x100000) ioctl$LOOP_SET_FD(r7, 0x4c00, r8) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r9, &(0x7f00000005c0)='3\x00', 0x1) (async) close(r9) 139.756294ms ago: executing program 4 (id=68): r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1\x00', 0x2) 89.169576ms ago: executing program 3 (id=69): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="2b00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) read(r0, &(0x7f0000000600)=""/256, 0x100) r1 = socket(0x1f, 0x5, 0x9) setsockopt(r1, 0x112, 0x11, &(0x7f0000000100)="00ff000000000000ff0000000500000001000000ff000000050000000100000000000000000000000000000000000000000000000a0000000a000000", 0x3c) connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa) 34.306999ms ago: executing program 4 (id=70): syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a40000000000010902240001010080fa0904000002ff000000090581020002000000090502020002000000"], 0x0) nanosleep(&(0x7f0000000400)={0x2}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000300)="000000000100000000040000000000000100"/28}) 0s ago: executing program 3 (id=71): r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000680)='readonly\x00', 0x9) kernel console output (not intermixed with test programs): [ 46.966452][ T30] audit: type=1400 audit(1785853745.563:111): avc: denied { write } for pid=5458 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.017712][ T30] audit: type=1400 audit(1785853745.613:112): avc: denied { write } for pid=5469 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.100663][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 48.100678][ T30] audit: type=1400 audit(1785853746.693:117): avc: denied { write } for pid=5500 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.146855][ T30] audit: type=1400 audit(1785853746.743:118): avc: denied { write } for pid=5511 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.311056][ T30] audit: type=1400 audit(1785853746.903:119): avc: denied { write } for pid=5514 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.361872][ T30] audit: type=1400 audit(1785853746.953:120): avc: denied { write } for pid=5525 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.523168][ T30] audit: type=1400 audit(1785853747.123:121): avc: denied { write } for pid=5528 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.572269][ T30] audit: type=1400 audit(1785853747.163:122): avc: denied { write } for pid=5539 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.738115][ T30] audit: type=1400 audit(1785853747.333:123): avc: denied { write } for pid=5542 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.784334][ T30] audit: type=1400 audit(1785853747.383:124): avc: denied { write } for pid=5553 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.938086][ T30] audit: type=1400 audit(1785853747.533:125): avc: denied { write } for pid=5556 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.979673][ T30] audit: type=1400 audit(1785853747.573:126): avc: denied { write } for pid=5567 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.188' (ED25519) to the list of known hosts. [ 52.731615][ T5591] cgroup: Unknown subsys name 'net' [ 52.835095][ T5591] cgroup: Unknown subsys name 'cpuset' [ 52.842436][ T5591] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 53.038876][ T5596] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 53.999258][ T5591] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 56.874688][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 56.874703][ T30] audit: type=1400 audit(1785853755.473:142): avc: denied { execmem } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 57.674170][ T30] audit: type=1400 audit(1785853756.263:143): avc: denied { create } for pid=5605 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.699021][ T30] audit: type=1400 audit(1785853756.263:144): avc: denied { read write } for pid=5605 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 57.722846][ T30] audit: type=1400 audit(1785853756.273:145): avc: denied { open } for pid=5605 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 57.752409][ T30] audit: type=1400 audit(1785853756.293:146): avc: denied { ioctl } for pid=5605 comm="syz-executor" path="socket:[5232]" dev="sockfs" ino=5232 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.800110][ T5621] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 57.800728][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 57.815386][ T5622] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 57.815440][ T5621] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 57.823388][ T5622] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 57.832256][ T5621] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 57.837582][ T5622] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 57.844548][ T5621] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 57.851301][ T5622] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 57.858795][ T5621] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 57.865382][ T5622] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 57.873107][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 57.884522][ T5623] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 57.886822][ T5621] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 57.893564][ T5622] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 57.901770][ T5621] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 57.914368][ T5623] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 57.920534][ T5624] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 57.921638][ T5622] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 57.928948][ T5624] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.936037][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 57.943182][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 57.949845][ T5622] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 57.956482][ T5624] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.975504][ T30] audit: type=1400 audit(1785853756.563:147): avc: denied { read } for pid=5608 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 57.975894][ T5623] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 58.012488][ T30] audit: type=1400 audit(1785853756.573:148): avc: denied { open } for pid=5605 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 58.036605][ T30] audit: type=1400 audit(1785853756.603:149): avc: denied { open } for pid=5608 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 