last executing test programs: 20.838660335s ago: executing program 1 (id=486): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000c40), 0x12) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="e90c610faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x7, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0xfd, 0x100, @val=0x80}}}}}}}, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000080), 0x4) sendmmsg$inet(r4, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r5) r6 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x128, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xff}, @NFCTH_STATUS={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x5}}, @NFCTH_TUPLE={0x18, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @remote}}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x8}}, @NFCTH_TUPLE={0xc8, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @rand_addr=' \x01\x00'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000004}, 0x4080004) socket$inet_smc(0x2b, 0x1, 0x0) 19.024294889s ago: executing program 1 (id=493): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x288}) r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185647, &(0x7f0000000100)={0xf000000, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x8000000, '\x00', @string=&(0x7f0000000340)=0xfe}}) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000140)={0x1, 0xa, 0x3, "2e85f85a3b9156e89e82960ad936188f4429f4bf777d1b56926c75b050d4c3f0", 0x39555659}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) add_key$user(&(0x7f0000000280), &(0x7f00000003c0)={'syz', 0x1}, &(0x7f00000000c0)="ff", 0x1, 0x0) keyctl$clear(0x7, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010000d0425bd7000fcdbff2500000022", @ANYRES32=r1, @ANYBLOB="10000000000000001c0012800b00010062726964676500000c0002800800030019000000"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r5, 0x5421, &(0x7f0000000000)=0x5) connect$bt_rfcomm(r5, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xb}, 0xa) close(r5) 14.656878894s ago: executing program 1 (id=511): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="016f0002010000000000200000004500002800000000008490783fffffffac1414aa00000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="7b548b838202ab90b8807d763b065fd3544de5a70806dc16c91ebe4d43b7172e6cc7773f4c21338adbdeab264ce62b5c71f62b29a8c7bc459429efd3db110f9dd23d856360867acd03ea6d637368"], 0x36) r2 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029b0003010000000904000000010100000a2401000000020102092408000000004c58062404000052072405000053f10b24050000133b9bda531c092405000596efc259090401000001020000090401010101020000090501090000000000072501000000006a00020000010200000904020101010200000b2402017f0200018b7e8e0724010000000009058209100000000007250103000000"], 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r2, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00000e03103900000000"], 0x0, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7f, 0x10, 0x3, 0x1, "256e3f84", "8d5572e9"}}, 0x0}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000780)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r4 = accept$alg(r3, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000600), 0xfec8) recvmmsg(r4, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0xc8}, {&(0x7f0000000140)=""/9, 0x9}], 0x2, 0x0, 0x0, 0x2000000}}], 0x1, 0xcb, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r6 = inotify_init() inotify_add_watch(r6, &(0x7f00000001c0)='./file0\x00', 0x4a9) removexattr(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=@known='system.posix_acl_default\x00') socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f00000000c0)=0x1) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r9}, 0x10) 10.016662175s ago: executing program 0 (id=524): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="180200000200000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000600000085000000060000009500000000000000d85ef6b49071343bef33b9f6bd1094603c62ef87280b3a5d09b20196e96cc7d1b46ae981fe0ef3077a99e957bd58daa375b4ea2346584b4387ab683194786a0d0764da321ad1c432cc920ce48184655498b9c8ec2d2238b50c8a6b080c0ced489e72a3b64873ac12dc0334b07c0ea5d9d2f343e9203565123b343142251ad3f77f788e4521191c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84242, 0x0) r2 = syz_open_procfs(0x0, 0x0) preadv(r2, 0x0, 0x0, 0x0, 0x104) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000001ac0)={r1, 0x4000, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200"}}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x8, 0x3, 0x268, 0x0, 0xffffffff, 0xffffffff, 0x118, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x40}, [], [0x0, 0xffffff00], '\x00', 'wg1\x00', {}, {0xff}, 0x6, 0x0, 0x0, 0x6171da8923978deb}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x4c00}}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @local, [0xffffffff, 0xff000000], [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 'veth1_to_team\x00', 'pimreg\x00', {}, {0xff}, 0x5c, 0x4, 0x5, 0xd3}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2c8) 9.94064485s ago: executing program 1 (id=525): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="180200000200000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000600000085000000060000009500000000000000d85ef6b49071343bef33b9f6bd1094603c62ef87280b3a5d09b20196e96cc7d1b46ae981fe0ef3077a99e957bd58daa375b4ea2346584b4387ab683194786a0d0764da321ad1c432cc920ce48184655498b9c8ec2d2238b50c8a6b080c0ced489e72a3b64873ac12dc0334b07c0ea5d9d2f343e9203565123b343142251ad3f77f788e4521191c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84242, 0x0) r2 = syz_open_procfs(0x0, 0x0) preadv(r2, 0x0, 0x0, 0x0, 0x104) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000001ac0)={r1, 0x4000, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200"}}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x8, 0x3, 0x268, 0x0, 0xffffffff, 0xffffffff, 0x118, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x40}, [], [0x0, 0xffffff00], '\x00', 'wg1\x00', {}, {0xff}, 0x6, 0x0, 0x0, 0x6171da8923978deb}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x4c00}}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @local, [0xffffffff, 0xff000000], [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 'veth1_to_team\x00', 'pimreg\x00', {}, {0xff}, 0x5c, 0x4, 0x5, 0xd3}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2c8) 8.460635905s ago: executing program 2 (id=533): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$key(0xf, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x4) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="24000000240081064e81f782db44b9040a02080006", 0x15}], 0x1}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0xfe33) r3 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) write$uinput_user_dev(r3, &(0x7f0000000780)={'syz1\x00', {0x2, 0xc3fd, 0x5, 0x101}, 0x43, [0x4, 0x7, 0x0, 0x8e, 0xf, 0x7, 0xc08, 0x7fffffff, 0xa, 0x7, 0x3, 0xc, 0x7fff, 0x1, 0x7fffffff, 0x1, 0x2, 0x6, 0x200, 0x8, 0xd63, 0x2, 0x8, 0xb2, 0x1, 0x10, 0x7f, 0x6, 0x7, 0x3, 0x9e, 0x4, 0x7fff, 0x3, 0xa, 0x7, 0x7, 0x7, 0xfff, 0x5, 0x2, 0x4, 0xe, 0x4, 0x2, 0x10000, 0x6, 0xfffffff8, 0x5a, 0x3, 0x7fff, 0x1, 0xe, 0x7, 0x8001, 0x3, 0x0, 0x6, 0x10001, 0xc95, 0x383, 0x2e2, 0x7e20, 0x9], [0x8, 0x4, 0x1, 0x21, 0x6, 0x3, 0x6, 0x9, 0x100, 0x4, 0x6, 0x4, 0xf, 0x400, 0x8, 0x9, 0x4, 0x6, 0x7fffffff, 0x0, 0x7, 0x4, 0x5, 0x99, 0x0, 0x1, 0x3, 0x4e, 0x7fff, 0x7, 0x0, 0x6, 0x8, 0x0, 0x0, 0x3, 0x57f3d914, 0x3ff, 0x3, 0x80000001, 0x7, 0x1000, 0x1000, 0x1000, 0xffffffff, 0x9, 0x6bf71a42, 0x7, 0x2, 0x5, 0x4, 0xf7, 0x0, 0xfffffffa, 0x0, 0x9, 0x2, 0x8, 0xfff, 0xfffffff9, 0x70b, 0x800, 0x946, 0xf], [0xe55, 0x8, 0x3, 0x5, 0xb22a, 0x7, 0x4f1b, 0x6, 0x2, 0x100, 0x5, 0x2329, 0x4, 0xe5f9, 0x4, 0x2, 0x0, 0x7, 0x3ff, 0x7f, 0x7, 0xb, 0x8001, 0x92, 0x8, 0x9, 0x7, 0x8001, 0xffffffff, 0x1, 0xd52, 0x5, 0x81, 0x5, 0x606, 0x6, 0x2, 0x5ef, 0x7b57, 0x800, 0x2, 0x9, 0x6, 0x8, 0x8, 0x0, 0x7, 0xff, 0x6, 0xfff, 0xed, 0x5, 0x8d, 0x786, 0x4, 0x5, 0x1, 0xfffffffa, 0x100, 0x7, 0xfffffffd, 0x4, 0xfffffff7, 0x1ff], [0x67b12284, 0x16c, 0x9, 0x4, 0x0, 0x80, 0x7ff, 0x4, 0xff, 0xfff, 0x0, 0x7, 0x9, 0x0, 0xf46a, 0x8, 0x101, 0xfffff54b, 0x200, 0xde6, 0x6, 0x401, 0x5, 0x4, 0x64, 0x8001, 0x969b, 0x78b3ee01, 0x8c1, 0x2, 0xfffffffc, 0x5, 0x40, 0x59, 0x3ff, 0x6, 0x8, 0x1, 0x5, 0x1, 0x2, 0x5, 0x2, 0x3, 0x1, 0x6, 0x0, 0x6, 0x408, 0x1, 0x4, 0xe2f, 0xd222, 0x5, 0xffff, 0x7f, 0x2, 0x6, 0x80000000, 0x81, 0x6, 0x6, 0x6fccd243, 0x401]}, 0x45c) syz_usb_connect$cdc_ecm(0x2, 0x0, 0x0, 0x0) 8.376588148s ago: executing program 4 (id=534): r0 = syz_open_dev$amidi(&(0x7f0000000100), 0x3, 0x40000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, r0, 0x44000) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) timer_create(0x1, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) prctl$PR_SET_VMA(0x23, 0x0, &(0x7f000098b000/0x2000)=nil, 0x2000, 0x0) syz_usb_connect(0x0, 0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000092e1300833280102d52a0000000109022200010000000009040000000e010000082403"], 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_CLIENT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="997617f2ff28000000", @ANYRES16=r2, @ANYBLOB="20002cbd7000f9ffffff5400000008000300", @ANYRES32=r3, @ANYBLOB="0c0099000600000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x4040800) 7.850060864s ago: executing program 0 (id=535): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x2803f, 0x0, 0x0, 0x0, 0x0, 0x0) 7.840463934s ago: executing program 1 (id=536): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1ff, 0x20000) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000540)={{0x1, 0x3, 0x6, 0x448, '\x00', 0x9}, 0x1, [0x7, 0xd5, 0x5, 0x9, 0x6, 0xa, 0x2, 0x5, 0xfffffffffffffffb, 0xbd, 0x80000000, 0x102d, 0x8, 0x1, 0x3, 0xffffffffffffffff, 0x1, 0x1ed40, 0x6, 0x1ff, 0x80, 0x7, 0x7, 0x7, 0xc, 0x2, 0x9, 0x7, 0xffffffffffffffff, 0x3, 0x8fffffffe, 0x403, 0x1, 0x4, 0x1, 0x3, 0x3, 0x1, 0x0, 0x6, 0x9, 0x4, 0x8a, 0x50f, 0x9ac2, 0x6fe5, 0xffffffffba36ba58, 0x6, 0xa, 0x9, 0x6, 0xe000000000000000, 0xfffffffffffffffd, 0x403, 0x3, 0xfffffffffffff8f6, 0x4, 0xfffffffffffffff9, 0x0, 0xf9800000, 0x8, 0x9, 0x1800000, 0x4, 0x82b, 0x8, 0x5, 0x0, 0x4, 0xfffffffffffffffa, 0x5, 0x100000000000006, 0xca4f, 0x2f, 0x1, 0x7, 0x40, 0x2, 0x42843379, 0x1, 0x6, 0x201, 0x77d, 0xb3, 0x5, 0x539, 0x623b, 0x6, 0x0, 0x7, 0x4, 0x7fffffffffffffff, 0x7, 0x8, 0x0, 0x9, 0x93, 0x5, 0x401, 0x2, 0x2775e12f, 0x680000000000, 0x5, 0x40007, 0xe88, 0x80000004, 0x0, 0xfffffffffffffffa, 0x10001, 0x5, 0x8, 0x1000, 0x0, 0x5, 0x7, 0xfffffffffffff000, 0x8, 0x7ffd, 0xfffffffffffffff7, 0x6, 0x100000001, 0x8, 0x80000000005, 0x4, 0x20000000004, 0xc3, 0x7f, 0x3]}) openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xa, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYRES32=r3], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r4, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r4, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000740)={0x20, 0x3, 0x2, "b23b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r4, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x82, 0x2, 'j\x00'}, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000040)={0x14, 0x0, 0x0}, &(0x7f0000000600)={0x44, &(0x7f00000002c0)={0x0, 0x6, 0x2, "9d4c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x300060c1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r5], 0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x20, 0x14, 0x509, 0x0, 0x0, {0x2, 0x1, 0x0, 0xff, r8}, [@IFA_LOCAL={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x20}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r9, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) r11 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r11, 0x8916, &(0x7f0000000000)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) 7.593669248s ago: executing program 0 (id=537): sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000170a018859f822340177a0942cdc01000000000000000000000006ebe5d09fd9a7731ec389ac24f755126bfd514e572052dfc126613030b622d5a68e6c0f278deb71cbfd640f633ff71653eea9726e0fbe9269c138b1299a6e1a01bc8d3165bc71c0a07d26946c5e1c2cdc5f7731533856d6c56afe93f584302342b0d80c386c1b1b1bd371"], 0x14}, 0x1, 0x0, 0x0, 0x20000005}, 0x4000000) syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x230200) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="ee61d15b176da8ea8abe33a2ac1a58bde11db6411b4864916c5ac483163a894aaee52e9e377fc5bab5055d789da66a7a70863f889aad1335f04ee4450038b9778f4d5ec530dd982feea0da048265c0ac677634f7f8a03936495e01ad2391429afd94e82dd69e1e130ee96890732fd2607f206484a26cd5fb3c25cedbf3e614e91913ecc6cb885d6634e642a4663fb173c97df34d038205965db55ba937f12ef8ec0905e1cd0aae11db41a3046e273aeecf2fe24cbdb77f0b7aaf43983b50874a6dd6bf1a1b37c155a4d520a4f14573abd041057b027c698396e651d92fa6"], &(0x7f0000000380)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x0, 0x31, 0xffffffffffffffff, 0xbe55d000) syz_open_dev$usbfs(0x0, 0x76, 0x101b01) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x400000001, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfffffffe, @empty}, r6}}, 0x48) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {&(0x7f0000000780), r6, 0x2}}, 0x18) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x101001, 0x0) syz_open_dev$cec(&(0x7f0000000200), 0x0, 0x100) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c8000006800e97800000400000000000a0003002000001004000400"], 0x1c}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a03000000000000000000070000000900010073797a300000000050000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021140011800c000100636f756e74657200040002806c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000400003803c000080080003400000000230000b802c0001800a0001006c696d69740000001c0002800c00024000000000000000000c0001400000000000000009140000001000010000000000000084000a000000"], 0x104}, 0x1, 0x0, 0x0, 0x4040054}, 0x0) 7.455561426s ago: executing program 2 (id=538): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1ff, 0x20000) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000540)={{0x1, 0x3, 0x6, 0x448, '\x00', 0x9}, 0x1, [0x7, 0xd5, 0x5, 0x9, 0x6, 0xa, 0x2, 0x5, 0xfffffffffffffffb, 0xbd, 0x80000000, 0x102d, 0x8, 0x1, 0x3, 0xffffffffffffffff, 0x1, 0x1ed40, 0x6, 0x1ff, 0x80, 0x7, 0x7, 0x7, 0xc, 0x2, 0x9, 0x7, 0xffffffffffffffff, 0x3, 0x8fffffffe, 0x403, 0x1, 0x4, 0x1, 0x3, 0x3, 0x1, 0x0, 0x6, 0x9, 0x4, 0x8a, 0x50f, 0x9ac2, 0x6fe5, 0xffffffffba36ba58, 0x6, 0xa, 0x9, 0x6, 0xe000000000000000, 0xfffffffffffffffd, 0x403, 0x3, 0xfffffffffffff8f6, 0x4, 0xfffffffffffffff9, 0x0, 0xf9800000, 0x8, 0x9, 0x1800000, 0x4, 0x82b, 0x8, 0x5, 0x0, 0x4, 0xfffffffffffffffa, 0x5, 0x100000000000006, 0xca4f, 0x2f, 0x1, 0x7, 0x40, 0x2, 0x42843379, 0x1, 0x6, 0x201, 0x77d, 0xb3, 0x5, 0x539, 0x623b, 0x6, 0x0, 0x7, 0x4, 0x7fffffffffffffff, 0x7, 0x8, 0x0, 0x9, 0x93, 0x5, 0x401, 0x2, 0x2775e12f, 0x680000000000, 0x5, 0x40007, 0xe88, 0x80000004, 0x0, 0xfffffffffffffffa, 0x10001, 0x5, 0x8, 0x1000, 0x0, 0x5, 0x7, 0xfffffffffffff000, 0x8, 0x7ffd, 0xfffffffffffffff7, 0x6, 0x100000001, 0x8, 0x80000000005, 0x4, 0x20000000004, 0xc3, 0x7f, 0x3]}) openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xa, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYRES32=r3], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r4, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r4, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000740)={0x20, 0x3, 0x2, "b23b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r4, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x82, 0x2, 'j\x00'}, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000040)={0x14, 0x0, 0x0}, &(0x7f0000000600)={0x44, &(0x7f00000002c0)={0x0, 0x6, 0x2, "9d4c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x300060c1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r5], 0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x20, 0x14, 0x509, 0x0, 0x0, {0x2, 0x1, 0x0, 0xff, r8}, [@IFA_LOCAL={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x20}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r9, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) r12 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r12, 0x8916, &(0x7f0000000000)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) 6.629223391s ago: executing program 0 (id=540): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a00)={0x28, r2, 0x1, 0x70bd2a, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x7}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x200040c0}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001600)=@deltfilter={0x43c, 0x2d, 0x1, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xf}, {0xd, 0xffe0}, {0xffe0, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x40c, 0x2, [@TCA_ROUTE4_POLICE={0x408, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xfff, 0x0, 0x0, 0xc4e6, 0xfffffc01, 0x459, 0x6, 0x4, 0xc, 0x3, 0x1, 0xde8, 0x4, 0x6, 0x7, 0x2, 0x7, 0x3, 0x2, 0x5, 0x339c04a7, 0x1, 0x9, 0x0, 0x5, 0x4, 0x1, 0x6, 0x5, 0x5, 0x9, 0x9, 0x2, 0x0, 0x80000001, 0x9, 0x84b250eb, 0x2, 0x5, 0x1, 0x4, 0x2f5, 0x10, 0x5, 0x7a4e, 0x5, 0xb9, 0xffffffff, 0x8, 0x8000, 0x8, 0x8, 0xff, 0xff, 0x4, 0x40, 0x7, 0x17, 0x80, 0x3, 0x4, 0x5, 0x7b34, 0x2ce, 0xb8, 0x3ff, 0xb46, 0x4, 0x8, 0x1, 0x2fce, 0x0, 0x5, 0x3, 0x4, 0x8, 0x5, 0x1, 0x0, 0xf, 0x2c8, 0x2, 0xffffffc0, 0x5ed96db, 0x400, 0x7, 0x6, 0x400, 0x1, 0x6, 0x8, 0x5, 0x2, 0x200, 0x1ff, 0x8163, 0x4306ded, 0x1de7, 0x831, 0x5, 0xffffffff, 0x7, 0x5, 0x10000, 0xfffffffc, 0x6d1, 0xf, 0x1, 0x1, 0x401, 0x8000, 0x80, 0xe, 0x6, 0x6, 0x4, 0x7, 0x7fffffff, 0xd5f3, 0x0, 0x14, 0xc23, 0xd, 0x1, 0x3, 0x1, 0x9, 0x8, 0xf, 0x800, 0x1, 0xffff, 0x9, 0xfffffff7, 0x4, 0x6, 0xc3, 0x5, 0x3, 0x2, 0x10000, 0xfff, 0x8, 0x32f4, 0x9, 0x2, 0x4, 0x0, 0xa, 0x5, 0x0, 0x3, 0x8, 0x79a9, 0x8, 0x7, 0x6, 0x3, 0x1, 0x3e91, 0x6, 0x5, 0x6, 0xfffffff9, 0x0, 0x7, 0x5, 0x360c4ca1, 0x5, 0x40f, 0x8, 0x7ff, 0x7, 0x2, 0x1, 0xff, 0x96, 0x1, 0x2, 0xc95af3b, 0x6813, 0x4, 0x9, 0x3f, 0x5, 0x8, 0x7, 0x8, 0x1a74, 0x10000, 0x101, 0x8, 0x2, 0x13, 0x6, 0xff, 0x1, 0x0, 0x4, 0x9, 0xa, 0x7, 0x9, 0xffffff00, 0x9, 0x7, 0x1, 0x0, 0x1, 0x0, 0xfffffff8, 0x1000, 0x100000, 0x80000000, 0xffffffff, 0x80000001, 0x3ed, 0x2, 0xfffffffd, 0x6, 0x0, 0x0, 0xb, 0x5, 0x9, 0xd, 0x8, 0x4, 0x0, 0x1000, 0x4, 0x8, 0x5, 0x2, 0x4, 0x1, 0x0, 0xdcc, 0x7, 0x5, 0x5, 0x2, 0x10, 0x2, 0x217, 0x3ff, 0x200000, 0xd, 0xa990, 0x1, 0x9, 0x4, 0x2932, 0x5dd, 0x1ff, 0xe3]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x20000814}, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000000023b) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map, 0xffffffffffffffff, 0x1e, 0x0, 0x0, @void, @value=r5}, 0x20) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x1) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) setresuid(0xee00, 0xee00, 0x0) rename(&(0x7f0000000c00)='./file1\x00', &(0x7f0000000040)='./bus\x00') creat(0x0, 0xe5) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000008}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 6.560638527s ago: executing program 4 (id=541): r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000003c0), 0x20840, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80064d12, &(0x7f0000000000)) iopl(0x3) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x3) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x200, 0x40) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000f00), r3) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r3) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r1, &(0x7f00000002c0)="0d040000fc464aab16d9ce000037314d78296114e0b71db5d12051740442cf7f3e15807188a201b945000000ff00000000000038ac83db26fd16e0b8cd20ebccc57a087c4ba7e4484f91ee2f7c439c007eaaf09e90c7fe96e32a669532a4164315a842e7102e26", 0x67) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x7], &(0x7f0000000500)=[0x2], 