58.060161][ T30] audit: type=1400 audit(1785853756.603:150): avc: denied { mounton } for pid=5605 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 58.082064][ T30] audit: type=1400 audit(1785853756.603:151): avc: denied { module_request } for pid=5605 comm="syz-executor" kmod="netdev-nr4" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 59.232259][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.239395][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.246546][ T5613] bridge_slave_0: entered allmulticast mode [ 59.253281][ T5613] bridge_slave_0: entered promiscuous mode [ 59.286360][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.293622][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.301145][ T5613] bridge_slave_1: entered allmulticast mode [ 59.308072][ T5613] bridge_slave_1: entered promiscuous mode [ 59.321544][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.330984][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.338177][ T5609] bridge_slave_0: entered allmulticast mode [ 59.346007][ T5609] bridge_slave_0: entered promiscuous mode [ 59.372619][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.379743][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.386946][ T5609] bridge_slave_1: entered allmulticast mode [ 59.393651][ T5609] bridge_slave_1: entered promiscuous mode [ 59.438110][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.454290][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.461415][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.468534][ T5608] bridge_slave_0: entered allmulticast mode [ 59.475211][ T5608] bridge_slave_0: entered promiscuous mode [ 59.491960][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.501113][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.508435][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.515881][ T5605] bridge_slave_0: entered allmulticast mode [ 59.522481][ T5605] bridge_slave_0: entered promiscuous mode [ 59.529813][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.537225][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.544408][ T5608] bridge_slave_1: entered allmulticast mode [ 59.550978][ T5608] bridge_slave_1: entered promiscuous mode [ 59.559112][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.584714][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.591804][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.599337][ T5605] bridge_slave_1: entered allmulticast mode [ 59.606073][ T5605] bridge_slave_1: entered promiscuous mode [ 59.619896][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.633643][ T5613] team0: Port device team_slave_0 added [ 59.665559][ T5613] team0: Port device team_slave_1 added [ 59.678997][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.708733][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.719441][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.736183][ T5609] team0: Port device team_slave_0 added [ 59.741883][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.749007][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.756250][ T5606] bridge_slave_0: entered allmulticast mode [ 59.763026][ T5606] bridge_slave_0: entered promiscuous mode [ 59.777148][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.793435][ T5609] team0: Port device team_slave_1 added [ 59.799141][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.806257][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.813542][ T5606] bridge_slave_1: entered allmulticast mode [ 59.820158][ T5606] bridge_slave_1: entered promiscuous mode [ 59.827363][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.834514][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.860398][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.878986][ T5608] team0: Port device team_slave_0 added [ 59.896930][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.903913][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.929811][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.947788][ T5608] team0: Port device team_slave_1 added [ 59.971918][ T5605] team0: Port device team_slave_0 added [ 59.984461][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.991454][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.017593][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.030129][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.046117][ T5605] team0: Port device team_slave_1 added [ 60.053734][ T5617] Bluetooth: hci0: command tx timeout [ 60.059463][ T5619] Bluetooth: hci3: command tx timeout [ 60.059483][ T5622] Bluetooth: hci2: command tx timeout [ 60.064990][ T4925] Bluetooth: hci4: command tx timeout [ 60.072643][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.078648][ T5623] Bluetooth: hci1: command tx timeout [ 60.083493][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.114650][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.127159][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.151371][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.158386][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.184550][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.218584][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.225716][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.251727][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.271620][ T5606] team0: Port device team_slave_0 added [ 60.277748][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.284968][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.310936][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.330719][ T5613] hsr_slave_0: entered promiscuous mode [ 60.336761][ T5613] hsr_slave_1: entered promiscuous mode [ 60.344425][ T5606] team0: Port device team_slave_1 added [ 60.350421][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.357491][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.383598][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.438809][ T5608] hsr_slave_0: entered promiscuous mode [ 60.444816][ T5608] hsr_slave_1: entered promiscuous mode [ 60.450620][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 60.456446][ T5608] Cannot create hsr debugfs directory [ 60.464834][ T5609] hsr_slave_0: entered promiscuous mode [ 60.470879][ T5609] hsr_slave_1: entered promiscuous mode [ 60.477122][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 60.483228][ T5609] Cannot create hsr debugfs directory [ 60.490008][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.496984][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.522862][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.557674][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.564680][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.590584][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.622336][ T5605] hsr_slave_0: entered promiscuous mode [ 60.628538][ T5605] hsr_slave_1: entered promiscuous mode [ 60.634575][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 60.640285][ T5605] Cannot create hsr debugfs directory [ 60.741072][ T5606] hsr_slave_0: entered promiscuous mode [ 60.747367][ T5606] hsr_slave_1: entered promiscuous mode [ 60.753638][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 60.759350][ T5606] Cannot create hsr debugfs directory [ 61.005420][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 61.015812][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.023791][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 61.032069][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.040124][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 61.048988][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.056866][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 61.065208][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.124268][ T5608] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 61.135138][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.144955][ T5608] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 61.153826][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.161389][ T5608] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 61.170312][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.180315][ T5608] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 61.188495][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.262011][ T5605] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 61.271345][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.279051][ T5605] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 61.287909][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.296280][ T5605] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 61.304921][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.317142][ T5605] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 61.326236][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.371971][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.401896][ T5609] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 61.411064][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.419386][ T5609] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 61.428463][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.436711][ T5609] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 61.445061][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.452525][ T5609] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 61.461552][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.499044][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.528561][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.535859][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.562474][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.569534][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.593934][ T5606] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.602197][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.620789][ T5606] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.629080][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.641901][ T5606] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.650819][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.658774][ T5606] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 61.667340][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.680278][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.738706][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.777378][ T142] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.784506][ T142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.800114][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.807223][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.820599][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.875451][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.902136][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.915390][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.922466][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.934343][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.941392][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.965457][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.986701][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.997597][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.004708][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.026885][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.034002][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.095517][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.132813][ T5623] Bluetooth: hci1: command tx timeout [ 62.138436][ T5617] Bluetooth: hci0: command tx timeout [ 62.145735][ T5609] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 62.146805][ T5619] Bluetooth: hci3: command tx timeout [ 62.157471][ T5609] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 62.161714][ T4925] Bluetooth: hci4: command tx timeout [ 62.172497][ T5622] Bluetooth: hci2: command tx timeout [ 62.191181][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.198283][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.257340][ T142] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.264510][ T142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.331240][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.453674][ T5613] veth0_vlan: entered promiscuous mode [ 62.488300][ T5613] veth1_vlan: entered promiscuous mode [ 62.577997][ T5613] veth0_macvtap: entered promiscuous mode [ 62.601913][ T5613] veth1_macvtap: entered promiscuous mode [ 62.646987][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.681380][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.911452][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.914119][ T5778] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.930232][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.940091][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.974031][ T48] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.001325][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.067444][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.086921][ T5778] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.103833][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.117305][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.137431][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 63.137444][ T30] audit: type=1400 audit(1785853761.733:153): avc: denied { mounton } for pid=5613 comm="syz-executor" path="/root/syzkaller.F1g6VY/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 63.165516][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.218044][ T30] audit: type=1400 audit(1785853761.733:154): avc: denied { mount } for pid=5613 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 63.258713][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.271341][ T5613] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 63.288211][ T30] audit: type=1400 audit(1785853761.773:155): avc: denied { mounton } for pid=5613 comm="syz-executor" path="/root/syzkaller.F1g6VY/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 63.301413][ T5608] veth0_vlan: entered promiscuous mode [ 63.319535][ T30] audit: type=1400 audit(1785853761.773:156): avc: denied { mount } for pid=5613 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 63.333653][ T5606] veth0_vlan: entered promiscuous mode [ 63.345708][ T30] audit: type=1400 audit(1785853761.773:157): avc: denied { mounton } for pid=5613 comm="syz-executor" path="/root/syzkaller.F1g6VY/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 63.376007][ T5608] veth1_vlan: entered promiscuous mode [ 63.386429][ T5606] veth1_vlan: entered promiscuous mode [ 63.393146][ T30] audit: type=1400 audit(1785853761.773:158): avc: denied { mounton } for pid=5613 comm="syz-executor" path="/root/syzkaller.F1g6VY/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 63.409526][ T5609] veth0_vlan: entered promiscuous mode [ 63.424907][ T30] audit: type=1400 audit(1785853761.773:159): avc: denied { unmount } for pid=5613 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 63.452251][ T5609] veth1_vlan: entered promiscuous mode [ 63.500880][ T5606] veth0_macvtap: entered promiscuous mode [ 63.532460][ T5608] veth0_macvtap: entered promiscuous mode [ 63.537708][ T30] audit: type=1400 audit(1785853761.803:160): avc: denied { mounton } for pid=5613 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 63.575773][ T5606] veth1_macvtap: entered promiscuous mode [ 63.590567][ T30] audit: type=1400 audit(1785853761.803:161): avc: denied { mount } for pid=5613 comm="syz-executor" name="/" dev="gadgetfs" ino=7619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 63.619161][ T5608] veth1_macvtap: entered promiscuous mode [ 63.645840][ T30] audit: type=1400 audit(1785853761.803:162): avc: denied { mount } for pid=5613 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 63.651487][ T5609] veth0_macvtap: entered promiscuous mode [ 63.689244][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.721692][ T5609] veth1_macvtap: entered promiscuous mode [ 63.730464][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.754632][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.782255][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.803972][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.818230][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.834337][ T57] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.860421][ T57] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.874676][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.888465][ T5605] veth0_vlan: entered promiscuous mode [ 63.913245][ T57] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.931552][ T5605] veth1_vlan: entered promiscuous mode [ 63.953731][ T568] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.976291][ T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.999105][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.008483][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.065763][ T568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.075280][ T568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.078376][ T5605] veth0_macvtap: entered promiscuous mode [ 64.102830][ T57] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.112802][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.123425][ T5605] veth1_macvtap: entered promiscuous mode [ 64.150791][ T568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.158912][ T568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.167300][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.179913][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.213608][ T5622] Bluetooth: hci3: command tx timeout [ 64.219239][ T5622] Bluetooth: hci0: command tx timeout [ 64.224898][ T5622] Bluetooth: hci1: command tx timeout [ 64.230301][ T4925] Bluetooth: hci2: command tx timeout [ 64.270132][ T568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.281543][ T568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.313764][ T48] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.334427][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.343620][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.379458][ T568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.389446][ T568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.403926][ T48] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.421161][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.434400][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.440323][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.474928][ T568] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.525134][ T57] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.537171][ T568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.563642][ T568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.602643][ T5817] PM: suspend entry (deep) [ 64.644616][ T48] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.679483][ T48] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.698502][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.830512][ T5823] null_blk: nullb1: using native zone append [ 64.882469][ T5819] loop0: detected capacity change from 0 to 2048 [ 64.890641][ T5823] null_blk: disk nullb1 created [ 65.005968][ T568] Filesystems sync: 0.384 seconds [ 65.071306][ T5832] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 65.232997][ T5712] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 65.349690][ T5832] md: personality for level 5 is not loaded! [ 65.395392][ T5712] usb 