0x0, 0x2000000000000088}}, 0x40) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f000001f480), 0x2, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r6, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) ioctl$FUSE_DEV_IOC_CLONE(r5, 0x8004e500, &(0x7f0000000040)=r5) 5.945285105s ago: executing program 0 (id=543): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x395e000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = syz_io_uring_setup(0x204, &(0x7f0000000480)={0x0, 0x507e, 0x0, 0x0, 0x2ce}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) r5 = dup(r1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0x0, 0x4, r5, 0x0, 0x0, 0x0, 0x80800, 0x1}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 5.63233616s ago: executing program 4 (id=545): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f00000001c0)={0x400, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x57f, &(0x7f0000000000)={0x0, 0x807734, 0x80, 0x0, 0xfe}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r6 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r5, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)="7c220752098d1a03003fb4d50b17b9653538f559e8ca1a63dfa1a8f54135abe90913a7bb3930c14e8d1808268429578d92871b8681b42a7a264d4c578a7c26845616d98fc09729e3d8c0aa68e95af732c067f9dd1d9fdd4ee2008561e5a690de23248e60f4ab6390f520377d0a68cc822a17c773be19ee5b51b2428acd21725b17f5fadc10e18e574983e260010d619f74dd4c30b5", 0x95}], 0x1, &(0x7f0000000480)=ANY=[], 0x170}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000340)="d29f", 0x2}], 0x1}}], 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0xe}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x44}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) recvmsg$kcm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) 3.960708331s ago: executing program 2 (id=547): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xb, 0x7, 0x8, 0x8, 0x5}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000060018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000007d00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x4f) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000001c0)='kfree\x00', r2}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000e80)={{r1, 0xffffffffffffffff}, &(0x7f0000000500)=0x18, &(0x7f0000000940)='%pK \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000440)={{r3}, &(0x7f0000000380), &(0x7f0000000400)='%pI4 \x00'}, 0x20) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r4, 0x1, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8814}, 0x0) 3.93819124s ago: executing program 4 (id=549): getpid() r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x5c, r2, 0x1, 0x470bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa}, @key_params=[@NL80211_ATTR_KEY={0x18, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x1}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "1416d2f0c9"}]}], @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x5c}}, 0x20000880) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000001a00), 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, 0x0, 0x0, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r7, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000740)='wlan0\x00', 0x10) connect$inet(r7, &(0x7f0000000140)={0x2, 0xc000, @multicast1}, 0x10) setsockopt$inet_opts(r7, 0x0, 0x4, 0x0, 0x0) setsockopt$inet_opts(r7, 0x0, 0x1, &(0x7f0000000300)="18", 0x1) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000000c0), 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000400)={{0x40, 0x3}, 0x0, 0x4, 0x88, {}, 0x0, 0xffff}) 3.764997381s ago: executing program 1 (id=550): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) io_uring_enter(0xffffffffffffffff, 0x6d36, 0xd93b, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x300, 0x7b, 0x7a, 0x38, 0x40, 0x4a5, 0x300c, 0xa8c9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa6, 0x6, 0x40, 0x30, [{{0x9, 0x4, 0x33, 0x5, 0x0, 0xf1, 0xa3, 0x23, 0xf}}]}}]}}, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0}) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000440)=@in6={0xa, 0x4622, 0xfffffffd, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x80, 0x0}, 0x240ce040) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x14, 0x2d, 0x101, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) 3.100616501s ago: executing program 2 (id=551): r0 = socket$inet(0x2, 0x80000, 0xfffffffd) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='dctcp\x00', 0x6) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x1c8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$video4linux(&(0x7f0000006a40), 0x4, 0x41) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x4020565b, &(0x7f0000006a80)={0x6, 0x2}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="850000006100000054000000000000009500000000000000b4a8b1541206000000e9c79077fa15ba36eca61299de54cf77c9062430bc0688"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) socket$inet6(0xa, 0x200000000003, 0x87) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c2000001aaaaaaaaaa1586dd6003136c00188700fc0200000000000000000000000000fdff020000000000000000000000000001"], 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) r5 = fsopen(&(0x7f0000000140)='tracefs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) 1.971309842s ago: executing program 3 (id=553): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdir(0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private0, 0xfffffffd, 0x0, 0x1, 0x8, 0xffff, 0x7}, 0xfcf3) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xd41, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = io_uring_setup(0x4355b, &(0x7f0000000140)={0x0, 0xe24b, 0x10, 0x5, 0x4000020}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r4, r3, 0x0, 0x0, 0x0, 0x0, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) 1.967522224s ago: executing program 2 (id=554): fsopen(&(0x7f0000000080)='ext3\x00', 0x0) (fail_nth: 1) 1.872650613s ago: executing program 0 (id=555): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) io_uring_enter(0xffffffffffffffff, 0x6d36, 0xd93b, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x300, 0x7b, 0x7a, 0x38, 0x40, 0x4a5, 0x300c, 0xa8c9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa6, 0x6, 0x40, 0x30, [{{0x9, 0x4, 0x33, 0x5, 0x0, 0xf1, 0xa3, 0x23, 0xf}}]}}]}}, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0}) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000440)=@in6={0xa, 0x4622, 0xfffffffd, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x80, 0x0}, 0x240ce040) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x14, 0x2d, 0x101, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) 1.80793363s ago: executing program 4 (id=556): socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$vim2m(0x0, 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x59455247, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x2}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000940)='net/snmp\x00') readv(r2, 0x0, 0x0) fchdir(0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00001b8000/0x4000)=nil, 0x4000, 0x2b2d6d8275066cc, 0x4000010, 0xffffffffffffffff, 0x9e1d6000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, 0x0, 0x2018081, 0x0) listen(0xffffffffffffffff, 0x4000) close(0xffffffffffffffff) 1.777291262s ago: executing program 3 (id=557): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r2, &(0x7f0000000000)={0x1d, r3}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x7b, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff8100000486dd681747a80041060100000000000000000000ffffac14140cfc02000000000000000000000000000189000a31650000001d00cd3fca1f7ec6b010c8a20a70680000000000000000000000000000000000000300004e2100004e24000000040000000300000004000000"], 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000840)=""/121, 0x0, &(0x7f0000000540), 0x6c}, 0x38) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x41) getsockopt$IP_SET_OP_GET_BYNAME(r7, 0x1, 0x53, &(0x7f0000000280)={0x6, 0x7, 'syz0\x00'}, &(0x7f00000008c0)=0x28) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x3d, [0x6, 0xc95a, 0xfffffff3, 0x8, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x7, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x3, 0xe661, 0x4, 0x1000007, 0x3, 0x8001, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x20007, 0x103, 0x0, 0x5, 0x3d, 0x8f, 0x6, 0x1, 0x4, 0x5, 0x4, 0x5, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x10002, 0x12b, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0x3, 0xf9, 0xd, 0x2bf, 0x6c9, 0x1ff, 0xfffffffe, 0x3, 0x0, 0x7, 0x10000005, 0x2f, 0xe, 0x313, 0x78, 0xea4, 0xa, 0x4, 0x4, 0x80, 0x5, 0x400, 0x1, 0x6, 0x400001, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0xffffffff, 0x6, 0x1000004, 0x9, 0x4, 0x9, 0x8, 0x9, 0x7, 0x5, 0x0, 0x3, 0x8000, 0xffff, 0x2, 0x7f, 0x9, 0x8, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x1, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x40002, 0xf, 0x8, 0x84, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x3, 0x4, 0x54fe12da, 0xbf, 0x5, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x80000005, 0x0, 0x6, 0xfffffffb, 0x120000, 0x3, 0x6, 0x9, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xfffffffc, 0x5, 0x938, 0x6, 0x6, 0x51bf, 0x5, 0xce7, 0x200, 0x6, 0x7, 0x5, 0x3, 0x104, 0x80000000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x8000014c, 0x60a7, 0x6, 0x2, 0xffffffff, 0x80000003, 0x5, 0x8, 0xff, 0x3, 0x3, 0xffff, 0x3, 0x8, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c0b, 0x0, 0x2, 0x5, 0xb1c, 0x1, 0x1ff, 0xfff, 0xfff]}, 0x45c) renameat2(r7, &(0x7f0000000200)='./file0\x00', r4, &(0x7f0000000940)='./file0\x00', 0x5) syz_open_dev$dmmidi(&(0x7f0000000900), 0x7, 0x208102) r8 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r8, &(0x7f0000000040)="e2", 0x918) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, {0x7, 0x6}, {0xffff}, {0x1}}}, 0x24}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c080001"], 0x122}}, 0x0) 1.712630015s ago: executing program 2 (id=558): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x9}, 0x1c) listen(r0, 0x3) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0xec, 0x62, 0xf9, 0x40, 0xf3d, 0x68aa, 0xb4ca, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb, 0x0, 0x3, 0xf, 0x1f, 0xe7, 0x0, [], [{{0x9, 0x5, 0x5, 0x2, 0x8, 0x0, 0x3, 0x1}}, {{0x9, 0x5, 0xe, 0x0, 0x3ff, 0x2, 0x86, 0x3}}, {{0x9, 0x5, 0x87, 0x2, 0x400, 0xb, 0x7f, 0x14}}]}}]}}]}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_io_uring_setup(0x890, &(0x7f0000000140)={0x0, 0x9557, 0x4000, 0x8201, 0xbfdffffc}, 0x0, 0x0) io_uring_enter(r2, 0x2412, 0x0, 0x36, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000400)={'ipvlan1\x00', &(0x7f0000000300)=@ethtool_drvinfo={0x3, "cfae1e8610332aaf073c8d7e23e24149747696f72937d0eaa72f3f6db551129c", "88525cd14f8eed12a8efcbb486d5f94e1f7192a907767ee928726d8541593048", "94ed2609f31e59a9041429955c25747ddc5a9aa68b65f79d739539ff50fe6bbc", "e6ece6330b875a499a782bbd0bde05326e338adc8f3a60c5212b04fb64fff642", "a4e30583baf6fdc385302137f3f6b686903632a36dd691e2f0de22424c816b2b", "69dcedab10ae79d6206beff9", 0x7fffffff, 0x0, 0x4, 0x1, 0x1000}}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x200140, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$binfmt_register(r6, &(0x7f0000000100)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x7, 0x3a, '*.-*', 0x3a, '', 0x3a, './file0'}, 0x2b) open$dir(&(0x7f0000000200)='./file0\x00', 0x5e9140, 0x8a) setsockopt$inet_tcp_int(r5, 0x6, 0x19, 0x0, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r5, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee3c0cb001829a8681ed391da1", 0x12}], 0x1}}], 0x1, 0x20008000) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000300)={0x24, &(0x7f0000000100)={0x40, 0x22, 0x99, {0x99, 0x11, "e6908fbc8efcea2d0ab1861feb701e5c8f425f38ec4d3188da50d1bffdcd38ecdbb55e0666eb6765424ae7b7a2c49bd23e06fb25b5e5802fab87b219ff28a0a7fe8c58e872a7ea612ded682b6911dadb151ae87a2dda844537f4a7d83c2fb1567526ccf09b336739317ba6bfa33a2f0ab8d46c9eb4c700ea254f29767bcefb5de50b4f926fb1f60262716fbb8cd04bf846d1ea5164a85a"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x412}}, &(0x7f0000000200), &(0x7f00000002c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x3, 0x6, 0x1, {0x22, 0x41a}}}}, &(0x7f0000000580)={0x2c, &(0x7f0000000340)={0x20, 0x9, 0x4f, "0e65a059e45606447749b92f5d1f1762e2c8a19dc52838223899bd6c025d75bf6048f4aaea5f757b022ba149ae95bb3c60394d7524cda3eef0272bfb4880abed8ec4086510bb270f063706492561f1"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xfb}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000440)={0x20, 0x1, 0xde, "35fc65a6e9beb397fae697cdcd51860c04ab475b38ab434915e8766fad6cdd64a5f4a144a37ee12218901c6adebadf0fe34aa0e7eadb7c434ec659509556a4dfb503cd6e991dea9b835b9424711aa458485deefcf8bd834d6108dae013798a07aa47dfcaa2bbe15ad347c1cad36ffefc682f23c72fe7049b9353b663536a09a3d98cf8fb10f630f3deb59ab7db1f353a35f2006170cecb0f72195637ef74ed1e74f2e8fe8101d72c0215b287e2f6a621b32f3129f6213b660941d9764a5e7d21213b11a9a458ace1e63abaa6421746690092d01e4638b935a0037d1fd04a"}, &(0x7f0000000540)={0x20, 0x3, 0x1, 0xb}}) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "2a8435", 0x14, 0x6, 0xff, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x5, 0xc2}}}}}}}, 0x0) 1.476099992s ago: executing program 3 (id=559): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x12100}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_BACKUP_PORT={0x8, 0x22, r2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) (fail_nth: 7) 1.265757596s ago: executing program 4 (id=560): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_emit_ethernet(0x0, 0x0, 0x0) socket$tipc(0x1e, 0x5, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe1000, 0x280000b, 0x28011, r0, 0x0) 1.216703312s ago: executing program 3 (id=561): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdir(0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private0, 0xfffffffd, 0x0, 0x1, 0x8, 0xffff, 0x7}, 0xfcf3) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x8b32, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xd41, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = io_uring_setup(0x4355b, &(0x7f0000000140)={0x0, 0xe24b, 0x10, 0x5, 0x4000020}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) close_range(r1, 0xffffffffffffffff, 0x0) 980.059645ms ago: executing program 3 (id=562): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x288}) r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185647, &(0x7f0000000100)={0xf000000, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x8000000, '\x00', @string=&(0x7f0000000340)=0xfe}}) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000140)={0x1, 0xa, 0x3, "2e85f85a3b9156e89e82960ad936188f4429f4bf777d1b56926c75b050d4c3f0", 0x39555659}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) add_key$user(&(0x7f0000000280), &(0x7f00000003c0)={'syz', 0x1}, &(0x7f00000000c0)="ff", 0x1, 0x0) keyctl$clear(0x7, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010000d0425bd7000fcdbff2500000022", @ANYRES32=r1, @ANYBLOB="10000000000000001c0012800b00010062726964676500000c0002800800030019000000"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r5, 0x5421, &(0x7f0000000000)=0x5) connect$bt_rfcomm(r5, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xb}, 0xa) close(r5) 0s ago: executing program 3 (id=563): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0xa82, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0x4}, {}, {0xb, 0x9}}}, 0x24}}, 0x20040054) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) mount$nfs(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='ac,,']) fsmount(0xffffffffffffffff, 0x0, 0x1) write$cgroup_int(r0, &(0x7f0000000040)=0x900, 0x12) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$sequencer(r8, 0x0, 0x0) kernel console output (not intermixed with test programs): t 0x8A has an invalid bInterval 0, changing to 7 [ 113.818644][ T30] audit: type=1400 audit(1752016373.673:269): avc: denied { ioctl } for pid=6527 comm="syz.1.125" path="socket:[9845]" dev="sockfs" ino=9845 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 113.832443][ T5918] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 113.947928][ T6537] FAULT_INJECTION: forcing a failure. [ 113.947928][ T6537] name failslab, interval 1, probability 0, space 0, times 0 [ 113.959363][ T48] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 113.964070][ T30] audit: type=1400 audit(1752016373.963:270): avc: denied { read } for pid=6532 comm="syz.4.128" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 114.585806][ T6537] CPU: 0 UID: 0 PID: 6537 Comm: syz.4.128 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 114.585831][ T6537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 114.585840][ T6537] Call Trace: [ 114.585845][ T6537] [ 114.585852][ T6537] dump_stack_lvl+0x16c/0x1f0 [ 114.585881][ T6537] should_fail_ex+0x512/0x640 [ 114.585901][ T6537] ? fs_reclaim_acquire+0xae/0x150 [ 114.585919][ T6537] ? tomoyo_encode2+0x100/0x3e0 [ 114.585939][ T6537] should_failslab+0xc2/0x120 [ 114.585961][ T6537] __kmalloc_noprof+0xd2/0x510 [ 114.585982][ T6537] ? d_absolute_path+0x136/0x1a0 [ 114.586003][ T6537] tomoyo_encode2+0x100/0x3e0 [ 114.586027][ T6537] tomoyo_encode+0x29/0x50 [ 114.586045][ T6537] tomoyo_realpath_from_path+0x18f/0x6e0 [ 114.586072][ T6537] tomoyo_path_number_perm+0x245/0x580 [ 114.586088][ T6537] ? tomoyo_path_number_perm+0x237/0x580 [ 114.586106][ T6537] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 114.586124][ T6537] ? find_held_lock+0x2b/0x80 [ 114.586160][ T6537] ? find_held_lock+0x2b/0x80 [ 114.586177][ T6537] ? hook_file_ioctl_common+0x145/0x410 [ 114.586195][ T6537] ? __fget_files+0x20e/0x3c0 [ 114.586219][ T6537] security_file_ioctl+0x9b/0x240 [ 114.586240][ T6537] __x64_sys_ioctl+0xb7/0x210 [ 114.586258][ T6537] do_syscall_64+0xcd/0x4c0 [ 114.586280][ T6537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.586295][ T6537] RIP: 0033:0x7f47fe98e929 [ 114.586307][ T6537] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 114.586321][ T6537] RSP: 002b:00007f47ff740038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.586340][ T6537] RAX: ffffffffffffffda RBX: 00007f47febb6080 RCX: 00007f47fe98e929 [ 114.586349][ T6537] RDX: 0000200000000240 RSI: 0000000000004601 RDI: 0000000000000006 [ 114.586357][ T6537] RBP: 00007f47ff740090 R08: 0000000000000000 R09: 0000000000000000 [ 114.586365][ T6537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.586373][ T6537] R13: 0000000000000000 R14: 00007f47febb6080 R15: 00007ffeacb52058 [ 114.586393][ T6537] [ 114.822509][ T6535] ======================================================= [ 114.822509][ T6535] WARNING: The mand mount option has been deprecated and [ 114.822509][ T6535] and is ignored by this kernel. Remove the mand [ 114.822509][ T6535] option from the mount to silence this warning. [ 114.822509][ T6535] ======================================================= [ 114.857766][ T6535] tmpfs: Unknown parameter '/' [ 114.902439][ T6535] Bluetooth: MGMT ver 1.23 [ 114.942544][ T5918] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.984299][ T6537] ERROR: Out of memory at tomoyo_realpath_from_path. [ 114.993959][ T30] audit: type=1400 audit(1752016373.963:271): avc: denied { open } for pid=6532 comm="syz.4.128" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 115.018841][ T30] audit: type=1400 audit(1752016374.843:272): avc: denied { setopt } for pid=6534 comm="syz.2.127" lport=38167 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 115.043740][ T30] audit: type=1400 audit(1752016374.843:273): avc: denied { mounton } for pid=6534 comm="syz.2.127" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 115.204376][ T5918] usb 