5-1: config 1 interface 2 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 65.395412][ T5817] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 65.415644][ T5817] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 65.418947][ T5712] usb 5-1: config 1 interface 2 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 65.435126][ T5808] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 65.443908][ T5712] usb 5-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 65.453336][ T5712] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.456924][ T5817] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 65.473222][ T5817] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 65.479538][ T5817] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 65.493593][ T5817] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 65.514157][ T5817] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 65.520310][ T5817] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 65.529747][ T5817] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 65.589016][ T5817] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 65.599997][ T5808] usb 1-1: config index 0 descriptor too short (expected 143, got 141) [ 65.606629][ T5817] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 65.625876][ T5808] usb 1-1: config 1 has an invalid descriptor of length 7, skipping remainder of the config [ 65.653810][ T187] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 65.660603][ T5808] usb 1-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 65.679420][ T5817] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 65.680519][ T5808] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.724814][ T5808] usb 1-1: Product: syz [ 65.729952][ T5808] usb 1-1: Manufacturer: syz [ 65.730776][ T5817] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 65.737930][ T5808] usb 1-1: SerialNumber: syz [ 65.741815][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.753226][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.790344][ T5817] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 65.803357][ T5817] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 65.843899][ T187] usb 2-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 65.853549][ T187] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.202885][ T5833] NFSD: Unable to initialize client recovery tracking! (-110) [ 66.210607][ T5833] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 66.220668][ T5833] NFSD: starting 90-second grace period (net f00003df) [ 66.334491][ T187] lg-g15 0003:046D:C222.0001: hidraw0: USB HID v1.11 Device [HID 046d:c222] on usb-dummy_hcd.1-1/input0 [ 66.715831][ T805] usb 5-1: USB disconnect, device number 2 [ 66.962358][ T5808] usb 1-1: 1:2 : no or invalid class specific endpoint descriptor [ 67.031913][ T5808] usb 1-1: USB disconnect, device number 2 [ 67.093225][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 67.142720][ T5719] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 67.294053][ T5719] usb 4-1: not running at top speed; connect to a high speed hub [ 67.305656][ T5719] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 1.00 [ 67.317860][ T5719] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.319237][ T5866] loop0: detected capacity change from 0 to 2048 [ 67.328944][ T5719] usb 4-1: Product: syz [ 67.339873][ T5719] usb 4-1: Manufacturer: syz [ 67.352860][ T5719] usb 4-1: SerialNumber: syz [ 67.493092][ T4925] Bluetooth: hci1: command 0x0c1a tx timeout [ 67.573087][ T4925] Bluetooth: hci2: command 0x0c1a tx timeout [ 67.653549][ T4925] Bluetooth: hci3: command 0x0c1a tx timeout [ 67.764434][ T5726] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 67.813156][ T4925] Bluetooth: hci4: command 0x0c1a tx timeout [ 67.923733][ T5726] usb 1-1: not running at top speed; connect to a high speed hub [ 67.933170][ T5726] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 1023 [ 67.944289][ T5726] usb 1-1: New USB device found, idVendor=041e, idProduct=401c, bcdDevice= 0.00 [ 67.953338][ T5726] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.968944][ T5726] gspca_main: gspca_zc3xx-2.14.0 probing 041e:401c [ 68.219481][ T30] kauditd_printk_skb: 120 callbacks suppressed [ 68.219496][ T30] audit: type=1400 audit(1785853766.813:283): avc: denied { read write } for pid=5873 comm="syz.0.24" name="video0" dev="devtmpfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.250067][ T30] audit: type=1400 audit(1785853766.813:284): avc: denied { open } for pid=5873 comm="syz.0.24" path="/dev/video0" dev="devtmpfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.273268][ T30] audit: type=1400 audit(1785853766.813:285): avc: denied { ioctl } for pid=5873 comm="syz.0.24" path="/dev/video0" dev="devtmpfs" ino=931 ioctlcmd=0x5612 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.366664][ T5884] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.483951][ T5726] gspca_zc3xx: reg_w_i err -110 [ 68.530627][ T30] audit: type=1400 audit(1785853767.123:286): avc: denied { map } for pid=5887 comm="syz.4.28" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8758 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 68.558978][ T30] audit: type=1400 audit(1785853767.123:287): avc: denied { read write } for pid=5887 comm="syz.4.28" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8758 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 68.592304][ T5890] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.609701][ T5719] usb 4-1: 1:1: cannot set freq 48000 to ep 0x81 [ 68.640024][ T5719] usb 4-1: USB disconnect, device number 2 [ 68.733428][ T5890] md: could not open device unknown-block(1,0). [ 68.752840][ T5890] md: could not open device unknown-block(1,1). [ 68.792830][ T5890] md: could not open device unknown-block(1,2). [ 68.832867][ T5890] md: could not open device unknown-block(1,3). [ 68.884073][ T5892] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.014191][ T5892] md: could not open device unknown-block(1,0). [ 69.058961][ T5894] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.142625][ T30] audit: type=1800 audit(1785853767.733:288): pid=5896 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.32" name="ipv4_address" dev="configfs" ino=8779 res=0 errno=0 [ 69.167963][ T30] audit: type=1800 audit(1785853767.743:289): pid=5896 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.32" name="ipv4_port" dev="configfs" ino=8780 res=0 errno=0 [ 69.169210][ T5896] loop0: detected capacity change from 0 to 2048 [ 69.194652][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 69.210345][ T5897] md: could not open device unknown-block(1,0). [ 69.217691][ T30] audit: type=1800 audit(1785853767.743:290): pid=5896 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.32" name="local" dev="configfs" ino=8781 res=0 errno=0 [ 69.239360][ T30] audit: type=1800 audit(1785853767.753:291): pid=5896 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.32" name="block_bytes" dev="configfs" ino=8782 res=0 errno=0 [ 69.261890][ T30] audit: type=1800 audit(1785853767.753:292): pid=5896 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.32" name="blocks" dev="configfs" ino=8783 res=0 errno=0 [ 69.262123][ T5726] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 69.293344][ T5894] md: could not open device unknown-block(1,1). [ 69.301480][ T5726] gspca_zc3xx 1-1:1.0: probe with driver gspca_zc3xx failed with error -110 [ 69.333480][ T5897] md: could not open device unknown-block(1,2). [ 69.349093][ T5726] usb 1-1: USB disconnect, device number 3 [ 69.388444][ T5901] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.575199][ T4925] Bluetooth: hci1: command 0x0c1a tx timeout [ 69.625874][ T5911] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.639997][ T187] lg-g15 0003:046D:C222.0001: Error -71 disabling keyboard emulation for the G-keys, falling back to generic hid-input driver [ 69.662096][ T187] usb 2-1: USB disconnect, device number 2 [ 69.663005][ T4925] Bluetooth: hci2: command 0x0c1a tx timeout [ 69.734488][ T4925] Bluetooth: hci3: command 0x0c1a tx timeout [ 69.784243][ T5915] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.807181][ T5917] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.893699][ T4925] Bluetooth: hci4: command 0x0c1a tx timeout [ 70.005434][ T5917] md: could not open device unknown-block(1,0). [ 70.011859][ T5921] md: could not open device unknown-block(1,0). [ 70.064389][ T5915] md: could not open device unknown-block(1,1). [ 70.067891][ T5924] loop0: detected capacity change from 0 to 2048 [ 70.082887][ T805] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 70.091289][ T5922] md: could not open device unknown-block(1,2). [ 70.125120][ T5921] md: could not open device unknown-block(1,3). [ 70.217299][ T5931] Buffer I/O error on dev nullb1, logical block 0, lost async page write [ 70.247796][ T5927] NFSD: Failed to start, no listeners configured. [ 70.261430][ T805] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 70.283034][ T805] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 70.303719][ T805] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 70.317568][ T805] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 70.331058][ T5933] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.341264][ T805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.354163][ T805] usb 1-1: Product: syz [ 70.360450][ T805] usb 1-1: Manufacturer: syz [ 70.365221][ T805] usb 1-1: SerialNumber: syz [ 70.376719][ T5919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.394034][ T5919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.401282][ T5919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.409850][ T5937] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.473054][ T5933] md: could not open device unknown-block(1,0). [ 70.481182][ T5938] md: could not open device unknown-block(1,1). [ 70.539046][ T5933] md: could not open device unknown-block(1,2). [ 70.652144][ T5946] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.683359][ T5950] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.749802][ T5808] hid-generic 0003:046D:1234.0002: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 70.824365][ T5950] md: could not open device unknown-block(1,0). [ 70.931275][ T5966] Buffer I/O error on dev nullb1, logical block 0, lost async page write [ 70.982505][ T5969] null_blk: my_nullb: using native zone append [ 71.006233][ T5969] null_blk: disk my_nullb created [ 71.057197][ T5977] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 71.262987][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 71.347796][ T5988] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 71.473703][ T5988] md: could not open device unknown-block(1,0). [ 71.512817][ T5988] md: could not open device unknown-block(1,1). [ 71.553554][ T5988] md: could not open device unknown-block(1,2). [ 71.630414][ T805] redrat3 1-1:1.0: Problem fetching firmware ID [ 71.652849][ T4925] Bluetooth: hci1: command 0x0c1a tx timeout [ 71.655313][ T5992] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 71.672257][ T805] redrat3 1-1:1.0: Failed to read timeout from hardware [ 71.735313][ T4925] Bluetooth: hci2: command 0x0c1a tx timeout [ 71.741449][ T805] rc_core: IR keymap rc-hauppauge not found [ 71.748488][ T805] Registered IR keymap rc-empty [ 71.760786][ T805] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 71.779796][ T805] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input6 [ 71.798241][ T805] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 71.812734][ T4925] Bluetooth: hci3: command 0x0c1a tx timeout [ 71.822047][ T805] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 71.840389][ T4925] Bluetooth: hci4: unexpected event for opcode 0x041b [ 71.854357][ T5726] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 71.858288][ T805] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 71.882291][ T805] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 71.913020][ T805] usb 1-1: USB disconnect, device number 4 [ 71.928408][ T4975] ================================================================== [ 71.936472][ T4975] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 71.943405][ T4975] Read of size 1 at addr ffff8880371c7758 by task udevd/4975 [ 71.950763][ T4975] [ 71.953080][ T4975] CPU: 1 UID: 0 PID: 4975 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 71.953101][ T4975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 71.953111][ T4975] Call Trace: [ 71.953117][ T4975] [ 71.953123][ T4975] dump_stack_lvl+0x100/0x190 [ 71.953148][ T4975] print_report+0x13d/0x4b0 [ 71.953172][ T4975] ? __virt_addr_valid+0x239/0x430 [ 71.953201][ T4975] ? string+0x471/0x4d0 [ 71.953217][ T4975] kasan_report+0xdf/0x1c0 [ 71.953241][ T4975] ? string+0x471/0x4d0 [ 71.953260][ T4975] string+0x471/0x4d0 [ 71.953278][ T4975] ? __pfx_string+0x10/0x10 [ 71.953298][ T4975] vsnprintf+0x422/0x1300 [ 71.953320][ T4975] ? __pfx_vsnprintf+0x10/0x10 [ 71.953339][ T4975] ? ksys_read+0x12a/0x250 [ 71.953365][ T4975] ? do_syscall_64+0x115/0x870 [ 71.953385][ T4975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.953406][ T4975] add_uevent_var+0x183/0x3a0 [ 71.953424][ T4975] ? __pfx_add_uevent_var+0x10/0x10 [ 71.953443][ T4975] ? rc_dev_uevent+0x12d/0x1c0 [ 71.953471][ T4975] ? __pfx_rc_dev_uevent+0x10/0x10 [ 71.953497][ T4975] rc_dev_uevent+0x17d/0x1c0 [ 71.953523][ T4975] dev_uevent+0x2f1/0x870 [ 71.953550][ T4975] ? __pfx_dev_uevent+0x10/0x10 [ 71.953574][ T4975] ? kasan_save_track+0x14/0x30 [ 71.953593][ T4975] ? __kasan_kmalloc+0xaa/0xb0 [ 71.953613][ T4975] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 71.953642][ T4975] ? uevent_show+0x166/0x3a0 [ 71.953662][ T4975] ? __pfx_uevent_show+0x10/0x10 [ 71.953681][ T4975] uevent_show+0x1ca/0x3a0 [ 71.953699][ T4975] ? __pfx_uevent_show+0x10/0x10 [ 71.953718][ T4975] dev_attr_show+0x52/0xa0 [ 71.953742][ T4975] ? __pfx_dev_attr_show+0x10/0x10 [ 71.953766][ T4975] sysfs_kf_seq_show+0x217/0x3f0 [ 71.953794][ T4975] seq_read_iter+0x32f/0x1270 [ 71.953811][ T4975] ? cp_new_stat+0x484/0x5c0 [ 71.953833][ T4975] kernfs_fop_read_iter+0x46c/0x610 [ 71.953857][ T4975] ? rw_verify_area+0xce/0x6d0 [ 71.953880][ T4975] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 71.953904][ T4975] vfs_read+0x82e/0xb40 [ 71.953930][ T4975] ? __pfx_vfs_read+0x10/0x10 [ 71.953956][ T4975] ? __pfx___do_sys_newfstat+0x10/0x10 [ 71.953982][ T4975] ksys_read+0x12a/0x250 [ 71.954007][ T4975] ? __pfx_ksys_read+0x10/0x10 [ 71.954036][ T4975] do_syscall_64+0x115/0x870 [ 71.954056][ T4975] ? clear_bhb_loop+0x40/0x90 [ 71.954075][ T4975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.954093][ T4975] RIP: 0033:0x7f43b62a7407 [ 71.954107][ T4975] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 71.954123][ T4975] RSP: 002b:00007ffd379fe2d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 71.954139][ T4975] RAX: ffffffffffffffda RBX: 00007f43b69e5880 RCX: 00007f43b62a7407 [ 71.954151][ T4975] RDX: 0000000000001000 RSI: 0000560031902c30 RDI: 000000000000000c [ 71.954161][ T4975] RBP: 00007f43b63efff0 R08: 0000000000000000 R09: 0000000000000000 [ 71.954172][ T4975] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 71.954182][ T4975] R13: 00007f43b63efea0 R14: 0000000000000000 R15: 00005600318955c0 [ 71.954203][ T4975] [ 71.954209][ T4975] [ 72.260770][ T4975] Allocated by task 805: [ 72.264986][ T4975] kasan_save_stack+0x30/0x50 [ 72.269645][ T4975] kasan_save_track+0x14/0x30 [ 72.274298][ T4975] __kasan_kmalloc+0xaa/0xb0 [ 72.278865][ T4975] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 72.284219][ T4975] redrat3_dev_probe+0x326/0x2b50 [ 72.289228][ T4975] usb_probe_interface+0x303/0x8f0 [ 72.294320][ T4975] really_probe+0x241/0xa60 [ 72.298801][ T4975] __driver_probe_device+0x20e/0x450 [ 72.304067][ T4975] driver_probe_device+0x4a/0x140 [ 72.309070][ T4975] __device_attach_driver+0x1df/0x320 [ 72.314420][ T4975] bus_for_each_drv+0x159/0x1e0 [ 72.319248][ T4975] __device_attach+0x1e4/0x4d0 [ 72.323989][ T4975] device_initial_probe+0xaf/0xd0 [ 72.328994][ T4975] bus_probe_device+0x64/0x160 [ 72.333740][ T4975] device_add+0x121d/0x1970 [ 72.338227][ T4975] usb_set_configuration+0xd97/0x1c60 [ 72.343583][ T4975] usb_generic_driver_probe+0xa1/0xe0 [ 72.348932][ T4975] usb_probe_device+0xef/0x400 [ 72.353675][ T4975] really_probe+0x241/0xa60 [ 72.358170][ T4975] __driver_probe_device+0x20e/0x450 [ 72.363433][ T4975] driver_probe_device+0x4a/0x140 [ 72.368435][ T4975] __device_attach_driver+0x1df/0x320 [ 72.373784][ T4975] bus_for_each_drv+0x159/0x1e0 [ 72.378612][ T4975] __device_attach+0x1e4/0x4d0 [ 72.383355][ T4975] device_initial_probe+0xaf/0xd0 [ 72.388359][ T4975] bus_probe_device+0x64/0x160 [ 72.393121][ T4975] device_add+0x121d/0x1970 [ 72.397618][ T4975] usb_new_device.cold+0x685/0x115c [ 72.402795][ T4975] hub_event+0x30a3/0x4a60 [ 72.407202][ T4975] process_one_work+0xa23/0x1940 [ 72.412128][ T4975] worker_thread+0x5ef/0xe50 [ 72.416695][ T4975] kthread+0x370/0x450 [ 72.420742][ T4975] ret_from_fork+0x72b/0xd50 [ 72.425314][ T4975] ret_from_fork_asm+0x1a/0x30 [ 72.430061][ T4975] [ 72.432363][ T4975] Freed by task 805: [ 72.436231][ T4975] kasan_save_stack+0x30/0x50 [ 72.440980][ T4975] kasan_save_track+0x14/0x30 [ 72.445638][ T4975] kasan_save_free_info+0x3b/0x70 [ 72.450649][ T4975] __kasan_slab_free+0x5f/0x80 [ 72.455399][ T4975] kfree+0x22b/0x6c0 [ 72.459286][ T4975] redrat3_dev_probe+0x107a/0x2b50 [ 72.464385][ T4975] usb_probe_interface+0x303/0x8f0 [ 72.469481][ T4975] really_probe+0x241/0xa60 [ 72.473962][ T4975] __driver_probe_device+0x20e/0x450 [ 72.479237][ T4975] driver_probe_device+0x4a/0x140 [ 72.484251][ T4975] __device_attach_driver+0x1df/0x320 [ 72.489610][ T4975] bus_for_each_drv+0x159/0x1e0 [ 72.494439][ T4975] __device_attach+0x1e4/0x4d0 [ 72.499186][ T4975] device_initial_probe+0xaf/0xd0 [ 72.504192][ T4975] bus_probe_device+0x64/0x160 [ 72.508934][ T4975] device_add+0x121d/0x1970 [ 72.513422][ T4975] usb_set_configuration+0xd97/0x1c60 [ 72.518781][ T4975] usb_generic_driver_probe+0xa1/0xe0 [ 72.524140][ T4975] usb_probe_device+0xef/0x400 [ 72.528888][ T4975] really_probe+0x241/0xa60 [ 72.533371][ T4975] __driver_probe_device+0x20e/0x450 [ 72.538643][ T4975] driver_probe_device+0x4a/0x140 [ 72.543652][ T4975] __device_attach_driver+0x1df/0x320 [ 72.549003][ T4975] bus_for_each_drv+0x159/0x1e0 [ 72.553829][ T4975] __device_attach+0x1e4/0x4d0 [ 72.558572][ T4975] device_initial_probe+0xaf/0xd0 [ 72.563577][ T4975] bus_probe_device+0x64/0x160 [ 72.568319][ T4975] device_add+0x121d/0x1970 [ 72.572807][ T4975] usb_new_device.cold+0x685/0x115c [ 72.577986][ T4975] hub_event+0x30a3/0x4a60 [ 72.582384][ T4975] process_one_work+0xa23/0x1940 [ 72.587302][ T4975] worker_thread+0x5ef/0xe50 [ 72.591873][ T4975] kthread+0x370/0x450 [ 72.595920][ T4975] ret_from_fork+0x72b/0xd50 [ 72.600498][ T4975] ret_from_fork_asm+0x1a/0x30 [ 72.605691][ T4975] [ 72.607992][ T4975] The buggy address belongs to the object at ffff8880371c7000 [ 72.607992][ T4975] which belongs to the cache kmalloc-2k of size 2048 [ 72.622019][ T4975] The buggy address is located 1880 bytes inside of [ 72.622019][ T4975] freed 2048-byte region [ffff8880371c7000, ffff8880371c7800) [ 72.635978][ T4975] [ 72.638286][ T4975] The buggy address belongs to the physical page: [ 72.644670][ T4975] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880371c6000 pfn:0x371c0 [ 72.654709][ T4975] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.663186][ T4975] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 