1-1: Product: syz [ 115.208572][ T5918] usb 1-1: Manufacturer: syz [ 115.231759][ T48] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 115.249866][ T48] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 115.682262][ T5918] usb 1-1: SerialNumber: syz [ 115.706049][ T5918] usb 1-1: config 0 descriptor?? [ 115.712260][ T48] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 115.734201][ T48] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.760048][ T48] usb 2-1: config 0 descriptor?? [ 115.782145][ T48] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 115.802875][ T48] dvb-usb: bulk message failed: -22 (3/0) [ 115.833065][ T48] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 115.858530][ T48] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 115.883437][ T48] usb 2-1: media controller created [ 115.907284][ T48] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 116.005060][ T5918] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 116.057214][ T48] dvb-usb: bulk message failed: -22 (6/0) [ 116.070577][ T48] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 116.115977][ T48] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input7 [ 116.411066][ T48] dvb-usb: schedule remote query interval to 150 msecs. [ 116.418053][ T48] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 116.679672][ T48] dvb-usb: bulk message failed: -22 (1/0) [ 116.732074][ T48] dvb-usb: error while querying for an remote control event. [ 116.784463][ T6558] lo: entered allmulticast mode [ 116.790799][ T6558] tunl0: entered allmulticast mode [ 116.796823][ T6558] gre0: entered allmulticast mode [ 116.808874][ T6558] gretap0: entered allmulticast mode [ 116.816189][ T6558] erspan0: entered allmulticast mode [ 116.839480][ T6558] ip_vti0: entered allmulticast mode [ 116.866262][ T6561] FAULT_INJECTION: forcing a failure. [ 116.866262][ T6561] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.879394][ T6561] CPU: 1 UID: 0 PID: 6561 Comm: syz.2.133 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 116.879409][ T6561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 116.879416][ T6561] Call Trace: [ 116.879419][ T6561] [ 116.879423][ T6561] dump_stack_lvl+0x16c/0x1f0 [ 116.879442][ T6561] should_fail_ex+0x512/0x640 [ 116.879466][ T6561] _copy_to_user+0x32/0xd0 [ 116.879491][ T6561] bpf_prog_test_run_raw_tp+0x53f/0x710 [ 116.879518][ T6561] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 116.879541][ T6561] ? fput+0x70/0xf0 [ 116.879551][ T6561] ? __bpf_prog_get+0x97/0x2a0 [ 116.879563][ T6561] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 116.879581][ T6561] __sys_bpf+0x1488/0x4d80 [ 116.879601][ T6561] ? __pfx___sys_bpf+0x10/0x10 [ 116.879624][ T6561] ? ksys_write+0x190/0x250 [ 116.879646][ T6561] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 116.879680][ T6561] ? fput+0x70/0xf0 [ 116.879688][ T6561] ? ksys_write+0x1ac/0x250 [ 116.879701][ T6561] ? __pfx_ksys_write+0x10/0x10 [ 116.879716][ T6561] __x64_sys_bpf+0x78/0xc0 [ 116.879731][ T6561] ? lockdep_hardirqs_on+0x7c/0x110 [ 116.879750][ T6561] do_syscall_64+0xcd/0x4c0 [ 116.879778][ T6561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.879796][ T6561] RIP: 0033:0x7f3982d8e929 [ 116.879809][ T6561] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 116.879824][ T6561] RSP: 002b:00007f3983cca038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 116.879840][ T6561] RAX: ffffffffffffffda RBX: 00007f3982fb5fa0 RCX: 00007f3982d8e929 [ 116.879850][ T6561] RDX: 000000000000000c RSI: 0000200000000500 RDI: 000000000000000a [ 116.879860][ T6561] RBP: 00007f3983cca090 R08: 0000000000000000 R09: 0000000000000000 [ 116.879870][ T6561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.879879][ T6561] R13: 0000000000000000 R14: 00007f3982fb5fa0 R15: 00007ffe62514928 [ 116.879902][ T6561] [ 117.076281][ T48] dvb-usb: bulk message failed: -22 (1/0) [ 117.082047][ T48] dvb-usb: error while querying for an remote control event. [ 117.099514][ T6558] ip6_vti0: entered allmulticast mode [ 117.116049][ T6558] sit0: entered allmulticast mode [ 117.116073][ T5918] usb 1-1: USB disconnect, device number 9 [ 117.170914][ T6558] ip6tnl0: entered allmulticast mode [ 117.250904][ T48] dvb-usb: bulk message failed: -22 (1/0) [ 117.252028][ T6558] ip6gre0: entered allmulticast mode [ 117.256657][ T48] dvb-usb: error while querying for an remote control event. [ 117.352713][ T6558] syz_tun: entered allmulticast mode [ 117.370209][ T6558] ip6gretap0: entered allmulticast mode [ 117.382250][ T48] usb 2-1: USB disconnect, device number 5 [ 117.394046][ T6558] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.401618][ T6558] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.409916][ T6558] bridge0: entered allmulticast mode [ 117.419326][ T6558] vcan0: entered allmulticast mode [ 117.427264][ T6558] bond0: entered allmulticast mode [ 117.437479][ T6558] bond_slave_0: entered allmulticast mode [ 117.443447][ T6558] bond_slave_1: entered allmulticast mode [ 117.454105][ T6558] team0: entered allmulticast mode [ 117.459279][ T6558] team_slave_0: entered allmulticast mode [ 117.514172][ T6558] team_slave_1: entered allmulticast mode [ 117.523358][ T6558] dummy0: entered allmulticast mode [ 117.828879][ T6572] syz.4.134: attempt to access beyond end of device [ 117.828879][ T6572] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 117.945343][ T48] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 117.965716][ T6558] nlmon0: entered allmulticast mode [ 118.192769][ T6558] caif0: entered allmulticast mode [ 118.319727][ T6558] batadv0: entered allmulticast mode [ 118.331658][ T6558] vxcan0: entered allmulticast mode [ 118.350635][ T6558] vxcan1: entered allmulticast mode [ 118.357693][ T6558] veth0: entered allmulticast mode [ 118.386715][ T6558] veth1: entered allmulticast mode [ 118.408616][ T6558] wg0: entered allmulticast mode [ 118.480693][ T6578] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 118.489603][ T6558] wg1: entered allmulticast mode [ 118.538419][ T6558] wg2: entered allmulticast mode [ 118.559230][ T6558] veth0_to_bridge: entered allmulticast mode [ 118.589367][ T6558] veth1_to_bridge: entered allmulticast mode [ 118.678934][ T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 118.686305][ T6558] veth0_to_bond: entered allmulticast mode [ 118.762574][ T6558] veth1_to_bond: entered allmulticast mode [ 118.776072][ T6558] veth0_to_team: entered allmulticast mode [ 118.786269][ T6558] veth1_to_team: entered allmulticast mode [ 118.796004][ T6558] veth0_to_batadv: entered allmulticast mode [ 118.805040][ T6558] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.819139][ T6558] batadv_slave_0: entered allmulticast mode [ 118.828969][ T6558] veth1_to_batadv: entered allmulticast mode [ 118.837310][ T6558] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.844956][ T6558] batadv_slave_1: entered allmulticast mode [ 118.854796][ T6558] xfrm0: entered allmulticast mode [ 118.862049][ T6558] veth0_to_hsr: entered allmulticast mode [ 118.872798][ T6558] hsr_slave_0: entered allmulticast mode [ 118.879519][ T6558] veth1_to_hsr: entered allmulticast mode [ 118.887767][ T6558] hsr_slave_1: entered allmulticast mode [ 118.894922][ T6558] hsr0: entered allmulticast mode [ 118.902359][ T6558] veth1_virt_wifi: entered allmulticast mode [ 118.903073][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 118.910594][ T6558] veth0_virt_wifi: entered allmulticast mode [ 118.918235][ T10] usb 3-1: config 166 has an invalid interface number: 51 but max is 0 [ 118.924945][ T6558] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 118.933064][ T10] usb 3-1: config 166 has no interface number 0 [ 118.938910][ T6558] veth1_vlan: entered allmulticast mode [ 118.944592][ T10] usb 3-1: config 166 interface 51 has no altsetting 0 [ 118.953345][ T6558] veth0_vlan: entered allmulticast mode [ 118.964129][ T10] usb 3-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 118.971282][ T6558] vlan0: entered allmulticast mode [ 118.977969][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.978609][ T6558] vlan1: entered allmulticast mode [ 118.986447][ T10] usb 3-1: Product: syz [ 118.986465][ T10] usb 3-1: Manufacturer: syz [ 118.986485][ T10] usb 3-1: SerialNumber: syz [ 119.006906][ T6558] macvlan0: entered allmulticast mode [ 119.015133][ T6558] macvlan1: entered allmulticast mode [ 119.023013][ T6558] ipvlan0: entered allmulticast mode [ 119.028432][ T6558] ipvlan1: entered allmulticast mode [ 119.034691][ T6558] veth1_macvtap: entered allmulticast mode [ 119.042978][ T6558] veth0_macvtap: entered allmulticast mode [ 119.051589][ T6558] macvtap0: entered allmulticast mode [ 119.059634][ T6558] macsec0: entered allmulticast mode [ 119.067156][ T6558] geneve0: entered allmulticast mode [ 119.075732][ T6558] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.079882][ T5918] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 119.085184][ T6558] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.101088][ T6558] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.109984][ T6558] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.119031][ T6558] geneve1: entered allmulticast mode [ 119.126773][ T6558] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 119.135768][ T6558] netdevsim netdevsim3 netdevsim1: entered allmulticast mode [ 119.144343][ T6558] netdevsim netdevsim3 netdevsim2: entered allmulticast mode [ 119.153958][ T6558] netdevsim netdevsim3 netdevsim3: entered allmulticast mode [ 119.168458][ T6558] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 119.182341][ T6558] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 119.409862][ T5918] usb 1-1: Using ep0 maxpacket: 16 [ 119.421177][ T5918] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 119.439296][ T5918] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.449601][ T5918] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 120.282435][ T5918] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 120.381784][ T5918] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.390422][ T5918] usb 1-1: Product: syz [ 120.394766][ T5918] usb 1-1: Manufacturer: syz [ 120.399438][ T5918] usb 1-1: SerialNumber: syz [ 120.488011][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 120.488026][ T30] audit: type=1400 audit(1752016380.503:278): avc: denied { read } for pid=6589 comm="syz.3.140" name="mouse0" dev="devtmpfs" ino=994 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 120.654623][ T6598] netlink: 'syz.1.142': attribute type 11 has an invalid length. [ 120.662662][ T6598] netlink: 48 bytes leftover after parsing attributes in process `syz.1.142'. [ 120.831826][ T30] audit: type=1400 audit(1752016380.693:279): avc: denied { append } for pid=6594 comm="syz.4.141" name="v4l-subdev0" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 120.842479][ T5918] usb 1-1: 0:2 : does not exist [ 121.164912][ T6610] netlink: 156 bytes leftover after parsing attributes in process `syz.4.144'. [ 121.502849][ T10] gspca_main: spca500-2.14.0 probing 04a5:300c [ 121.607348][ T6614] netlink: 'syz.3.145': attribute type 4 has an invalid length. [ 121.620863][ T6614] netlink: 'syz.3.145': attribute type 4 has an invalid length. [ 121.636941][ T6614] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1011 sclass=netlink_route_socket pid=6614 comm=syz.3.145 [ 121.796951][ T5918] usb 1-1: 1:0: failed to get current value for ch 0 (-22) [ 121.840096][ T10] usb 3-1: USB disconnect, device number 5 [ 122.401729][ T5918] usb 1-1: USB disconnect, device number 10 [ 122.992600][ T30] audit: type=1400 audit(1752016382.583:280): avc: denied { connect } for pid=6619 comm="syz.1.146" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 123.166702][ T5830] udevd[5830]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 123.379645][ T6636] netlink: 4 bytes leftover after parsing attributes in process `syz.2.148'. [ 123.414809][ T6636] netlink: 40 bytes leftover after parsing attributes in process `syz.2.148'. [ 123.632059][ T6637] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 123.886434][ T30] audit: type=1400 audit(1752016383.883:281): avc: denied { bind } for pid=6640 comm="syz.0.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 124.320951][ T30] audit: type=1400 audit(1752016383.883:282): avc: denied { name_bind } for pid=6640 comm="syz.0.151" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 124.569914][ T30] audit: type=1400 audit(1752016383.883:283): avc: denied { node_bind } for pid=6640 comm="syz.0.151" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 124.640193][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 124.666345][ T6651] FAULT_INJECTION: forcing a failure. [ 124.666345][ T6651] name failslab, interval 1, probability 0, space 0, times 0 [ 124.679163][ T6651] CPU: 0 UID: 0 PID: 6651 Comm: syz.2.152 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 124.679186][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 124.679196][ T6651] Call Trace: [ 124.679202][ T6651] [ 124.679209][ T6651] dump_stack_lvl+0x16c/0x1f0 [ 124.679243][ T6651] should_fail_ex+0x512/0x640 [ 124.679266][ T6651] ? fs_reclaim_acquire+0xae/0x150 [ 124.679287][ T6651] should_failslab+0xc2/0x120 [ 124.679312][ T6651] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 124.679336][ T6651] ? security_inode_alloc+0x3b/0x2b0 [ 124.679361][ T6651] security_inode_alloc+0x3b/0x2b0 [ 124.679382][ T6651] inode_init_always_gfp+0xce4/0x1030 [ 124.679411][ T6651] alloc_inode+0x86/0x240 [ 124.679429][ T6651] sock_alloc+0x40/0x280 [ 124.679456][ T6651] do_accept+0xf7/0x530 [ 124.679474][ T6651] ? do_raw_spin_lock+0x12c/0x2b0 [ 124.679494][ T6651] ? __pfx_do_accept+0x10/0x10 [ 124.679529][ T6651] __sys_accept4+0x100/0x1c0 [ 124.679548][ T6651] ? __pfx___sys_accept4+0x10/0x10 [ 124.679574][ T6651] __x64_sys_accept4+0x96/0x100 [ 124.679592][ T6651] ? lockdep_hardirqs_on+0x7c/0x110 [ 124.679615][ T6651] do_syscall_64+0xcd/0x4c0 [ 124.679641][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.679659][ T6651] RIP: 0033:0x7f3982d8e929 [ 124.679674][ T6651] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 124.679691][ T6651] RSP: 002b:00007f3983c88038 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 124.679708][ T6651] RAX: ffffffffffffffda RBX: 00007f3982fb6160 RCX: 00007f3982d8e929 [ 124.679719][ T6651] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 124.679729][ T6651] RBP: 00007f3983c88090 R08: 0000000000000000 R09: 0000000000000000 [ 124.679740][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.679750][ T6651] R13: 0000000000000000 R14: 00007f3982fb6160 R15: 00007ffe62514928 [ 124.679776][ T6651] [ 125.745585][ T6660] netlink: 'syz.2.156': attribute type 11 has an invalid length. [ 125.753630][ T6660] netlink: 48 bytes leftover after parsing attributes in process `syz.2.156'. [ 125.960532][ T6653] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 126.162724][ T30] audit: type=1400 audit(1752016386.183:284): avc: denied { create } for pid=6669 comm="syz.1.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 126.638175][ T30] audit: type=1400 audit(1752016386.193:285): avc: denied { read } for pid=6669 comm="syz.1.157" name="usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 126.675092][ T30] audit: type=1400 audit(1752016386.193:286): avc: denied { open } for pid=6669 comm="syz.1.157" path="/dev/usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 126.813659][ T30] audit: type=1400 audit(1752016386.193:287): avc: denied { ioctl } for pid=6669 comm="syz.1.157" path="/dev/usbmon7" dev="devtmpfs" ino=737 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 126.857587][ T30] audit: type=1326 audit(1752016386.283:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7e6d8e929 code=0x7ffc0000 [ 126.881989][ T30] audit: type=1326 audit(1752016386.283:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7e6d8e929 code=0x7ffc0000 [ 126.907170][ T30] audit: type=1326 audit(1752016386.283:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd7e6d8d290 code=0x7ffc0000 [ 126.949344][ T6677] netlink: 20 bytes leftover after parsing attributes in process `syz.0.158'. [ 126.970965][ T30] audit: type=1326 audit(1752016386.293:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd7e6d8e52b code=0x7ffc0000 [ 127.040506][ T30] audit: type=1326 audit(1752016386.293:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7e6d8e929 code=0x7ffc0000 [ 127.068536][ T30] audit: type=1326 audit(1752016386.293:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6658 comm="syz.3.155" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7e6d8e929 code=0x7ffc0000 [ 127.229917][ T10] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 127.768313][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 127.965330][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.082471][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.511281][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 128.657353][ T10] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 128.673175][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.822979][ T10] usb 1-1: config 0 descriptor?? [ 128.900140][ T5834] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 129.145761][ T5834] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 129.157120][ T5834] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.809920][ T6712] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 130.000461][ T5834] usb 3-1: Product: syz [ 130.005813][ T5834] usb 3-1: Manufacturer: syz [ 130.010455][ T5834] usb 3-1: SerialNumber: syz [ 130.135034][ T5834] usb 3-1: config 0 descriptor?? [ 130.869683][ T6721] tipc: Trying to set illegal importance in message [ 131.185909][ T5834] usb 3-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 131.284406][ T6725] netlink: 'syz.3.169': attribute type 11 has an invalid length. [ 131.292352][ T6725] netlink: 48 bytes leftover after parsing attributes in process `syz.3.169'. [ 131.341936][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 131.352540][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 131.360531][ T5845] Bluetooth: hci5: command 0x1003 tx timeout [ 131.367612][ T5154] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 131.390812][ T10] usb 1-1: USB disconnect, device number 11 [ 131.405702][ T5834] usb 3-1: failed to fetch extended address, random address set [ 131.414760][ T5834] usb 3-1: atusb_probe: initialization failed, error = -524 [ 131.425202][ T5834] atusb 3-1:0.0: probe with driver atusb failed with error -524 [ 131.655303][ T5918] usb 3-1: USB disconnect, device number 6 [ 131.741536][ T6735] syz.0.170: attempt to access beyond end of device [ 131.741536][ T6735] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 132.269239][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 132.269255][ T30] audit: type=1400 audit(1752016392.273:344): avc: denied { create } for pid=6733 comm="syz.4.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 132.340020][ T30] audit: type=1400 audit(1752016392.283:345): avc: denied { ioctl } for pid=6733 comm="syz.4.172" path="socket:[10885]" dev="sockfs" ino=10885 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 132.364439][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.372113][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.609881][ T6745] netlink: 4 bytes leftover after parsing attributes in process `syz.4.173'. [ 132.622911][ T6745] netlink: 40 bytes leftover after parsing attributes in process `syz.4.173'. [ 133.178367][ T6763] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 133.230369][ T5918] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 133.479544][ T5918] usb 3-1: Using ep0 maxpacket: 16 [ 133.564161][ T5918] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 133.772616][ T6765] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 133.788489][ T5918] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.857945][ T5918] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 134.093747][ T5918] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 134.127555][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.147816][ T5918] usb 3-1: Product: syz [ 134.181882][ T5918] usb 3-1: Manufacturer: syz [ 134.209282][ T5918] usb 3-1: SerialNumber: syz [ 134.387368][ T6779] sp0: Synchronizing with TNC [ 134.573529][ T30] audit: type=1400 audit(1752016394.583:346): avc: denied { map } for pid=6752 comm="syz.2.176" path="socket:[10934]" dev="sockfs" ino=10934 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 134.600914][ T6786] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 134.610249][ T6786] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 134.859452][ T30] audit: type=1400 audit(1752016394.583:347): avc: denied { read } for pid=6752 comm="syz.2.176" path="socket:[10934]" dev="sockfs" ino=10934 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 134.884857][ T30] audit: type=1400 audit(1752016394.633:348): avc: denied { firmware_load } for pid=6783 comm="syz.3.180" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 135.492438][ T5918] usb 3-1: 0:2 : does not exist [ 135.521477][ T5918] usb 3-1: 1:0: cannot get min/max values for control 4 (id 1) [ 135.641607][ T6802] netlink: 'syz.3.185': attribute type 11 has an invalid length. [ 135.732236][ T6802] netlink: 48 bytes leftover after parsing attributes in process `syz.3.185'. [ 136.394404][ T5918] usb 3-1: USB disconnect, device number 7 [ 136.415501][ T6002] udevd[6002]: setting mode of /dev/bus/usb/003/007 to 020664 failed: No such file or directory [ 136.498538][ T6818] FAULT_INJECTION: forcing a failure. [ 136.498538][ T6818] name failslab, interval 1, probability 0, space 0, times 0 [ 136.511519][ T6818] CPU: 1 UID: 0 PID: 6818 Comm: syz.4.188 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 136.511542][ T6818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 136.511549][ T6818] Call Trace: [ 136.511553][ T6818] [ 136.511557][ T6818] dump_stack_lvl+0x16c/0x1f0 [ 136.511575][ T6818] should_fail_ex+0x512/0x640 [ 136.511589][ T6818] ? __kmalloc_noprof+0xbf/0x510 [ 136.511604][ T6818] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 136.511618][ T6818] should_failslab+0xc2/0x120 [ 136.511635][ T6818] __kmalloc_noprof+0xd2/0x510 [ 136.511652][ T6818] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 136.511666][ T6818] ? cred_has_capability.isra.0+0x193/0x2f0 [ 136.511682][ T6818] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 136.511696][ T6818] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 136.511713][ T6818] ? bpf_lsm_capable+0x9/0x10 [ 136.511725][ T6818] ? security_capable+0x7e/0x260 [ 136.511740][ T6818] genl_rcv_msg+0x55c/0x800 [ 136.511753][ T6818] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.511765][ T6818] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 136.511783][ T6818] ? __lock_acquire+0x622/0x1c90 [ 136.511795][ T6818] netlink_rcv_skb+0x158/0x420 [ 136.511805][ T6818] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.511818][ T6818] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 136.511833][ T6818] ? netlink_deliver_tap+0x1ae/0xd30 [ 136.511849][ T6818] ? is_vmalloc_addr+0x86/0xa0 [ 136.511865][ T6818] genl_rcv+0x28/0x40 [ 136.511875][ T6818] netlink_unicast+0x53a/0x7f0 [ 136.511886][ T6818] ? __pfx_netlink_unicast+0x10/0x10 [ 136.511900][ T6818] netlink_sendmsg+0x8d1/0xdd0 [ 136.511913][ T6818] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.511928][ T6818] ____sys_sendmsg+0xa95/0xc70 [ 136.511939][ T6818] ? copy_msghdr_from_user+0x10a/0x160 [ 136.511954][ T6818] ? __pfx_____sys_sendmsg+0x10/0x10 [ 136.511971][ T6818] ___sys_sendmsg+0x134/0x1d0 [ 136.511991][ T6818] ? __pfx____sys_sendmsg+0x10/0x10 [ 136.512004][ T6818] ? __lock_acquire+0x622/0x1c90 [ 136.512030][ T6818] __sys_sendmsg+0x16d/0x220 [ 136.512044][ T6818] ? __pfx___sys_sendmsg+0x10/0x10 [ 136.512063][ T6818] ? xfd_validate_state+0x61/0x180 [ 136.512083][ T6818] do_syscall_64+0xcd/0x4c0 [ 136.512099][ T6818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.512111][ T6818] RIP: 0033:0x7f47fe98e929 [ 136.512120][ T6818] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.512130][ T6818] RSP: 002b:00007f47ff740038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 136.512141][ T6818] RAX: ffffffffffffffda RBX: 00007f47febb6080 RCX: 00007f47fe98e929 [ 136.512148][ T6818] RDX: 0000000000000004 RSI: 0000200000000040 RDI: 0000000000000005 [ 136.512154][ T6818] RBP: 00007f47ff740090 R08: 0000000000000000 R09: 0000000000000000 [ 136.512161][ T6818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.512167][ T6818] R13: 0000000000000001 R14: 00007f47febb6080 R15: 00007ffeacb52058 [ 136.512180][ T6818] [ 136.512302][ T6002] udevd[6002]: setting owner of /dev/bus/usb/003/007 to uid=0, gid=0 failed: No such file or directory [ 136.699856][ T5918] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 136.955230][ T6830] FAULT_INJECTION: forcing a failure. [ 136.955230][ T6830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.968895][ T6830] CPU: 0 UID: 0 PID: 6830 Comm: syz.1.192 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 136.968919][ T6830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 136.968929][ T6830] Call Trace: [ 136.968935][ T6830] [ 136.968941][ T6830] dump_stack_lvl+0x16c/0x1f0 [ 136.968969][ T6830] should_fail_ex+0x512/0x640 [ 136.968995][ T6830] _copy_from_user+0x2e/0xd0 [ 136.969020][ T6830] drm_ioctl+0x4fb/0xc30 [ 136.969047][ T6830] ? __pfx_drm_gem_flink_ioctl+0x10/0x10 [ 136.969072][ T6830] ? __pfx_drm_ioctl+0x10/0x10 [ 136.969106][ T6830] ? selinux_file_ioctl+0x180/0x270 [ 136.969128][ T6830] ? selinux_file_ioctl+0xb4/0x270 [ 136.969152][ T6830] ? __pfx_drm_ioctl+0x10/0x10 [ 136.969177][ T6830] __x64_sys_ioctl+0x18e/0x210 [ 136.969199][ T6830] do_syscall_64+0xcd/0x4c0 [ 136.969231][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.969249][ T6830] RIP: 0033:0x7faa9d98e929 [ 136.969263][ T6830] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.969279][ T6830] RSP: 002b:00007faa9b7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 136.969296][ T6830] RAX: ffffffffffffffda RBX: 00007faa9dbb5fa0 RCX: 00007faa9d98e929 [ 136.969307][ T6830] RDX: 00002000000001c0 RSI: 00000000c008640a RDI: 0000000000000004 [ 136.969318][ T6830] RBP: 00007faa9b7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 136.969329][ T6830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.969339][ T6830] R13: 0000000000000000 R14: 00007faa9dbb5fa0 R15: 00007ffc8e8e5cf8 [ 136.969361][ T6830] [ 137.186329][ T6002] udevd[6002]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 137.235284][ T49] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 137.299836][ T5834] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 137.334469][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 137.451740][ T5834] usb 4-1: unable to get BOS descriptor or descriptor too short [ 137.930608][ T5834] usb 4-1: config 166 has an invalid interface number: 51 but max is 0 [ 138.282573][ T5834] usb 4-1: config 166 has no interface number 0 [ 138.288875][ T5834] usb 4-1: config 166 interface 51 has no altsetting 0 [ 138.317405][ T5834] usb 4-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 138.326708][ T5834] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.339851][ T5834] usb 4-1: Product: syz [ 138.348849][ T5834] usb 4-1: Manufacturer: syz [ 138.358904][ T5834] usb 4-1: SerialNumber: syz [ 138.359793][ T5918] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 138.391804][ T5918] usb 3-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 138.404512][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.440421][ T5918] usb 3-1: config 0 descriptor?? [ 138.450330][ T6805] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 138.539440][ T5918] usbhid 3-1:0.0: can't add hid device: -71 [ 138.549223][ T5918] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 138.602893][ T5918] usb 3-1: USB disconnect, device number 8 [ 139.279855][ T5154] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 139.747596][ T6849] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 140.655739][ T5834] gspca_main: spca500-2.14.0 probing 04a5:300c [ 140.693139][ T5834] usb 4-1: USB disconnect, device number 8 [ 140.806996][ T6861] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 141.339978][ T30] audit: type=1400 audit(1752016401.193:349): avc: denied { watch watch_reads } for pid=6864 comm="syz.4.199" path="/38/bus" dev="tmpfs" ino=216 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 141.486175][ T30] audit: type=1800 audit(1752016401.483:350): pid=6868 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.200" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 141.627471][ T6873] netlink: 'syz.2.201': attribute type 11 has an invalid length. [ 141.649134][ T6873] netlink: 48 bytes leftover after parsing attributes in process `syz.2.201'. [ 141.804656][ T30] audit: type=1400 audit(1752016401.823:351): avc: denied { mount } for pid=6874 comm="syz.0.202" name="/" dev="hugetlbfs" ino=11117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 141.916346][ T6888] 9pnet_fd: Insufficient options for proto=fd [ 141.938047][ T6888] netlink: 8 bytes leftover after parsing attributes in process `syz.3.207'. [ 141.947612][ T30] audit: type=1400 audit(1752016401.973:352): avc: denied { unmount } for pid=5829 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 142.357616][ T5834] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 143.028423][ T5834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 143.074526][ T5834] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 143.229913][ T5834] usb 2-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 143.248917][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.374458][ T5834] usb 2-1: config 0 descriptor?? [ 143.408444][ T6883] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 144.153016][ T30] audit: type=1400 audit(1752016404.013:353): avc: denied { mount } for pid=6927 comm="syz.2.215" name="/" dev="ramfs" ino=11202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 144.289138][ T30] audit: type=1400 audit(1752016404.203:354): avc: denied { execute } for pid=6927 comm="syz.2.215" name="file0" dev="ramfs" ino=11203 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 144.326238][ T30] audit: type=1400 audit(1752016404.203:355): avc: denied { execute_no_trans } for pid=6927 comm="syz.2.215" path="/file0" dev="ramfs" ino=11203 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 144.388468][ T30] audit: type=1400 audit(1752016404.263:356): avc: denied { write } for pid=6927 comm="syz.2.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 144.653180][ T6942] tipc: Trying to set illegal importance in message [ 144.835567][ T5834] usbhid 2-1:0.0: can't add hid device: -71 [ 144.863399][ T5834] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 144.926403][ T5834] usb 2-1: USB disconnect, device number 6 [ 145.231423][ T6953] gfs2: gfs2 mount does not exist [ 145.301563][ T5900] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 145.316383][ T30] audit: type=1400 audit(1752016405.243:357): avc: denied { create } for pid=6954 comm="syz.4.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 145.407340][ T30] audit: type=1400 audit(1752016405.283:358): avc: denied { ioctl } for pid=6954 comm="syz.4.219" path="socket:[11226]" dev="sockfs" ino=11226 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 145.519808][ T6953] netlink: 24 bytes leftover after parsing attributes in process `syz.0.218'. [ 145.578291][ T6964] netlink: 'syz.4.221': attribute type 11 has an invalid length. [ 145.587352][ T6964] netlink: 48 bytes leftover after parsing attributes in process `syz.4.221'. [ 145.616605][ T5900] usb 3-1: unable to get BOS descriptor or descriptor too short [ 145.629114][ T5900] usb 3-1: config 166 has an invalid interface number: 51 but max is 0 [ 145.928324][ T5900] usb 3-1: config 166 has no interface number 0 [ 145.979737][ T5900] usb 3-1: config 166 interface 51 has no altsetting 0 [ 145.997388][ T5900] usb 3-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 146.010662][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.034858][ T5900] usb 3-1: Product: syz [ 146.053670][ T5900] usb 3-1: Manufacturer: syz [ 146.076993][ T5900] usb 3-1: SerialNumber: syz [ 147.753377][ T6973] capability: warning: `syz.3.224' uses 32-bit capabilities (legacy support in use) [ 148.124360][ T5834] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 148.127729][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 148.127742][ T30] audit: type=1400 audit(1752016408.143:363): avc: denied { read write } for pid=7000 comm="syz.1.227" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 148.246374][ T7003] loop6: detected capacity change from 0 to 63 [ 148.316396][ T5900] gspca_main: spca500-2.14.0 probing 04a5:300c [ 148.366163][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 148.382723][ T30] audit: type=1400 audit(1752016408.193:364): avc: denied { append } for pid=7000 comm="syz.1.227" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 148.389820][ T5834] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 148.626257][ T5900] usb 3-1: USB disconnect, device number 9 [ 148.633807][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 148.653721][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 148.679586][ T5834] usb 1-1: config 0 has no interface number 0 [ 148.712641][ T5834] usb 1-1: config 0 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 148.724221][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 148.754071][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 148.772821][ T5834] usb 1-1: config 0 interface 32 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.810232][ T5834] usb 1-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 148.859864][ T5834] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.913772][ T5834] usb 1-1: config 0 descriptor?? [ 149.040036][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 149.204214][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 149.217052][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.238667][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 149.264975][ T10] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 149.286776][ T10] usb 5-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 149.298299][ T10] usb 5-1: Product: syz [ 149.305734][ T10] usb 5-1: config 0 descriptor?? [ 149.579901][ T5954] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 149.636535][ T5834] logitech-djreceiver 0003:046D:C71B.0002: hidraw0: USB HID v0.00 Device [HID 046d:c71b] on usb-dummy_hcd.0-1/input32 [ 149.689893][ T5900] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 149.760106][ T5954] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 149.792402][ T5954] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 149.835165][ T5954] usb 4-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 149.868359][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 149.872064][ T5954] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.893059][ T5900] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 150.132240][ T5954] usb 4-1: config 0 descriptor?? [ 150.138355][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 150.204591][ T7022] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 150.222392][ T5900] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 150.246904][ T5900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.255647][ T5900] usb 2-1: Product: syz [ 150.265714][ T5900] usb 2-1: Manufacturer: syz [ 150.275655][ T5900] usb 2-1: SerialNumber: syz [ 150.288692][ T5900] usb 2-1: config 0 descriptor?? [ 150.304708][ T7018] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 150.313463][ T7018] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 150.322624][ T48] usb 1-1: USB disconnect, device number 12 [ 150.334346][ T5900] usb 2-1: ucan: probing device on interface #0 [ 150.353243][ T10] appleir 0003:05AC:8241.0003: unbalanced collection at end of report description [ 150.371462][ T10] appleir 0003:05AC:8241.0003: parse failed [ 150.403561][ T10] appleir 0003:05AC:8241.0003: probe with driver appleir failed with error -22 [ 150.476731][ T5954] usbhid 4-1:0.0: can't add hid device: -71 [ 150.493250][ T5954] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 150.520127][ T5954] usb 4-1: USB disconnect, device number 9 [ 150.589740][ T30] audit: type=1400 audit(1752016410.603:365): avc: denied { name_connect } for pid=7050 comm="syz.2.237" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 150.658795][ T30] audit: type=1400 audit(1752016410.613:366): avc: denied { getopt } for pid=7050 comm="syz.2.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 151.144054][ T30] audit: type=1400 audit(1752016411.153:367): avc: denied { setopt } for pid=7058 comm="syz.2.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 151.145800][ T10] usb 5-1: USB disconnect, device number 5 [ 151.245043][ T7064] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 151.522369][ T5845] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 151.526124][ T5900] usb 2-1: ucan: could not read protocol version, ret=-110 [ 151.531498][ T5845] Bluetooth: hci0: Injecting HCI hardware error event [ 151.557786][ T5845] Bluetooth: hci0: hardware error 0x00 [ 151.688177][ T7065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.238'. [ 151.899337][ T5900] usb 2-1: ucan: probe failed; try to update the device firmware [ 153.249996][ T5918] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 153.341491][ T5954] usb 2-1: USB disconnect, device number 7 [ 154.005906][ T7098] FAULT_INJECTION: forcing a failure. [ 154.005906][ T7098] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 154.019006][ T7098] CPU: 1 UID: 0 PID: 7098 Comm: syz.3.245 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 154.019030][ T7098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 154.019041][ T7098] Call Trace: [ 154.019047][ T7098] [ 154.019054][ T7098] dump_stack_lvl+0x16c/0x1f0 [ 154.019082][ T7098] should_fail_ex+0x512/0x640 [ 154.019110][ T7098] _copy_from_user+0x2e/0xd0 [ 154.019135][ T7098] copy_from_sockptr_offset.constprop.0+0x153/0x1a0 [ 154.019157][ T7098] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 154.019184][ T7098] do_ipv6_setsockopt+0x865/0x4400 [ 154.019209][ T7098] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 154.019225][ T7098] ? avc_has_perm_noaudit+0x117/0x3b0 [ 154.019247][ T7098] ? avc_has_perm_noaudit+0x149/0x3b0 [ 154.019267][ T7098] ? avc_has_perm+0x11a/0x1c0 [ 154.019284][ T7098] ? __pfx_avc_has_perm+0x10/0x10 [ 154.019310][ T7098] ? sock_has_perm+0x259/0x2f0 [ 154.019331][ T7098] ? __pfx_sock_has_perm+0x10/0x10 [ 154.019351][ T7098] ? selinux_netlbl_socket_setsockopt+0x183/0x470 [ 154.019376][ T7098] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 154.019399][ T7098] ? proc_fail_nth_write+0x9f/0x250 [ 154.019429][ T7098] ? ipv6_setsockopt+0xcb/0x170 [ 154.019444][ T7098] ipv6_setsockopt+0xcb/0x170 [ 154.019466][ T7098] tcp_setsockopt+0xa7/0x100 [ 154.019492][ T7098] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 154.019521][ T7098] do_sock_setsockopt+0x221/0x470 [ 154.019548][ T7098] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 154.019589][ T7098] __sys_setsockopt+0x1a0/0x230 [ 154.019616][ T7098] __x64_sys_setsockopt+0xbd/0x160 [ 154.019637][ T7098] ? do_syscall_64+0x91/0x4c0 [ 154.019661][ T7098] ? lockdep_hardirqs_on+0x7c/0x110 [ 154.019684][ T7098] do_syscall_64+0xcd/0x4c0 [ 154.019709][ T7098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.019733][ T7098] RIP: 0033:0x7fd7e6d8e929 [ 154.019747][ T7098] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 154.019767][ T7098] RSP: 002b:00007fd7e7b85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 154.019785][ T7098] RAX: ffffffffffffffda RBX: 00007fd7e6fb6160 RCX: 00007fd7e6d8e929 [ 154.019797][ T7098] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005 [ 154.019807][ T7098] RBP: 00007fd7e7b85090 R08: 00000000000003c0 R09: 0000000000000000 [ 154.019818][ T7098] R10: 0000200000001040 R11: 0000000000000246 R12: 0000000000000001 [ 154.019828][ T7098] R13: 0000000000000000 R14: 00007fd7e6fb6160 R15: 00007ffce6494948 [ 154.019852][ T7098] [ 154.100234][ T5845] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 154.143996][ T5918] usb 3-1: unable to get BOS descriptor or descriptor too short [ 154.380620][ T5918] usb 3-1: config 166 has an invalid interface number: 51 but max is 0 [ 154.439664][ T5918] usb 3-1: config 166 has no interface number 0 [ 154.539848][ T5918] usb 3-1: config 166 interface 51 has no altsetting 0 [ 154.554133][ T5918] usb 3-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 154.566717][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.574872][ T5918] usb 3-1: Product: syz [ 154.579109][ T5918] usb 3-1: Manufacturer: syz [ 154.584494][ T5918] usb 3-1: SerialNumber: syz [ 155.766134][ T7121] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 156.102750][ T7122] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 157.509560][ T5918] gspca_main: spca500-2.14.0 probing 04a5:300c [ 157.536050][ T5918] usb 3-1: USB disconnect, device number 10 [ 158.032382][ T7140] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 158.640604][ T30] audit: type=1400 audit(1752016418.663:368): avc: denied { ioctl } for pid=7151 comm="syz.3.256" path="socket:[12704]" dev="sockfs" ino=12704 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 159.161830][ T30] audit: type=1400 audit(1752016419.183:369): avc: denied { write } for pid=7151 comm="syz.3.