72.671662][ T4975] page_type: f5(slab) [ 72.675622][ T4975] raw: 00fff00000000240 ffff88813fe28000 ffffea0000d71210 ffffea0001e76410 [ 72.684182][ T4975] raw: ffff8880371c6000 0000000800080007 00000000f5000000 0000000000000000 [ 72.692749][ T4975] head: 00fff00000000240 ffff88813fe28000 ffffea0000d71210 ffffea0001e76410 [ 72.701394][ T4975] head: ffff8880371c6000 0000000800080007 00000000f5000000 0000000000000000 [ 72.710042][ T4975] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 72.718687][ T4975] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 72.727328][ T4975] page dumped because: kasan: bad access detected [ 72.733712][ T4975] page_owner tracks the page as allocated [ 72.739399][ T4975] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5608, tgid 5608 (syz-executor), ts 59011777954, free_ts 59004410004 [ 72.760124][ T4975] post_alloc_hook+0xfd/0x120 [ 72.764789][ T4975] get_page_from_freelist+0xf48/0x3530 [ 72.770223][ T4975] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 72.776109][ T4975] new_slab+0xa2/0x640 [ 72.780152][ T4975] refill_objects+0xe3/0x410 [ 72.784717][ T4975] __pcs_replace_empty_main+0x376/0x680 [ 72.790249][ T4975] __kmalloc_cache_noprof+0x479/0x6c0 [ 72.795606][ T4975] batadv_hard_if_event+0x14bf/0x3870 [ 72.800956][ T4975] notifier_call_chain+0x99/0x3f0 [ 72.805957][ T4975] call_netdevice_notifiers_info+0xbe/0x110 [ 72.811834][ T4975] register_netdevice+0x1998/0x25a0 [ 72.817014][ T4975] bond_newlink+0x6a/0x100 [ 72.821407][ T4975] rtnl_newlink+0x1499/0x2380 [ 72.826064][ T4975] rtnetlink_rcv_msg+0x95e/0xe90 [ 72.830982][ T4975] netlink_rcv_skb+0x159/0x420 [ 72.835721][ T4975] netlink_unicast+0x585/0x850 [ 72.840473][ T4975] page last free pid 2 tgid 2 stack trace: [ 72.846249][ T4975] __free_frozen_pages+0x79f/0x1090 [ 72.851429][ T4975] qlist_free_all+0x47/0xf0 [ 72.855907][ T4975] kasan_quarantine_reduce+0x1a0/0x1f0 [ 72.861345][ T4975] __kasan_slab_alloc+0x69/0x90 [ 72.866173][ T4975] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 72.871610][ T4975] alloc_pid+0x1bd/0x1910 [ 72.875916][ T4975] copy_process+0x5485/0x8030 [ 72.880578][ T4975] kernel_clone+0x176/0x9d0 [ 72.885066][ T4975] kernel_thread+0xdb/0x120 [ 72.889551][ T4975] kthreadd+0x498/0x7a0 [ 72.893682][ T4975] ret_from_fork+0x72b/0xd50 [ 72.898254][ T4975] ret_from_fork_asm+0x1a/0x30 [ 72.903011][ T4975] [ 72.905312][ T4975] Memory state around the buggy address: [ 72.910914][ T4975] ffff8880371c7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.918948][ T4975] ffff8880371c7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.926983][ T4975] >ffff8880371c7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.935021][ T4975] ^ [ 72.941943][ T4975] ffff8880371c7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.949978][ T4975] ffff8880371c7800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.958010][ T4975] ================================================================== [ 72.979400][ T4975] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.986604][ T4975] CPU: 1 UID: 0 PID: 4975 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 72.995437][ T4975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 73.005490][ T4975] Call Trace: [ 73.008746][ T4975] [ 73.011656][ T4975] dump_stack_lvl+0x100/0x190 [ 73.016317][ T4975] vpanic+0x552/0x970 [ 73.020290][ T4975] ? __pfx_vpanic+0x10/0x10 [ 73.024771][ T4975] ? mark_held_locks+0x40/0x70 [ 73.029515][ T4975] ? string+0x471/0x4d0 [ 73.033657][ T4975] panic+0xd1/0xe0 [ 73.037357][ T4975] ? __pfx_panic+0x10/0x10 [ 73.041754][ T4975] ? string+0x471/0x4d0 [ 73.045889][ T4975] ? preempt_schedule_common+0x42/0xc0 [ 73.051330][ T4975] ? check_panic_on_warn+0x1f/0x90 [ 73.056420][ T4975] check_panic_on_warn.cold+0x19/0x34 [ 73.061774][ T4975] end_report.part.0+0x3a/0x90 [ 73.066527][ T4975] kasan_report.cold+0xe/0x18 [ 73.071187][ T4975] ? string+0x471/0x4d0 [ 73.075322][ T4975] string+0x471/0x4d0 [ 73.079282][ T4975] ? __pfx_string+0x10/0x10 [ 73.083764][ T4975] vsnprintf+0x422/0x1300 [ 73.088075][ T4975] ? __pfx_vsnprintf+0x10/0x10 [ 73.092816][ T4975] ? ksys_read+0x12a/0x250 [ 73.097215][ T4975] ? do_syscall_64+0x115/0x870 [ 73.101957][ T4975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.108002][ T4975] add_uevent_var+0x183/0x3a0 [ 73.112656][ T4975] ? __pfx_add_uevent_var+0x10/0x10 [ 73.117836][ T4975] ? rc_dev_uevent+0x12d/0x1c0 [ 73.122585][ T4975] ? __pfx_rc_dev_uevent+0x10/0x10 [ 73.127678][ T4975] rc_dev_uevent+0x17d/0x1c0 [ 73.132252][ T4975] dev_uevent+0x2f1/0x870 [ 73.136566][ T4975] ? __pfx_dev_uevent+0x10/0x10 [ 73.141399][ T4975] ? kasan_save_track+0x14/0x30 [ 73.146228][ T4975] ? __kasan_kmalloc+0xaa/0xb0 [ 73.150986][ T4975] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 73.156518][ T4975] ? uevent_show+0x166/0x3a0 [ 73.161094][ T4975] ? __pfx_uevent_show+0x10/0x10 [ 73.166009][ T4975] uevent_show+0x1ca/0x3a0 [ 73.170406][ T4975] ? __pfx_uevent_show+0x10/0x10 [ 73.175320][ T4975] dev_attr_show+0x52/0xa0 [ 73.179722][ T4975] ? __pfx_dev_attr_show+0x10/0x10 [ 73.184815][ T4975] sysfs_kf_seq_show+0x217/0x3f0 [ 73.189740][ T4975] seq_read_iter+0x32f/0x1270 [ 73.194393][ T4975] ? cp_new_stat+0x484/0x5c0 [ 73.198964][ T4975] kernfs_fop_read_iter+0x46c/0x610 [ 73.204148][ T4975] ? rw_verify_area+0xce/0x6d0 [ 73.208894][ T4975] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 73.214594][ T4975] vfs_read+0x82e/0xb40 [ 73.218736][ T4975] ? __pfx_vfs_read+0x10/0x10 [ 73.223397][ T4975] ? __pfx___do_sys_newfstat+0x10/0x10 [ 73.228844][ T4975] ksys_read+0x12a/0x250 [ 73.233074][ T4975] ? __pfx_ksys_read+0x10/0x10 [ 73.237826][ T4975] do_syscall_64+0x115/0x870 [ 73.242396][ T4975] ? clear_bhb_loop+0x40/0x90 [ 73.247050][ T4975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.252922][ T4975] RIP: 0033:0x7f43b62a7407 [ 73.257322][ T4975] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 73.276907][ T4975] RSP: 002b:00007ffd379fe2d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 73.285300][ T4975] RAX: ffffffffffffffda RBX: 00007f43b69e5880 RCX: 00007f43b62a7407 [ 73.293248][ T4975] RDX: 0000000000001000 RSI: 0000560031902c30 RDI: 000000000000000c [ 73.301207][ T4975] RBP: 00007f43b63efff0 R08: 0000000000000000 R09: 0000000000000000 [ 73.309171][ T4975] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 73.317132][ T4975] R13: 00007f43b63efea0 R14: 0000000000000000 R15: 00005600318955c0 [ 73.325092][ T4975] [ 73.328285][ T4975] Kernel Offset: disabled [ 73.332581][ T4975] Rebooting in 86400 seconds..