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 159.782643][ T5900] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 159.992364][ T5900] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 160.017342][ T5900] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 160.060333][ T5900] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 160.083985][ T30] audit: type=1400 audit(1752016420.103:370): avc: denied { ioctl } for pid=7151 comm="syz.3.256" path="socket:[11998]" dev="sockfs" ino=11998 ioctlcmd=0x8924 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 160.122325][ T5900] usb 2-1: config 1 has no interface number 0 [ 160.135358][ T5900] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 160.146767][ T5900] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 160.190025][ T5900] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 160.297885][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.786711][ T5900] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 161.090517][ T7189] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 161.357984][ T5900] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 161.452758][ T7194] FAULT_INJECTION: forcing a failure. [ 161.452758][ T7194] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 161.466120][ T7194] CPU: 0 UID: 0 PID: 7194 Comm: syz.4.262 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 161.466142][ T7194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 161.466151][ T7194] Call Trace: [ 161.466155][ T7194] [ 161.466159][ T7194] dump_stack_lvl+0x16c/0x1f0 [ 161.466179][ T7194] should_fail_ex+0x512/0x640 [ 161.466195][ T7194] _copy_from_iter+0x29f/0x16f0 [ 161.466214][ T7194] ? __alloc_skb+0x200/0x380 [ 161.466232][ T7194] ? __pfx__copy_from_iter+0x10/0x10 [ 161.466248][ T7194] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 161.466271][ T7194] netlink_sendmsg+0x829/0xdd0 [ 161.466283][ T7194] ? __pfx_netlink_sendmsg+0x10/0x10 [ 161.466299][ T7194] ____sys_sendmsg+0xa95/0xc70 [ 161.466310][ T7194] ? copy_msghdr_from_user+0x10a/0x160 [ 161.466324][ T7194] ? __pfx_____sys_sendmsg+0x10/0x10 [ 161.466341][ T7194] ___sys_sendmsg+0x134/0x1d0 [ 161.466356][ T7194] ? __pfx____sys_sendmsg+0x10/0x10 [ 161.466369][ T7194] ? __lock_acquire+0x622/0x1c90 [ 161.466391][ T7194] ? lookup_nulls_elem_raw+0xe0/0x180 [ 161.466410][ T7194] __sys_sendmsg+0x16d/0x220 [ 161.466424][ T7194] ? __pfx___sys_sendmsg+0x10/0x10 [ 161.466438][ T7194] ? __pfx_bpf_trace_run2+0x10/0x10 [ 161.466453][ T7194] ? syscall_trace_enter+0x1cb/0x260 [ 161.466467][ T7194] ? rcu_is_watching+0x12/0xc0 [ 161.466483][ T7194] do_syscall_64+0xcd/0x4c0 [ 161.466500][ T7194] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.466511][ T7194] RIP: 0033:0x7f47fe98e929 [ 161.466520][ T7194] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.466530][ T7194] RSP: 002b:00007f47ff740038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 161.466541][ T7194] RAX: ffffffffffffffda RBX: 00007f47febb6080 RCX: 00007f47fe98e929 [ 161.466548][ T7194] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 000000000000000b [ 161.466554][ T7194] RBP: 00007f47ff740090 R08: 0000000000000000 R09: 0000000000000000 [ 161.466560][ T7194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 161.466566][ T7194] R13: 0000000000000000 R14: 00007f47febb6080 R15: 00007ffeacb52058 [ 161.466580][ T7194] [ 161.702531][ T30] audit: type=1400 audit(1752016421.723:371): avc: denied { bind } for pid=7162 comm="syz.1.257" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 161.898571][ T7196] syz.4.262: vmalloc error: size 4198400, failed to allocated page array size 8200, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 161.918390][ T7196] CPU: 0 UID: 0 PID: 7196 Comm: syz.4.262 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 161.918416][ T7196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 161.918425][ T7196] Call Trace: [ 161.918431][ T7196] [ 161.918438][ T7196] dump_stack_lvl+0x16c/0x1f0 [ 161.918467][ T7196] warn_alloc+0x248/0x3a0 [ 161.918492][ T7196] ? __pfx_warn_alloc+0x10/0x10 [ 161.918514][ T7196] ? irqentry_exit+0x3b/0x90 [ 161.918547][ T7196] ? hash_ipportip_create+0x3ec/0x1250 [ 161.918567][ T7196] ? __vmalloc_node_noprof+0xad/0xf0 [ 161.918591][ T7196] __vmalloc_node_range_noprof+0x101b/0x14b0 [ 161.918619][ T7196] ? hash_ipportip_create+0x3ec/0x1250 [ 161.918652][ T7196] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 161.918673][ T7196] ? __alloc_pages_noprof+0xb/0x1b0 [ 161.918695][ T7196] ? ___kmalloc_large_node+0x84/0x1e0 [ 161.918719][ T7196] __kvmalloc_node_noprof+0x30a/0x620 [ 161.918740][ T7196] ? hash_ipportip_create+0x3ec/0x1250 [ 161.918761][ T7196] ? hash_ipportip_create+0x3ec/0x1250 [ 161.918785][ T7196] ? hash_ipportip_create+0x3ec/0x1250 [ 161.918804][ T7196] hash_ipportip_create+0x3ec/0x1250 [ 161.918825][ T7196] ? __nla_parse+0x13/0x60 [ 161.918841][ T7196] ? __pfx_hash_ipportip_create+0x10/0x10 [ 161.918862][ T7196] ip_set_create+0x7e4/0x14d0 [ 161.918888][ T7196] ? __pfx_ip_set_create+0x10/0x10 [ 161.918933][ T7196] nfnetlink_rcv_msg+0x9fc/0x1200 [ 161.918964][ T7196] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 161.918988][ T7196] ? __pfx___schedule+0x10/0x10 [ 161.919035][ T7196] ? netlink_rcv_skb+0xb5/0x420 [ 161.919057][ T7196] netlink_rcv_skb+0x158/0x420 [ 161.919073][ T7196] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 161.919095][ T7196] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 161.919125][ T7196] ? ns_capable+0xd7/0x110 [ 161.919149][ T7196] nfnetlink_rcv+0x1b3/0x430 [ 161.919168][ T7196] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 161.919195][ T7196] netlink_unicast+0x53a/0x7f0 [ 161.919215][ T7196] ? __pfx_netlink_unicast+0x10/0x10 [ 161.919239][ T7196] netlink_sendmsg+0x8d1/0xdd0 [ 161.919260][ T7196] ? __pfx_netlink_sendmsg+0x10/0x10 [ 161.919288][ T7196] ____sys_sendmsg+0xa95/0xc70 [ 161.919307][ T7196] ? copy_msghdr_from_user+0x10a/0x160 [ 161.919330][ T7196] ? __pfx_____sys_sendmsg+0x10/0x10 [ 161.919351][ T7196] ? __lock_acquire+0xb8a/0x1c90 [ 161.919376][ T7196] ___sys_sendmsg+0x134/0x1d0 [ 161.919401][ T7196] ? __pfx____sys_sendmsg+0x10/0x10 [ 161.919458][ T7196] __sys_sendmsg+0x16d/0x220 [ 161.919482][ T7196] ? __pfx___sys_sendmsg+0x10/0x10 [ 161.919514][ T7196] ? rcu_read_unlock_trace_special+0x2aa/0x3f0 [ 161.919544][ T7196] ? rcu_is_watching+0x12/0xc0 [ 161.919569][ T7196] do_syscall_64+0xcd/0x4c0 [ 161.919595][ T7196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.919613][ T7196] RIP: 0033:0x7f47fe98e929 [ 161.919628][ T7196] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.919652][ T7196] RSP: 002b:00007f47ff71f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 161.919669][ T7196] RAX: ffffffffffffffda RBX: 00007f47febb6160 RCX: 00007f47fe98e929 [ 161.919680][ T7196] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 000000000000000a [ 161.919690][ T7196] RBP: 00007f47fea10b39 R08: 0000000000000000 R09: 0000000000000000 [ 161.919700][ T7196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.919710][ T7196] R13: 0000000000000000 R14: 00007f47febb6160 R15: 00007ffeacb52058 [ 161.919734][ T7196] [ 162.259441][ T7196] Mem-Info: [ 162.262856][ T7196] active_anon:9571 inactive_anon:0 isolated_anon:0 [ 162.262856][ T7196] active_file:1616 inactive_file:43593 isolated_file:0 [ 162.262856][ T7196] unevictable:768 dirty:304 writeback:0 [ 162.262856][ T7196] slab_reclaimable:11564 slab_unreclaimable:100805 [ 162.262856][ T7196] mapped:30956 shmem:1389 pagetables:1343 [ 162.262856][ T7196] sec_pagetables:0 bounce:0 [ 162.262856][ T7196] kernel_misc_reclaimable:0 [ 162.262856][ T7196] free:1303492 free_pcp:20647 free_cma:0 [ 162.309612][ T7196] Node 0 active_anon:38284kB inactive_anon:0kB active_file:6464kB inactive_file:174168kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:123824kB dirty:1216kB writeback:0kB shmem:4020kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12584kB pagetables:5256kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 162.343213][ T7196] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 162.376361][ T7196] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 162.406012][ T7196] lowmem_reserve[]: 0 2480 2481 2481 2481 [ 162.412106][ T7196] Node 0 DMA32 free:1302440kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0KB free_highatomic:0KB active_anon:38244kB inactive_anon:0kB active_file:6464kB inactive_file:172840kB unevictable:1536kB writepending:1280kB present:3129332kB managed:2540080kB mlocked:0kB bounce:0kB free_pcp:63220kB local_pcp:40356kB free_cma:0kB [ 162.444605][ T7196] lowmem_reserve[]: 0 0 1 1 1 [ 162.449628][ T7196] Node 0 Normal free:12kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12kB inactive_anon:0kB active_file:0kB inactive_file:1328kB unevictable:0kB writepending:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:36kB local_pcp:8kB free_cma:0kB [ 162.480110][ T7196] lowmem_reserve[]: 0 0 0 0 0 [ 162.485181][ T7196] Node 1 Normal free:3896720kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:18632kB local_pcp:8776kB free_cma:0kB [ 162.516573][ T7196] lowmem_reserve[]: 0 0 0 0 0 [ 162.521627][ T7196] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 162.536928][ T7196] Node 0 DMA32: 1501*4kB (UM) 438*8kB (UM) 430*16kB (UME) 159*32kB (UME) 12*64kB (UME) 12*128kB (UME) 3*256kB (UM) 8*512kB (UM) 4*1024kB (UME) 4*2048kB (U) 308*4096kB (UM) = 1302500kB [ 162.556106][ T7196] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 162.569047][ T7196] Node 1 Normal: 168*4kB (UE) 40*8kB (UME) 43*16kB (UME) 56*32kB (UME) 30*64kB (UME) 3*128kB (UME) 5*256kB (UME) 5*512kB (UME) 2*1024kB (UM) 1*2048kB (E) 948*4096kB (M) = 3896720kB [ 162.588952][ T7196] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.599622][ T7196] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.609034][ T7196] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.618707][ T7196] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.628084][ T7196] 46594 total pagecache pages [ 162.633904][ T7196] 0 pages in swap cache [ 162.638232][ T7196] Free swap = 124996kB [ 162.642653][ T7196] Total swap = 124996kB [ 162.647768][ T7196] 2097051 pages RAM [ 162.651760][ T7196] 0 pages HighMem/MovableOnly [ 162.656623][ T7196] 430053 pages reserved [ 162.661105][ T7196] 0 pages cma reserved [ 162.712496][ T5892] snd_usb_pod 2-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 163.615856][ T7217] loop6: detected capacity change from 0 to 63 [ 163.672892][ T30] audit: type=1400 audit(1752016423.673:372): avc: denied { map } for pid=7214 comm="syz.2.265" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 163.675013][ T7217] Buffer I/O error on dev loop6, logical block 0, async page read [ 163.711040][ T7217] Buffer I/O error on dev loop6, logical block 1, async page read [ 163.720024][ T7217] Buffer I/O error on dev loop6, logical block 2, async page read [ 163.728925][ T7217] Buffer I/O error on dev loop6, logical block 3, async page read [ 163.739591][ T7217] Buffer I/O error on dev loop6, logical block 0, async page read [ 163.743887][ T30] audit: type=1400 audit(1752016423.673:373): avc: denied { execute } for pid=7214 comm="syz.2.265" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 163.750005][ T7217] Buffer I/O error on dev loop6, logical block 1, async page read [ 163.780275][ T7217] Buffer I/O error on dev loop6, logical block 2, async page read [ 163.788914][ T7217] Buffer I/O error on dev loop6, logical block 3, async page read [ 163.797835][ T7217] Buffer I/O error on dev loop6, logical block 0, async page read [ 163.809291][ T7217] Buffer I/O error on dev loop6, logical block 1, async page read [ 164.291518][ T7227] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 164.901043][ T7235] netlink: 4 bytes leftover after parsing attributes in process `syz.0.268'. [ 164.941916][ T7235] netlink: 40 bytes leftover after parsing attributes in process `syz.0.268'. [ 165.573103][ T7254] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 165.804086][ T5892] usb 2-1: USB disconnect, device number 8 [ 165.823115][ T5892] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 166.161705][ T5954] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 166.346756][ T5954] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 166.378280][ T5954] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.413668][ T5954] usb 5-1: Product: syz [ 166.417846][ T5954] usb 5-1: Manufacturer: syz [ 166.457041][ T5954] usb 5-1: SerialNumber: syz [ 166.558732][ T5954] usb 5-1: config 0 descriptor?? [ 166.936076][ T7275] 9pnet_fd: Insufficient options for proto=fd [ 166.959298][ T7274] netlink: 8 bytes leftover after parsing attributes in process `syz.1.276'. [ 167.061803][ T5954] usb 5-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 167.307332][ T5954] usb 5-1: failed to fetch extended address, random address set [ 167.332835][ T5954] usb 5-1: atusb_probe: initialization failed, error = -524 [ 167.361489][ T5954] atusb 5-1:0.0: probe with driver atusb failed with error -524 [ 167.761854][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 167.793769][ T5954] usb 5-1: USB disconnect, device number 6 [ 168.041216][ T7287] netlink: 4 bytes leftover after parsing attributes in process `syz.0.280'. [ 168.089804][ T7287] netlink: 40 bytes leftover after parsing attributes in process `syz.0.280'. [ 168.569840][ T5892] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 169.762122][ T5892] usb 3-1: Using ep0 maxpacket: 32 [ 169.879599][ T59] Bluetooth: hci5: Frame reassembly failed (-84) [ 170.070270][ T5949] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 170.235536][ T5949] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 170.251897][ T5949] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.279923][ T5949] usb 5-1: config 0 descriptor?? [ 170.400115][ T48] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 170.567022][ T48] usb 4-1: unable to get BOS descriptor or descriptor too short [ 170.585098][ T48] usb 4-1: config 166 has an invalid interface number: 51 but max is 0 [ 170.607675][ T48] usb 4-1: config 166 has no interface number 0 [ 170.627301][ T48] usb 4-1: config 166 interface 51 has no altsetting 0 [ 170.653511][ T48] usb 4-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 170.678804][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.702741][ T48] usb 4-1: Product: syz [ 170.715746][ T48] usb 4-1: Manufacturer: syz [ 170.725428][ T48] usb 4-1: SerialNumber: syz [ 170.741212][ T5949] ath6kl: Failed to submit usb control message: -71 [ 170.756728][ T5949] ath6kl: unable to send the bmi data to the device: -71 [ 170.785522][ T5949] ath6kl: Unable to send get target info: -71 [ 170.823756][ T5949] ath6kl: Failed to init ath6kl core: -71 [ 170.858758][ T5949] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 170.943220][ T5949] usb 5-1: USB disconnect, device number 7 [ 171.197722][ T5892] usb 3-1: too many configurations: 33, using maximum allowed: 8 [ 171.281530][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 172.130288][ T5845] Bluetooth: hci5: command 0x1003 tx timeout [ 172.137514][ T5154] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 172.151028][ T5892] usb 3-1: can't read configurations, error -71 [ 172.797491][ T7343] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 172.994278][ T7345] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 173.209832][ T10] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 173.537859][ T10] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 173.705501][ T48] gspca_main: spca500-2.14.0 probing 04a5:300c [ 173.721630][ T48] usb 4-1: USB disconnect, device number 10 [ 173.741052][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.827895][ T10] usb 1-1: config 0 descriptor?? [ 174.064059][ T7342] syz_tun: entered allmulticast mode [ 174.269829][ T48] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 174.277721][ T7340] syz_tun: left allmulticast mode [ 174.289693][ T10] ath6kl: Failed to submit usb control message: -71 [ 174.297818][ T10] ath6kl: unable to send the bmi data to the device: -71 [ 174.309517][ T10] ath6kl: Unable to send get target info: -71 [ 174.334327][ T10] ath6kl: Failed to init ath6kl core: -71 [ 174.367513][ T10] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 174.397088][ T10] usb 1-1: USB disconnect, device number 13 [ 174.478709][ T48] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 174.516920][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.553694][ T48] usb 4-1: Product: syz [ 174.578461][ T48] usb 4-1: Manufacturer: syz [ 174.590335][ T48] usb 4-1: SerialNumber: syz [ 174.856542][ T48] usb 4-1: config 0 descriptor?? [ 175.474693][ T7385] loop6: detected capacity change from 0 to 63 [ 175.486771][ T7385] buffer_io_error: 810 callbacks suppressed [ 175.486782][ T7385] Buffer I/O error on dev loop6, logical block 0, async page read [ 175.500552][ T7385] Buffer I/O error on dev loop6, logical block 1, async page read [ 175.508377][ T7385] Buffer I/O error on dev loop6, logical block 2, async page read [ 175.516211][ T7385] Buffer I/O error on dev loop6, logical block 3, async page read [ 175.524113][ T7385] Buffer I/O error on dev loop6, logical block 0, async page read [ 175.531964][ T7385] Buffer I/O error on dev loop6, logical block 1, async page read [ 175.539839][ T7385] Buffer I/O error on dev loop6, logical block 2, async page read [ 175.547674][ T7385] Buffer I/O error on dev loop6, logical block 3, async page read [ 175.558757][ T7386] Buffer I/O error on dev loop6, logical block 0, async page read [ 175.571712][ T7386] Buffer I/O error on dev loop6, logical block 1, async page read [ 175.613671][ T48] usb 4-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 176.317359][ T48] usb 4-1: failed to fetch extended address, random address set [ 177.678972][ T48] usb 4-1: atusb_probe: initialization failed, error = -524 [ 177.735734][ T48] atusb 4-1:0.0: probe with driver atusb failed with error -524 [ 177.857041][ T7404] loop6: detected capacity change from 0 to 524287999 [ 177.880936][ T48] usb 4-1: USB disconnect, device number 11 [ 178.449869][ T5892] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 178.641496][ T5892] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 178.981699][ T5892] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.258856][ T5892] usb 2-1: config 0 descriptor?? [ 179.529635][ T7403] syz_tun: entered allmulticast mode [ 179.884997][ T7401] syz_tun: left allmulticast mode [ 179.933059][ T5892] ath6kl: Failed to submit usb control message: -71 [ 180.028641][ T7433] /dev/nullb0: Can't open blockdev [ 180.432155][ T7434] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 180.568206][ T5892] ath6kl: unable to send the bmi data to the device: -71 [ 180.714894][ T5892] ath6kl: Unable to send get target info: -71 [ 180.745234][ T5892] ath6kl: Failed to init ath6kl core: -71 [ 180.764370][ T5892] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 180.782233][ T5892] usb 2-1: USB disconnect, device number 9 [ 180.833644][ T7441] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 180.910512][ T30] audit: type=1400 audit(1752016440.923:374): avc: denied { name_bind } for pid=7440 comm="syz.2.311" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 180.969930][ T5900] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 181.151845][ T5900] usb 5-1: Using ep0 maxpacket: 32 [ 181.180101][ T5892] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 181.200670][ T5900] usb 5-1: config 0 has an invalid interface number: 233 but max is 0 [ 181.213818][ T5900] usb 5-1: config 0 has no interface number 0 [ 181.227722][ T5900] usb 5-1: New USB device found, idVendor=1608, idProduct=0302, bcdDevice=d3.4f [ 181.248356][ T5900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.258981][ T5900] usb 5-1: Product: syz [ 181.263436][ T5900] usb 5-1: Manufacturer: syz [ 181.268035][ T5900] usb 5-1: SerialNumber: syz [ 181.269823][ T48] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 181.277832][ T5900] usb 5-1: config 0 descriptor?? [ 181.291472][ T5900] io_ti 5-1:0.233: required endpoints missing [ 181.294533][ T30] audit: type=1400 audit(1752016441.313:375): avc: denied { append } for pid=7452 comm="syz.2.316" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 181.450849][ T5892] usb 2-1: unable to get BOS descriptor or descriptor too short [ 181.455091][ T48] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 181.492282][ T7432] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.500826][ T7432] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.547281][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.572378][ T5892] usb 2-1: config 166 has an invalid interface number: 51 but max is 0 [ 181.584716][ T48] usb 4-1: Product: syz [ 181.601994][ T48] usb 4-1: Manufacturer: syz [ 181.637075][ T48] usb 4-1: SerialNumber: syz [ 181.721008][ T48] usb 4-1: config 0 descriptor?? [ 181.732685][ T5892] usb 2-1: config 166 has no interface number 0 [ 181.766925][ T5892] usb 2-1: config 166 interface 51 has no altsetting 0 [ 181.816774][ T30] audit: type=1400 audit(1752016441.833:376): avc: denied { remount } for pid=7452 comm="syz.2.316" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 181.849672][ T5892] usb 2-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 181.863085][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.875618][ T5892] usb 2-1: Product: syz [ 181.881517][ T5892] usb 2-1: Manufacturer: syz [ 181.887754][ T5892] usb 2-1: SerialNumber: syz [ 182.348733][ T48] usb 4-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 182.945406][ T5949] usb 5-1: USB disconnect, device number 8 [ 183.036417][ T48] usb 4-1: failed to fetch extended address, random address set [ 183.045764][ T30] audit: type=1400 audit(1752016443.063:377): avc: denied { unmount } for pid=5828 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 183.050799][ T48] usb 4-1: atusb_probe: initialization failed, error = -524 [ 183.151674][ T7472] netlink: 'syz.4.318': attribute type 10 has an invalid length. [ 183.167462][ T48] atusb 4-1:0.0: probe with driver atusb failed with error -524 [ 183.173579][ T30] audit: type=1400 audit(1752016443.173:378): avc: denied { accept } for pid=7471 comm="syz.4.318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 183.214102][ T7472] mac80211_hwsim hwsim9 wlan1: left allmulticast mode [ 183.264877][ T48] usb 4-1: USB disconnect, device number 12 [ 183.275662][ T7472] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 183.284394][ T7472] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 184.154776][ T5892] gspca_main: spca500-2.14.0 probing 04a5:300c [ 184.179086][ T5892] usb 2-1: USB disconnect, device number 10 [ 184.718260][ T7499] netlink: 'syz.4.324': attribute type 11 has an invalid length. [ 184.733674][ T7499] netlink: 48 bytes leftover after parsing attributes in process `syz.4.324'. [ 184.802299][ T7502] Cannot find add_set index 0 as target [ 185.279562][ T7497] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 185.290510][ T7497] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 185.313572][ T7497] overlayfs: missing 'lowerdir' [ 185.599965][ T5839] Bluetooth: hci1: command 0x0406 tx timeout [ 185.606017][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 185.686326][ T5846] Bluetooth: hci3: command 0x0406 tx timeout [ 185.692486][ T5839] Bluetooth: hci2: command 0x0406 tx timeout [ 186.977453][ T7525] affs: No valid root block on device nullb0 [ 186.993988][ T5954] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 187.461347][ T5954] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 187.474811][ T5954] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 187.487082][ T5954] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 187.504759][ T5954] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 187.514875][ T5954] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.549909][ T5949] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 187.573330][ T5954] usb 5-1: Product: syz [ 187.592197][ T5954] usb 5-1: Manufacturer: syz [ 187.609921][ T5954] usb 5-1: SerialNumber: syz [ 187.633005][ T5954] usb 5-1: config 0 descriptor?? [ 187.700317][ T7517] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 187.718180][ T7517] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 187.725920][ T5949] usb 3-1: Using ep0 maxpacket: 32 [ 187.732597][ T5954] usb 5-1: ucan: probing device on interface #0 [ 187.743191][ T5949] usb 3-1: config 0 has an invalid interface number: 233 but max is 0 [ 187.752186][ T5949] usb 3-1: config 0 has no interface number 0 [ 187.817594][ T5949] usb 3-1: New USB device found, idVendor=1608, idProduct=0302, bcdDevice=d3.4f [ 187.834905][ T5949] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.170836][ T5949] usb 3-1: Product: syz [ 188.178614][ T5949] usb 3-1: Manufacturer: syz [ 188.184218][ T5949] usb 3-1: SerialNumber: syz [ 188.224569][ T5949] usb 3-1: config 0 descriptor?? [ 188.246873][ T5949] io_ti 3-1:0.233: required endpoints missing [ 188.458448][ T7522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.467082][ T7522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.899873][ T5954] usb 5-1: ucan: could not read protocol version, ret=-110 [ 188.939829][ T5954] usb 5-1: ucan: probe failed; try to update the device firmware [ 189.114739][ T7563] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 189.528519][ T7570] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 189.748209][ T5949] usb 3-1: USB disconnect, device number 13 [ 190.024825][ T7577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.338'. [ 190.049907][ T7577] netlink: 40 bytes leftover after parsing attributes in process `syz.3.338'. [ 190.335532][ T5892] usb 5-1: USB disconnect, device number 9 [ 190.402448][ T5918] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 190.574747][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 190.991096][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 191.310859][ T30] audit: type=1400 audit(1752016451.313:379): avc: denied { create } for pid=7589 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 191.319845][ T5918] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 191.339197][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.353532][ T5918] usb 1-1: config 0 descriptor?? [ 191.365917][ T30] audit: type=1400 audit(1752016451.313:380): avc: denied { setopt } for pid=7589 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 191.555296][ T30] audit: type=1400 audit(1752016451.553:381): avc: denied { bind } for pid=7589 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 191.753655][ T5918] ath6kl: Failed to submit usb control message: -71 [ 191.877731][ T5918] ath6kl: unable to send the bmi data to the device: -71 [ 191.885074][ T30] audit: type=1400 audit(1752016451.553:382): avc: denied { create } for pid=7603 comm="syz.4.344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 192.006499][ T5918] ath6kl: Unable to send get target info: -71 [ 192.134331][ T5918] ath6kl: Failed to init ath6kl core: -71 [ 192.177992][ T30] audit: type=1400 audit(1752016451.553:383): avc: denied { setopt } for pid=7603 comm="syz.4.344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 192.197375][ C1] vkms_vblank_simulate: vblank timer overrun [ 192.263269][ T5918] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 192.458708][ T5918] usb 1-1: USB disconnect, device number 14 [ 192.652880][ T7618] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 193.785422][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.805656][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.946256][ T7631] netlink: 60 bytes leftover after parsing attributes in process `syz.2.349'. [ 194.232691][ T7633] netlink: 156 bytes leftover after parsing attributes in process `syz.4.350'. [ 194.511074][ T7638] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 194.560022][ T10] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 194.837629][ T10] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 194.872138][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.888566][ T10] usb 1-1: Product: syz [ 194.896559][ T10] usb 1-1: Manufacturer: syz [ 194.901353][ T10] usb 1-1: SerialNumber: syz [ 195.308295][ T10] usb 1-1: config 0 descriptor?? [ 195.959341][ T7648] netlink: 'syz.2.356': attribute type 1 has an invalid length. [ 196.781138][ T10] usb 1-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 197.098309][ T5918] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 197.239814][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 197.272839][ T5918] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 197.272865][ T5918] usb 2-1: config 0 has no interface number 0 [ 197.272899][ T5918] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has an invalid bInterval 60, changing to 7 [ 197.272924][ T5918] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid maxpacket 42777, setting to 1024 [ 197.338721][ T5918] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 197.338746][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.338764][ T5918] usb 2-1: Product: syz [ 197.338777][ T5918] usb 2-1: Manufacturer: syz [ 197.338789][ T5918] usb 2-1: SerialNumber: syz [ 197.341035][ T5918] usb 2-1: config 0 descriptor?? [ 197.660817][ T5918] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 197.671208][ T5918] em28xx 2-1:0.132: Video interface 132 found: isoc [ 197.846874][ T10] usb 1-1: failed to fetch extended address, random address set [ 197.865497][ T10] usb 1-1: atusb_probe: initialization failed, error = -524 [ 197.865919][ T7657] netlink: 60 bytes leftover after parsing attributes in process `syz.1.357'. [ 197.873538][ T10] atusb 1-1:0.0: probe with driver atusb failed with error -524 [ 198.519162][ T10] usb 1-1: USB disconnect, device number 15 [ 198.529532][ T7657] fuse: Bad value for 'group_id' [ 198.583738][ T7657] fuse: Bad value for 'group_id' [ 198.922240][ T5918] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 199.453619][ T5918] em28xx 2-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 199.726384][ T5918] em28xx 2-1:0.132: board has no eeprom [ 199.799832][ T5918] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 199.894174][ T5918] em28xx 2-1:0.132: analog set to isoc mode. [ 199.900875][ T5954] em28xx 2-1:0.132: Registering V4L2 extension [ 199.919786][ T30] audit: type=1400 audit(1752016459.933:384): avc: denied { mount } for pid=7684 comm="syz.2.364" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 200.009931][ T5892] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 200.032628][ T7690] syz.3.365: attempt to access beyond end of device [ 200.032628][ T7690] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 200.079260][ T5954] em28xx 2-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 200.089009][ T5954] em28xx 2-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 200.098833][ T5954] em28xx 2-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 200.120163][ T5918] usb 2-1: USB disconnect, device number 11 [ 200.127270][ T5918] em28xx 2-1:0.132: Disconnecting em28xx [ 200.200655][ T5892] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 200.210058][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.267101][ T5892] usb 1-1: config 0 descriptor?? [ 200.307882][ T30] audit: type=1400 audit(1752016460.323:385): avc: denied { ioctl } for pid=7696 comm="syz.2.367" path="socket:[14509]" dev="sockfs" ino=14509 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 200.333132][ C0] vkms_vblank_simulate: vblank timer overrun [ 200.604935][ T7683] syz_tun: entered allmulticast mode [ 201.226398][ T5954] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 201.235598][ T5954] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 201.249050][ T5954] em28xx 2-1:0.132: No AC97 audio processor [ 201.394075][ T5954] usb 2-1: Decoder not found [ 201.398710][ T5954] em28xx 2-1:0.132: failed to create media graph [ 201.416863][ T7682] syz_tun: left allmulticast mode [ 201.575209][ T5900] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 201.593440][ T5892] ath6kl: Failed to submit usb control message: -71 [ 201.612364][ T5954] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 201.618826][ T5892] ath6kl: unable to send the bmi data to the device: -71 [ 201.626516][ T5954] em28xx 2-1:0.132: Remote control support is not available for this card. [ 201.662554][ T5892] ath6kl: Unable to send get target info: -71 [ 201.691600][ T5918] em28xx 2-1:0.132: Closing input extension [ 201.709985][ T5892] ath6kl: Failed to init ath6kl core: -71 [ 201.726836][ T5918] em28xx 2-1:0.132: Freeing device [ 201.727849][ T5892] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 201.782914][ T5900] usb 3-1: Using ep0 maxpacket: 8 [ 201.919113][ T7723] netlink: 4 bytes leftover after parsing attributes in process `syz.3.372'. [ 201.970254][ T7723] netlink: 40 bytes leftover after parsing attributes in process `syz.3.372'. [ 202.085168][ T5900] usb 3-1: config 0 interface 0 has no altsetting 0 [ 202.096981][ T5892] usb 1-1: USB disconnect, device number 16 [ 202.105271][ T5900] usb 3-1: New USB device found, idVendor=20a0, idProduct=4287, bcdDevice= 0.00 [ 202.131782][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.171622][ T5900] usb 3-1: config 0 descriptor?? [ 202.961180][ T5900] hid-u2fzero 0003:20A0:4287.0004: hidraw0: USB HID v0.03 Device [HID 20a0:4287] on usb-dummy_hcd.2-1/input0 [ 202.981344][ T5892] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 203.061138][ T5900] hid-u2fzero 0003:20A0:4287.0004: NitroKey U2F LED initialised [ 203.098654][ T5900] hid-u2fzero 0003:20A0:4287.0004: NitroKey U2F RNG initialised [ 203.614705][ T7743] nfs: Unknown parameter 'TIPCv2' [ 203.651290][ T7743] syz.1.375: attempt to access beyond end of device [ 203.651290][ T7743] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 204.034178][ T5892] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 204.052091][ T5900] usb 3-1: USB disconnect, device number 14 [ 204.095287][ T5892] usb 1-1: config 0 has no interfaces? [ 204.111100][ T5892] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 204.144294][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.334949][ T5892] usb 1-1: config 0 descriptor?? [ 204.791323][ T7760] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 205.340476][ T7762] Cannot find add_set index 0 as target [ 205.813907][ T30] audit: type=1400 audit(1752016465.833:386): avc: denied { write } for pid=7764 comm="syz.1.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 206.051943][ T7775] netlink: 156 bytes leftover after parsing attributes in process `syz.3.383'. [ 206.130014][ T5954] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 206.430557][ T5954] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 206.506914][ T5954] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.579822][ T7781] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 206.730209][ T5954] usb 3-1: config 0 descriptor?? [ 206.824114][ T5892] usb 1-1: USB disconnect, device number 17 [ 206.929588][ T30] audit: type=1400 audit(1752016466.943:387): avc: denied { setattr } for pid=7785 comm="syz.1.389" name="anycast6" dev="proc" ino=4026532992 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 207.252621][ T5954] ath6kl: Failed to submit usb control message: -71 [ 207.308449][ T5954] ath6kl: unable to send the bmi data to the device: -71 [ 207.370608][ T5892] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 207.374309][ T5954] ath6kl: Unable to send get target info: -71 [ 207.518447][ T5954] ath6kl: Failed to init ath6kl core: -71 [ 207.545417][ T5954] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 207.617629][ T5954] usb 3-1: USB disconnect, device number 15 [ 207.665800][ T5892] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 207.716701][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.775156][ T5892] usb 1-1: Product: syz [ 207.797836][ T5892] usb 1-1: Manufacturer: syz [ 207.804286][ T5892] usb 1-1: SerialNumber: syz [ 207.843416][ T5892] usb 1-1: config 0 descriptor?? [ 207.913742][ T30] audit: type=1400 audit(1752016467.923:388): avc: denied { ioctl } for pid=7807 comm="syz.4.393" path="/dev/input/event2" dev="devtmpfs" ino=922 ioctlcmd=0x4591 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 207.979276][ T5900] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 208.002753][ T30] audit: type=1400 audit(1752016467.983:389): avc: denied { create } for pid=7814 comm="syz.2.395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 208.245399][ T7825] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 208.300337][ T5892] usb 1-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 208.369117][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 208.454898][ T7829] netlink: 160 bytes leftover after parsing attributes in process `syz.3.396'. [ 208.464019][ T5900] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 208.488765][ T5892] usb 1-1: failed to fetch extended address, random address set [ 208.522299][ T5892] usb 1-1: atusb_probe: initialization failed, error = -524 [ 208.529679][ T5892] atusb 1-1:0.0: probe with driver atusb failed with error -524 [ 208.537381][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 208.577500][ T5900] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 208.599934][ T5900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.607951][ T5900] usb 2-1: Product: syz [ 208.652646][ T5900] usb 2-1: Manufacturer: syz [ 208.666409][ T5900] usb 2-1: SerialNumber: syz [ 208.681109][ T5900] usb 2-1: config 0 descriptor?? [ 208.691543][ T7802] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 208.698887][ T7802] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 208.721056][ T5900] usb 2-1: ucan: probing device on interface #0 [ 208.737737][ T5892] usb 1-1: USB disconnect, device number 18 [ 209.941809][ T5900] usb 2-1: ucan: could not read protocol version, ret=-110 [ 209.949048][ T5900] usb 2-1: ucan: probe failed; try to update the device firmware [ 210.178078][ T7851] capability: warning: `syz.0.403' uses deprecated v2 capabilities in a way that may be insecure [ 210.371394][ T5949] usb 2-1: USB disconnect, device number 12 [ 210.515291][ T7859] netlink: 156 bytes leftover after parsing attributes in process `syz.2.404'. [ 210.540087][ T5900] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 210.679812][ T5954] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 210.699933][ T5900] usb 1-1: Using ep0 maxpacket: 16 [ 210.709278][ T5900] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.734119][ T5900] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 210.744079][ T5900] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 210.754912][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.768975][ T5900] usb 1-1: config 0 descriptor?? [ 210.841201][ T5954] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 210.850471][ T5954] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.865405][ T5954] usb 5-1: config 0 descriptor?? [ 211.280935][ T5842] Bluetooth: hci5: command 0x1003 tx timeout [ 211.282097][ T5845] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 211.359827][ T5954] ath6kl: Failed to submit usb control message: -71 [ 211.370364][ T5954] ath6kl: unable to send the bmi data to the device: -71 [ 211.381469][ T5954] ath6kl: Unable to send get target info: -71 [ 211.629151][ T5954] ath6kl: Failed to init ath6kl core: -71 [ 211.651594][ T5954] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 211.800590][ T5954] usb 5-1: USB disconnect, device number 10 [ 211.915768][ T7875] nfs: Unknown parameter 'acPCv2' [ 211.925048][ T7875] syz.2.408: attempt to access beyond end of device [ 211.925048][ T7875] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 212.251571][ T5900] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 212.283638][ T7876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.427455][ T7876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.511539][ T7876] openvswitch: netlink: Duplicate or invalid key (type 0). [ 212.668012][ T7876] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 213.004606][ T5900] usb 2-1: Using ep0 maxpacket: 16 [ 213.018583][ T5900] usb 2-1: unable to get BOS descriptor or descriptor too short [ 213.480442][ T5900] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 213.495270][ T5900] usb 2-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 213.508643][ T5900] usb 2-1: config 1 interface 0 has no altsetting 0 [ 213.575486][ T5900] usb 2-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 213.626068][ T30] audit: type=1400 audit(1752016473.633:390): avc: denied { read write } for pid=7892 comm="syz.3.414" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 213.627467][ T5900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.649096][ C0] vkms_vblank_simulate: vblank timer overrun [ 213.690825][ T5900] usb 2-1: Product: syz [ 213.695094][ T5900] usb 2-1: Manufacturer: syz [ 213.712360][ T5900] usb 2-1: SerialNumber: syz [ 213.740369][ T30] audit: type=1400 audit(1752016473.633:391): avc: denied { open } for pid=7892 comm="syz.3.414" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 213.870248][ T30] audit: type=1400 audit(1752016473.643:392): avc: denied { ioctl } for pid=7892 comm="syz.3.414" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 213.971303][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 213.980183][ T30] audit: type=1400 audit(1752016473.743:393): avc: denied { create } for pid=7892 comm="syz.3.414" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 214.153574][ T9] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 214.166213][ T30] audit: type=1400 audit(1752016473.743:394): avc: denied { unlink } for pid=7892 comm="syz.3.414" name="file0" dev="tmpfs" ino=476 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 214.194756][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.215992][ T5892] usb 1-1: USB disconnect, device number 19 [ 214.257648][ T9] usb 3-1: Product: syz [ 214.295765][ T9] usb 3-1: Manufacturer: syz [ 214.322079][ T9] usb 3-1: SerialNumber: syz [ 214.395189][ T30] audit: type=1400 audit(1752016473.943:395): avc: denied { setopt } for pid=7900 comm="syz.3.417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 214.420032][ T9] usb 3-1: config 0 descriptor?? [ 214.462010][ T30] audit: type=1400 audit(1752016474.463:396): avc: denied { map } for pid=7894 comm="syz.4.415" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 214.876473][ T9] usb 3-1: Firmware: major: 73, minor: 252, hardware type: UNKNOWN (62) [ 214.949823][ T5918] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 215.090989][ T9] usb 3-1: failed to fetch extended address, random address set [ 215.123612][ T5918] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 215.146413][ T9] usb 3-1: atusb_probe: initialization failed, error = -524 [ 215.150290][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.165506][ T9] atusb 3-1:0.0: probe with driver atusb failed with error -524 [ 215.197263][ T5918] usb 1-1: config 0 descriptor?? [ 215.313172][ T5954] usb 3-1: USB disconnect, device number 16 [ 215.409543][ T7916] loop6: detected capacity change from 0 to 63 [ 215.423214][ T5830] buffer_io_error: 16366 callbacks suppressed [ 215.423224][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.438522][ T7910] syz_tun: entered allmulticast mode [ 215.476007][ T7916] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.484875][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.504999][ T7917] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.517330][ T7916] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.527093][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.549836][ T7917] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.558886][ T5830] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.570321][ T7916] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.579173][ T7916] Buffer I/O error on dev loop6, logical block 0, async page read [ 215.653840][ T7909] syz_tun: left allmulticast mode [ 215.668623][ T5918] ath6kl: Failed to submit usb control message: -71 [ 215.711005][ T5918] ath6kl: unable to send the bmi data to the device: -71 [ 215.715382][ T5900] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 215.729443][ T5900] usb 2-1: USB disconnect, device number 13 [ 215.749848][ T5918] ath6kl: Unable to send get target info: -71 [ 215.762227][ T5918] ath6kl: Failed to init ath6kl core: -71 [ 215.777034][ T5918] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 215.839291][ T5918] usb 1-1: USB disconnect, device number 20 [ 216.029935][ T7923] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 216.382709][ T5918] IPVS: starting estimator thread 0... [ 216.500536][ T7926] IPVS: using max 50 ests per chain, 120000 per kthread [ 216.521015][ T7928] netlink: 8 bytes leftover after parsing attributes in process `syz.3.426'. [ 216.529822][ T7928] netlink: 8 bytes leftover after parsing attributes in process `syz.3.426'. [ 216.556307][ T30] audit: type=1400 audit(1752016476.563:397): avc: denied { remount } for pid=7927 comm="syz.3.426" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 216.839583][ T5900] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 216.925167][ T7932] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 216.999882][ T5900] usb 2-1: Using ep0 maxpacket: 8 [ 217.006540][ T5900] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 217.109064][ T5900] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 217.143353][ T5900] usb 2-1: config 0 has no interface number 0 [ 217.590216][ T5900] usb 2-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 217.602272][ T5900] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 217.622596][ T5900] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 217.744348][ T30] audit: type=1400 audit(1752016477.663:398): avc: denied { ioctl } for pid=7947 comm="syz.3.432" path="socket:[16422]" dev="sockfs" ino=16422 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 217.747787][ T5900] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 217.954260][ T5900] usb 2-1: New USB device strings: Mfr=31, Product=1, SerialNumber=0 [ 217.964139][ T5900] usb 2-1: Product: syz [ 217.968348][ T5900] usb 2-1: Manufacturer: syz [ 217.981161][ T5900] usb 2-1: config 0 descriptor?? [ 217.987617][ T7919] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 218.883830][ T30] audit: type=1400 audit(1752016478.903:399): avc: denied { name_bind } for pid=7956 comm="syz.2.435" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 218.909940][ T7919] tipc: Started in network mode [ 218.914939][ T7919] tipc: Node identity ac1414aa, cluster identity 4711 [ 219.218570][ T7919] tipc: Enabled bearer , priority 10 [ 219.294653][ T5900] usb 2-1: USB disconnect, device number 14 [ 219.824541][ T7976] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 219.846300][ T5918] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 220.212200][ T5918] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 220.221675][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.233153][ T5918] usb 1-1: config 0 descriptor?? [ 220.372822][ T5949] tipc: Node number set to 2886997162 [ 220.441914][ T7967] syz_tun: entered allmulticast mode [ 220.525736][ T7992] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 220.781160][ T7966] syz_tun: left allmulticast mode [ 220.904440][ T5918] ath6kl: Failed to submit usb control message: -71 [ 220.913830][ T5918] ath6kl: unable to send the bmi data to the device: -71 [ 220.921047][ T5918] ath6kl: Unable to send get target info: -71 [ 221.366486][ T5918] ath6kl: Failed to init ath6kl core: -71 [ 221.381088][ T5918] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 221.405925][ T5918] usb 1-1: USB disconnect, device number 21 [ 222.932536][ T8018] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 223.984071][ T8035] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 224.657409][ T8040] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=8040 comm=syz.0.461 [ 224.693338][ T8040] netlink: 53 bytes leftover after parsing attributes in process `syz.0.461'. [ 225.049961][ T5954] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 225.233400][ T5954] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 225.305097][ T5954] usb 1-1: config 0 interface 0 has no altsetting 0 [ 225.391121][ T5954] usb 1-1: New USB device found, idVendor=0471, idProduct=0308, bcdDevice=e4.df [ 225.482747][ T5954] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.545553][ T5954] usb 1-1: config 0 descriptor?? [ 225.707508][ T5954] pwc: Philips PCVC680K (Vesta Pro) USB webcam detected. [ 225.943500][ T30] audit: type=1400 audit(1752016485.873:400): avc: denied { mount } for pid=8053 comm="syz.3.465" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 226.616687][ T8063] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 227.867959][ T5954] pwc: send_video_command error -71 [ 227.903443][ T5954] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 227.945730][ T8085] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 227.952985][ T8085] IPv6: NLM_F_CREATE should be set when creating new route [ 227.992369][ T8083] tty tty3: ldisc open failed (-12), clearing slot 2 [ 228.054893][ T5954] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 228.059554][ T8088] lo: entered allmulticast mode [ 228.067292][ T5954] usb 1-1: USB disconnect, device number 22 [ 228.109528][ T8088] tunl0: entered allmulticast mode [ 228.147798][ T8088] gre0: entered allmulticast mode [ 228.170237][ T8088] gretap0: entered allmulticast mode [ 228.241387][ T8088] erspan0: entered allmulticast mode [ 228.269664][ T8088] ip_vti0: entered allmulticast mode [ 228.286388][ T8088] ip6_vti0: entered allmulticast mode [ 228.309441][ T8088] sit0: entered allmulticast mode [ 228.409870][ T8097] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 228.490153][ T5954] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 228.493641][ T8088] ip6tnl0: entered allmulticast mode [ 228.665772][ T8088] ip6gre0: entered allmulticast mode [ 228.706855][ T8088] syz_tun: entered allmulticast mode [ 228.732971][ T8088] ip6gretap0: entered allmulticast mode [ 228.804338][ T5954] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 228.814711][ T5954] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.834743][ T8088] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.842149][ T8088] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.851238][ T5954] usb 1-1: config 0 descriptor?? [ 228.860855][ T1320] Bluetooth: hci5: Frame reassembly failed (-84) [ 228.926169][ T8088] bridge0: entered allmulticast mode [ 228.979385][ T8088] vcan0: entered allmulticast mode [ 229.181769][ T8088] bond0: entered allmulticast mode [ 229.304645][ T8088] bond_slave_0: entered allmulticast mode [ 229.311803][ T8088] bond_slave_1: entered allmulticast mode [ 229.323625][ T8088] team0: entered allmulticast mode [ 229.328820][ T8088] team_slave_0: entered allmulticast mode [ 229.335090][ T8088] team_slave_1: entered allmulticast mode [ 229.343793][ T8088] dummy0: entered allmulticast mode [ 229.352113][ T8088] nlmon0: entered allmulticast mode [ 229.358369][ T8088] caif0: entered allmulticast mode [ 229.364171][ T8088] batadv0: entered allmulticast mode [ 229.371636][ T8088] vxcan0: entered allmulticast mode [ 229.377572][ T8088] vxcan1: entered allmulticast mode [ 229.386631][ T8088] veth0: entered allmulticast mode [ 229.395235][ T8088] veth1: entered allmulticast mode [ 229.403124][ T8088] wg0: entered allmulticast mode [ 229.410139][ T8088] wg1: entered allmulticast mode [ 229.416807][ T8088] wg2: entered allmulticast mode [ 229.423275][ T8088] veth0_to_bridge: entered allmulticast mode [ 229.433257][ T8088] veth1_to_bridge: entered allmulticast mode [ 229.445356][ T8088] veth0_to_bond: entered allmulticast mode [ 229.454397][ T8088] veth1_to_bond: entered allmulticast mode [ 229.463995][ T8088] veth0_to_team: entered allmulticast mode [ 229.473327][ T8088] veth1_to_team: entered allmulticast mode [ 229.482959][ T8088] veth0_to_batadv: entered allmulticast mode [ 229.491499][ T8088] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 229.499179][ T8088] batadv_slave_0: entered allmulticast mode [ 229.509052][ T8088] veth1_to_batadv: entered allmulticast mode [ 229.517344][ T8088] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 229.525298][ T8088] batadv_slave_1: entered allmulticast mode [ 229.533340][ T8088] xfrm0: entered allmulticast mode [ 229.540363][ T8088] veth0_to_hsr: entered allmulticast mode [ 229.548398][ T8088] hsr_slave_0: entered allmulticast mode [ 229.555783][ T8088] veth1_to_hsr: entered allmulticast mode [ 229.563602][ T8088] hsr_slave_1: entered allmulticast mode [ 229.571036][ T8088] hsr0: entered allmulticast mode [ 229.577907][ T8088] veth1_virt_wifi: entered allmulticast mode [ 229.586730][ T8088] veth0_virt_wifi: entered allmulticast mode [ 229.594379][ T8088] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 229.602934][ T8088] veth1_vlan: entered allmulticast mode [ 229.610615][ T8088] veth0_vlan: entered allmulticast mode [ 229.624189][ T8088] vlan0: entered allmulticast mode [ 229.629404][ T8088] vlan1: entered allmulticast mode [ 229.635283][ T8088] macvlan0: entered allmulticast mode [ 229.644712][ T8088] macvlan1: entered allmulticast mode [ 229.653408][ T8088] ipvlan0: entered allmulticast mode [ 229.658937][ T8088] ipvlan1: entered allmulticast mode [ 229.665100][ T8088] veth1_macvtap: entered allmulticast mode [ 229.673584][ T8088] veth0_macvtap: entered allmulticast mode [ 229.682347][ T8088] macvtap0: entered allmulticast mode [ 229.690261][ T8088] macsec0: entered allmulticast mode [ 229.698406][ T8088] geneve0: entered allmulticast mode [ 229.706128][ T8088] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.717167][ T8088] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.727647][ T8088] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.737312][ T8088] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.746526][ T8088] geneve1: entered allmulticast mode [ 229.755513][ T8088] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 229.765347][ T8088] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 229.775137][ T8088] netdevsim netdevsim1 netdevsim2: entered allmulticast mode [ 229.784029][ T8088] netdevsim netdevsim1 netdevsim3: entered allmulticast mode [ 229.800590][ T8088] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 229.814746][ T8088] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 229.823065][ T8088] geneve2: entered allmulticast mode [ 229.878941][ T5954] ath6kl: Failed to submit usb control message: -71 [ 229.892702][ T5954] ath6kl: unable to send the bmi data to the device: -71 [ 229.909064][ T5954] ath6kl: Unable to send get target info: -71 [ 229.919672][ T5954] ath6kl: Failed to init ath6kl core: -71 [ 229.931836][ T5954] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 230.136581][ T5954] usb 1-1: USB disconnect, device number 23 [ 230.881920][ T5842] Bluetooth: hci5: command 0x1003 tx timeout [ 230.886484][ T5845] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 231.407513][ T8137] affs: No valid root block on device nullb0 [ 231.659857][ T5954] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 232.727219][ T8143] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 232.743746][ T5954] usb 3-1: Using ep0 maxpacket: 32 [ 232.783802][ T5954] usb 3-1: config 0 has an invalid interface number: 233 but max is 0 [ 232.798812][ T8149] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 232.814942][ T5954] usb 3-1: config 0 has no interface number 0 [ 232.855226][ T5954] usb 3-1: New USB device found, idVendor=1608, idProduct=0302, bcdDevice=d3.4f [ 232.864349][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.872740][ T5954] usb 3-1: Product: syz [ 232.891665][ T5954] usb 3-1: Manufacturer: syz [ 232.896366][ T5954] usb 3-1: SerialNumber: syz [ 232.910520][ T5954] usb 3-1: config 0 descriptor?? [ 232.925082][ T5954] io_ti 3-1:0.233: required endpoints missing [ 233.165061][ T8135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.173860][ T8135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.221361][ T8162] netlink: 156 bytes leftover after parsing attributes in process `syz.0.494'. [ 234.205355][ T5954] usb 3-1: USB disconnect, device number 17 [ 235.527099][ T8184] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 236.169835][ T5842] Bluetooth: hci4: command 0x0405 tx timeout [ 236.279035][ T8194] netlink: 'syz.4.506': attribute type 1 has an invalid length. [ 236.451384][ T8199] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 237.441729][ T8210] syz.1.511 uses obsolete (PF_INET,SOCK_PACKET) [ 238.529905][ T5918] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 239.121537][ T8217] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 239.280352][ T48] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 239.304621][ T5918] usb 2-1: Using ep0 maxpacket: 16 [ 239.342014][ T5918] usb 2-1: config 1 has an invalid descriptor of length 106, skipping remainder of the config [ 239.373043][ T5918] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 239.400465][ T5918] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 239.489934][ T5918] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 239.504750][ T48] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 239.546242][ T48] usb 1-1: config 0 has no interface number 0 [ 239.558155][ T5918] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 239.583800][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.680728][ T8225] overlayfs: failed to resolve './file0': -2 [ 239.728831][ T5918] usb 2-1: Product: syz [ 239.733879][ T48] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 239.741596][ T8227] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 239.743153][ T48] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.759016][ T5918] usb 2-1: Manufacturer: syz [ 239.763736][ T5918] usb 2-1: SerialNumber: syz [ 239.891300][ T48] usb 1-1: Product: syz [ 240.029456][ T48] usb 1-1: Manufacturer: syz [ 240.037409][ T48] usb 1-1: SerialNumber: syz [ 240.044665][ T48] usb 1-1: config 0 descriptor?? [ 240.410921][ T48] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in cold state [ 240.431506][ T48] usb 1-1: Direct firmware load for dvb-usb-ec168.fw failed with error -2 [ 240.453180][ T30] audit: type=1400 audit(1752016500.463:401): avc: denied { watch watch_reads } for pid=8207 comm="syz.1.511" path="/93/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 240.476092][ C1] vkms_vblank_simulate: vblank timer overrun [ 240.482664][ T48] usb 1-1: Falling back to sysfs fallback for: dvb-usb-ec168.fw [ 240.499306][ T5918] usb 2-1: 0:2 : does not exist [ 240.618345][ T12] Bluetooth: hci5: Frame reassembly failed (-84) [ 240.627826][ T12] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 240.642267][ T5918] usb 2-1: USB disconnect, device number 15 [ 241.801177][ T30] audit: type=1400 audit(1752016501.043:402): avc: denied { sqpoll } for pid=8242 comm="syz.3.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 242.097146][ T8255] loop6: detected capacity change from 0 to 63 [ 242.138710][ T6002] buffer_io_error: 1221 callbacks suppressed [ 242.138729][ T6002] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.295337][ T6002] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.315526][ T6002] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.640649][ T5845] Bluetooth: hci5: command 0x1003 tx timeout [ 242.646992][ T5842] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 242.816485][ T6002] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.852632][ T8263] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.870497][ T8263] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.884768][ T8255] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.916164][ T6002] Buffer I/O error on dev loop6, logical block 0, async page read [ 243.097436][ T8271] x_tables: duplicate underflow at hook 3 [ 243.800600][ T8267] Buffer I/O error on dev loop6, logical block 0, async page read [ 244.079817][ T5954] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 244.242053][ T5954] usb 5-1: Using ep0 maxpacket: 8 [ 244.258656][ T5954] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.299831][ T5954] usb 5-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 244.308912][ T5954] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.358177][ T5954] usb 5-1: config 0 descriptor?? [ 244.369810][ T5949] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 244.521067][ T5949] usb 2-1: Using ep0 maxpacket: 16 [ 244.533235][ T5949] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 244.572603][ T5949] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 244.634443][ T5954] usb 5-1: USB disconnect, device number 11 [ 245.006779][ T5949] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 245.024317][ T5949] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 245.260406][ T5949] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.266346][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 245.279050][ T5949] usb 2-1: Product: syz [ 245.289872][ T5949] usb 2-1: Manufacturer: syz [ 245.294478][ T5949] usb 2-1: SerialNumber: syz [ 245.392106][ T8307] ref_ctr_offset mismatch. inode: 0x236 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x6 [ 245.446495][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 245.599949][ T9] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 245.706726][ T30] audit: type=1400 audit(1752016505.723:403): avc: denied { ioctl } for pid=8305 comm="syz.4.541" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 245.719793][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 245.799839][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 245.830319][ T5949] usb 2-1: 0:2 : does not exist [ 245.830431][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 245.854421][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.880297][ T9] usb 3-1: Product: syz [ 245.887659][ T9] usb 3-1: Manufacturer: syz [ 245.904531][ T9] usb 3-1: SerialNumber: syz [ 245.995203][ T30] audit: type=1400 audit(1752016506.013:404): avc: denied { bind } for pid=8312 comm="syz.3.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 246.785580][ T5949] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 246.796072][ T30] audit: type=1400 audit(1752016506.803:405): avc: denied { bind } for pid=8321 comm="syz.4.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 246.836898][ T30] audit: type=1400 audit(1752016506.803:406): avc: denied { listen } for pid=8321 comm="syz.4.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 247.453794][ T30] audit: type=1400 audit(1752016507.113:407): avc: denied { connect } for pid=8321 comm="syz.4.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 247.510191][ T9] usb 3-1: 0:2 : does not exist [ 247.531424][ T5949] usb 2-1: USB disconnect, device number 16 [ 247.714188][ T30] audit: type=1400 audit(1752016507.113:408): avc: denied { accept } for pid=8321 comm="syz.4.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 247.920451][ T9] usb 3-1: 1:0: cannot get min/max values for control 4 (id 1) [ 247.997252][ T9] usb 3-1: USB disconnect, device number 18 [ 248.280549][ T30] audit: type=1400 audit(1752016508.233:409): avc: denied { bind } for pid=8333 comm="syz.3.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 248.820517][ T6002] udevd[6002]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 248.872106][ T5900] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 249.031799][ T5900] usb 2-1: unable to get BOS descriptor or descriptor too short [ 249.050798][ T5900] usb 2-1: config 166 has an invalid interface number: 51 but max is 0 [ 249.059208][ T5900] usb 2-1: config 166 has no interface number 0 [ 249.080412][ T5900] usb 2-1: config 166 interface 51 has no altsetting 0 [ 249.100125][ T5900] usb 2-1: New USB device found, idVendor=04a5, idProduct=300c, bcdDevice=a8.c9 [ 249.119592][ T5900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.143218][ T5900] usb 2-1: Product: syz [ 249.147391][ T5900] usb 2-1: Manufacturer: syz [ 249.163376][ T5900] usb 2-1: SerialNumber: syz [ 249.398456][ T30] audit: type=1400 audit(1752016509.343:410): avc: denied { search } for pid=8345 comm="syz.2.551" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 249.420070][ C1] vkms_vblank_simulate: vblank timer overrun [ 249.912198][ T30] audit: type=1400 audit(1752016509.343:411): avc: denied { search } for pid=8345 comm="syz.2.551" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 249.935237][ T30] audit: type=1400 audit(1752016509.343:412): avc: denied { search } for pid=8345 comm="syz.2.551" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 249.956765][ C1] vkms_vblank_simulate: vblank timer overrun [ 250.234261][ T8364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.557'. [ 250.408582][ T8364] netlink: 40 bytes leftover after parsing attributes in process `syz.3.557'. [ 250.733530][ T5949] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 250.916963][ T5949] usb 3-1: config 0 has an invalid interface number: 11 but max is 0 [ 250.944987][ T5949] usb 3-1: config 0 has no interface number 0 [ 250.968799][ T5949] usb 3-1: config 0 interface 11 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8 [ 251.003922][ T5949] usb 3-1: config 0 interface 11 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 251.160108][ T5949] usb 3-1: config 0 interface 11 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 1024 [ 251.174200][ T5949] usb 3-1: New USB device found, idVendor=0f3d, idProduct=68aa, bcdDevice=b4.ca [ 251.183330][ T5949] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.191762][ T5949] usb 3-1: Product: syz [ 251.196982][ T5949] usb 3-1: Manufacturer: syz [ 251.208639][ T5949] usb 3-1: SerialNumber: syz [ 251.225085][ T5949] usb 3-1: config 0 descriptor?? [ 251.275701][ T8366] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 251.324113][ T8366] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 252.063591][ T8395] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 252.074197][ T8395] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 252.837379][ T5949] sierra_net 3-1:0.11 wwan0: register 'sierra_net' at usb-dummy_hcd.2-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:0b [ 252.851381][ T5949] ------------[ cut here ]------------ [ 252.856859][ T5949] WARNING: CPU: 1 PID: 5949 at drivers/net/usb/usbnet.c:266 usbnet_status_start+0x189/0x1e0 [ 252.867112][ T5949] Modules linked in: [ 252.871221][ T5949] CPU: 1 UID: 0 PID: 5949 Comm: kworker/1:6 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 252.883426][ T5949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 252.893697][ T5949] Workqueue: usb_hub_wq hub_event [ 252.898933][ T5949] RIP: 0010:usbnet_status_start+0x189/0x1e0 [ 252.904870][ T5949] Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 4e 48 8b bb 70 03 00 00 89 ee e8 b5 5e 1a 00 41 89 c5 e9 36 ff ff ff e8 28 b8 a0 fa 90 <0f> 0b 90 45 31 ed e9 39 ff ff ff 4c 89 ff e8 b4 93 07 fb e9 e9 fe [ 252.924586][ T5949] RSP: 0018:ffffc900046af090 EFLAGS: 00010283 [ 252.930682][ T5949] RAX: 000000000006dc79 RBX: ffff888073d40d80 RCX: ffffc9001a6c1000 [ 252.938658][ T5949] RDX: 0000000000100000 RSI: ffffffff871b3e88 RDI: ffff888073d40d80 [ 252.946674][ T5949] RBP: 0000000000000cc0 R08: 0000000000000005 R09: 0000000000000000 [ 252.954691][ T5949] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888073d410f0 [ 252.962973][ T5949] R13: ffffffff8f8d9e90 R14: ffff8880271a8028 R15: ffff8880271a8024 [ 252.970971][ T5949] FS: 0000000000000000(0000) GS:ffff888124816000(0000) knlGS:0000000000000000 [ 252.979941][ T5949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 252.986530][ T5949] CR2: 0000200000032000 CR3: 000000005ca83000 CR4: 00000000003526f0 [ 252.994709][ T5949] Call Trace: [ 252.997999][ T5949] [ 253.001098][ T5949] sierra_net_probe+0x70/0xb0 [ 253.005790][ T5949] usb_probe_interface+0x303/0x9c0 [ 253.010986][ T5949] ? __pfx_usb_probe_interface+0x10/0x10 [ 253.016631][ T5949] really_probe+0x23e/0xa90 [ 253.021151][ T5949] __driver_probe_device+0x1de/0x440 [ 253.026471][ T5949] driver_probe_device+0x4c/0x1b0 [ 253.031518][ T5949] __device_attach_driver+0x1df/0x310 [ 253.036887][ T5949] ? __pfx___device_attach_driver+0x10/0x10 [ 253.042817][ T5949] bus_for_each_drv+0x156/0x1e0 [ 253.047665][ T5949] ? __pfx_bus_for_each_drv+0x10/0x10 [ 253.053061][ T5949] ? lockdep_hardirqs_on+0x7c/0x110 [ 253.058263][ T5949] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 253.064117][ T5949] __device_attach+0x1e4/0x4b0 [ 253.068875][ T5949] ? __pfx___device_attach+0x10/0x10 [ 253.074186][ T5949] ? do_raw_spin_unlock+0x172/0x230 [ 253.079377][ T5949] bus_probe_device+0x17f/0x1c0 [ 253.084268][ T5949] device_add+0x1148/0x1a70 [ 253.088768][ T5949] ? __pfx_device_add+0x10/0x10 [ 253.093640][ T5949] ? mark_held_locks+0x49/0x80 [ 253.098541][ T5949] usb_set_configuration+0x1187/0x1e20 [ 253.104114][ T5949] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 253.110186][ T5949] usb_generic_driver_probe+0xb1/0x110 [ 253.115645][ T5949] usb_probe_device+0xef/0x3e0 [ 253.120426][ T5949] ? __pfx_usb_probe_device+0x10/0x10 [ 253.125795][ T5949] really_probe+0x23e/0xa90 [ 253.130332][ T5949] __driver_probe_device+0x1de/0x440 [ 253.135616][ T5949] ? usb_driver_applicable+0x1c7/0x220 [ 253.141098][ T5949] driver_probe_device+0x4c/0x1b0 [ 253.146125][ T5949] __device_attach_driver+0x1df/0x310 [ 253.151525][ T5949] ? __pfx___device_attach_driver+0x10/0x10 [ 253.157420][ T5949] bus_for_each_drv+0x156/0x1e0 [ 253.162310][ T5949] ? __pfx_bus_for_each_drv+0x10/0x10 [ 253.167676][ T5949] ? lockdep_hardirqs_on+0x7c/0x110 [ 253.172904][ T5949] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 253.178714][ T5949] __device_attach+0x1e4/0x4b0 [ 253.183514][ T5949] ? __pfx___device_attach+0x10/0x10 [ 253.188811][ T5949] ? do_raw_spin_unlock+0x172/0x230 [ 253.194028][ T5949] bus_probe_device+0x17f/0x1c0 [ 253.199065][ T5949] device_add+0x1148/0x1a70 [ 253.203697][ T5949] ? __pfx_device_add+0x10/0x10 [ 253.208543][ T5949] ? usb_new_device+0xbea/0x1a20 [ 253.213500][ T5949] usb_new_device+0xd07/0x1a20 [ 253.218276][ T5949] ? do_raw_spin_lock+0x12c/0x2b0 [ 253.223351][ T5949] ? __pfx_usb_new_device+0x10/0x10 [ 253.228547][ T5949] ? mark_held_locks+0x49/0x80 [ 253.233334][ T5949] hub_event+0x2eb7/0x4fa0 [ 253.237772][ T5949] ? __pfx_hub_event+0x10/0x10 [ 253.242550][ T5949] ? rcu_is_watching+0x12/0xc0 [ 253.247307][ T5949] ? irqentry_exit+0x3b/0x90 [ 253.251931][ T5949] ? preempt_schedule_thunk+0x16/0x30 [ 253.257305][ T5949] process_one_work+0x9cf/0x1b70 [ 253.262289][ T5949] ? __pfx_hcd_resume_work+0x10/0x10 [ 253.267591][ T5949] ? __pfx_process_one_work+0x10/0x10 [ 253.272991][ T5949] ? assign_work+0x1a0/0x250 [ 253.277562][ T5949] worker_thread+0x6c8/0xf10 [ 253.282250][ T5949] ? __kthread_parkme+0x19e/0x250 [ 253.287263][ T5949] ? __pfx_worker_thread+0x10/0x10 [ 253.292388][ T5949] kthread+0x3c5/0x780 [ 253.296453][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.301055][ T5949] ? rcu_is_watching+0x12/0xc0 [ 253.305956][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.310668][ T5949] ret_from_fork+0x5d7/0x6f0 [ 253.315247][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.319842][ T5949] ret_from_fork_asm+0x1a/0x30 [ 253.324621][ T5949] [ 253.327635][ T5949] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 253.334904][ T5949] CPU: 1 UID: 0 PID: 5949 Comm: kworker/1:6 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(full) [ 253.346949][ T5949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 253.356999][ T5949] Workqueue: usb_hub_wq hub_event [ 253.362015][ T5949] Call Trace: [ 253.365284][ T5949] [ 253.368214][ T5949] dump_stack_lvl+0x3d/0x1f0 [ 253.372789][ T5949] panic+0x71c/0x800 [ 253.376678][ T5949] ? __pfx_panic+0x10/0x10 [ 253.381092][ T5949] ? show_trace_log_lvl+0x29b/0x3e0 [ 253.386279][ T5949] ? usbnet_status_start+0x189/0x1e0 [ 253.391551][ T5949] check_panic_on_warn+0xab/0xb0 [ 253.396485][ T5949] __warn+0xf6/0x3c0 [ 253.400356][ T5949] ? usbnet_status_start+0x189/0x1e0 [ 253.405644][ T5949] report_bug+0x3c3/0x580 [ 253.409978][ T5949] ? usbnet_status_start+0x189/0x1e0 [ 253.415263][ T5949] handle_bug+0x184/0x210 [ 253.419594][ T5949] exc_invalid_op+0x17/0x50 [ 253.424099][ T5949] asm_exc_invalid_op+0x1a/0x20 [ 253.428932][ T5949] RIP: 0010:usbnet_status_start+0x189/0x1e0 [ 253.434810][ T5949] Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 4e 48 8b bb 70 03 00 00 89 ee e8 b5 5e 1a 00 41 89 c5 e9 36 ff ff ff e8 28 b8 a0 fa 90 <0f> 0b 90 45 31 ed e9 39 ff ff ff 4c 89 ff e8 b4 93 07 fb e9 e9 fe [ 253.454419][ T5949] RSP: 0018:ffffc900046af090 EFLAGS: 00010283 [ 253.460480][ T5949] RAX: 000000000006dc79 RBX: ffff888073d40d80 RCX: ffffc9001a6c1000 [ 253.468431][ T5949] RDX: 0000000000100000 RSI: ffffffff871b3e88 RDI: ffff888073d40d80 [ 253.476380][ T5949] RBP: 0000000000000cc0 R08: 0000000000000005 R09: 0000000000000000 [ 253.484334][ T5949] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888073d410f0 [ 253.492292][ T5949] R13: ffffffff8f8d9e90 R14: ffff8880271a8028 R15: ffff8880271a8024 [ 253.500270][ T5949] ? usbnet_status_start+0x188/0x1e0 [ 253.505577][ T5949] sierra_net_probe+0x70/0xb0 [ 253.510245][ T5949] usb_probe_interface+0x303/0x9c0 [ 253.515362][ T5949] ? __pfx_usb_probe_interface+0x10/0x10 [ 253.520991][ T5949] really_probe+0x23e/0xa90 [ 253.525489][ T5949] __driver_probe_device+0x1de/0x440 [ 253.530774][ T5949] driver_probe_device+0x4c/0x1b0 [ 253.535789][ T5949] __device_attach_driver+0x1df/0x310 [ 253.541153][ T5949] ? __pfx___device_attach_driver+0x10/0x10 [ 253.547054][ T5949] bus_for_each_drv+0x156/0x1e0 [ 253.551898][ T5949] ? __pfx_bus_for_each_drv+0x10/0x10 [ 253.557261][ T5949] ? lockdep_hardirqs_on+0x7c/0x110 [ 253.562460][ T5949] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 253.568261][ T5949] __device_attach+0x1e4/0x4b0 [ 253.573021][ T5949] ? __pfx___device_attach+0x10/0x10 [ 253.578293][ T5949] ? do_raw_spin_unlock+0x172/0x230 [ 253.583483][ T5949] bus_probe_device+0x17f/0x1c0 [ 253.588333][ T5949] device_add+0x1148/0x1a70 [ 253.592827][ T5949] ? __pfx_device_add+0x10/0x10 [ 253.597674][ T5949] ? mark_held_locks+0x49/0x80 [ 253.602438][ T5949] usb_set_configuration+0x1187/0x1e20 [ 253.607921][ T5949] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 253.614000][ T5949] usb_generic_driver_probe+0xb1/0x110 [ 253.619477][ T5949] usb_probe_device+0xef/0x3e0 [ 253.624244][ T5949] ? __pfx_usb_probe_device+0x10/0x10 [ 253.629616][ T5949] really_probe+0x23e/0xa90 [ 253.634126][ T5949] __driver_probe_device+0x1de/0x440 [ 253.639407][ T5949] ? usb_driver_applicable+0x1c7/0x220 [ 253.644850][ T5949] driver_probe_device+0x4c/0x1b0 [ 253.649884][ T5949] __device_attach_driver+0x1df/0x310 [ 253.655261][ T5949] ? __pfx___device_attach_driver+0x10/0x10 [ 253.661158][ T5949] bus_for_each_drv+0x156/0x1e0 [ 253.666014][ T5949] ? __pfx_bus_for_each_drv+0x10/0x10 [ 253.671382][ T5949] ? lockdep_hardirqs_on+0x7c/0x110 [ 253.676576][ T5949] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 253.682392][ T5949] __device_attach+0x1e4/0x4b0 [ 253.687165][ T5949] ? __pfx___device_attach+0x10/0x10 [ 253.692444][ T5949] ? do_raw_spin_unlock+0x172/0x230 [ 253.697631][ T5949] bus_probe_device+0x17f/0x1c0 [ 253.702477][ T5949] device_add+0x1148/0x1a70 [ 253.706968][ T5949] ? __pfx_device_add+0x10/0x10 [ 253.711822][ T5949] ? usb_new_device+0xbea/0x1a20 [ 253.716751][ T5949] usb_new_device+0xd07/0x1a20 [ 253.721510][ T5949] ? do_raw_spin_lock+0x12c/0x2b0 [ 253.726528][ T5949] ? __pfx_usb_new_device+0x10/0x10 [ 253.731711][ T5949] ? mark_held_locks+0x49/0x80 [ 253.736469][ T5949] hub_event+0x2eb7/0x4fa0 [ 253.740907][ T5949] ? __pfx_hub_event+0x10/0x10 [ 253.745653][ T5949] ? rcu_is_watching+0x12/0xc0 [ 253.750414][ T5949] ? irqentry_exit+0x3b/0x90 [ 253.754991][ T5949] ? preempt_schedule_thunk+0x16/0x30 [ 253.760361][ T5949] process_one_work+0x9cf/0x1b70 [ 253.765291][ T5949] ? __pfx_hcd_resume_work+0x10/0x10 [ 253.770565][ T5949] ? __pfx_process_one_work+0x10/0x10 [ 253.775925][ T5949] ? assign_work+0x1a0/0x250 [ 253.780497][ T5949] worker_thread+0x6c8/0xf10 [ 253.785073][ T5949] ? __kthread_parkme+0x19e/0x250 [ 253.790102][ T5949] ? __pfx_worker_thread+0x10/0x10 [ 253.795198][ T5949] kthread+0x3c5/0x780 [ 253.799255][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.803836][ T5949] ? rcu_is_watching+0x12/0xc0 [ 253.808586][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.813176][ T5949] ret_from_fork+0x5d7/0x6f0 [ 253.817766][ T5949] ? __pfx_kthread+0x10/0x10 [ 253.822356][ T5949] ret_from_fork_asm+0x1a/0x30 [ 253.827124][ T5949] [ 253.830325][ T5949] Kernel Offset: disabled [ 253.834631][ T5949] Rebooting in 86400 seconds..