last executing test programs: 5.166694926s ago: executing program 0 (id=360): write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000400)="53ed0b8f9e9e31254c0d2a523e4252", 0xffffff09, 0x20008045, &(0x7f00000001c0)={0xa, 0x4002, 0xffd, @empty}, 0x1c) 5.140517136s ago: executing program 0 (id=363): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x340, 0x11, 0x148, 0x340, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x20000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) 5.057091548s ago: executing program 0 (id=364): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000300000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000400)='io_uring_create\x00', r1}, 0x18) io_uring_setup(0x1de0, &(0x7f0000001e00)={0x0, 0x8ec5, 0x0, 0x0, 0x0, 0x0, r1}) 5.006139418s ago: executing program 0 (id=365): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x3000046, &(0x7f0000000400), 0x1, 0x55f, &(0x7f0000001000)="$eJzs3c9rHFUcAPDvbJL+1qZQiopIoAcrtZsm8UcFD/UoWizovS7JNJRsuiW7KU0s2B7sxYNSBBEL4l3vHov/gH9FQQtFStCDl5XZzKbbZDfZppsf7X4+MOG9ndm8+e7M9+2bfbNsAH1rJPtTiHg5Ir5NIg5HRJKvG4x85cjydksPr09mSxL1+qd/J43tsnrzfzWfdzCvvBQRv38VcbKwtt3qwuJMqVxO5/L6aG32ymh1YfHUpdnSdDqdXh6fmDjz9sT4e+++07NY3zj/7w+f3P3wzNfHl77/9f6R20mcjUP5utY4nsKN1spIjOSvyVCcXbXhWA8a202Snd4BNmUgz/OhyPqAwzGQZz3w/PsyIupAn0rkP/Sp5jigeW3fo+vgZ8aDD5YvgNbGP7j82Ujsa1wbHVhKHrsyyq53h3vQftbGb3/duZ0t0bvPIQA2dONmRJweHFzb/yV5/7d5p7vYZnUb+j/YPnez8c+b7cY/hZXxT7QZ/xxsk7ubsXH+F+73oJmOsvHf+23HvyuTVsMDee2FxphvKLl4qZxmfduLEXEihvZm9fXmc84s3at3Wtc6/suWrP3mWDDfj/uDex9/zlSpVnqamFs9uBnxStvxb7Jy/JM2xz97Pc532cax9M5rndZtHP/Wqv8c8Xrb4/9oRitZf35ytHE+jDbPirX+uXXsj07t73T82fE/sH78w0nrfG31ydv4ad9/aad1j8Uf3Z//e5LPGuU9+WPXSrXa3FjEnuTjtY+PP3pus97cPov/xPH1+7925//+iPi8y/hvHf3l1a7i36HjP/VEx//JC/c++uLHTu131/+91SidyB/ppv/rdgef5rUDAAAAAACA3aYQEYciKRRXyoVCsbh8f8fROFAoV6q1kxcr85enovFd2eEYKjRnug+33A8xlt8P26yPr6pPRMSRiPhuYH+jXpyslKd2OngAAAAAAAAAAAAAAAAAAADYJQ52+P5/5s+Bnd47YMv5yW/oXxvm/6pfabrxzRbuDLCtvP9D/5L/0L/kP/SvzeW/2QF4Hnj/h/4l/6F/yX/oX/IfAAAAAAAAAAAAAAAAAAAAAAAAAAAAeur8uXPZUl96eH0yq09dXZifqVw9NZVWZ4qz85PFycrcleJ0pTJdTouTldmN/l+5UrkyNh7z10ZrabU2Wl1YvDBbmb9cu3BptjSdXkiHtiUqAAAAAAAAAAAAAAAAAAAAeLZUFxZnSuVyOqegsKnC4O7YDYUeFzp0GEm+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMA2+j8AAP//3vk4xQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x141842, 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x1c7102, 0x1) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2, 0x28011, r1, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000700)=ANY=[@ANYBLOB="0b00000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fa"], 0x118) 4.709960723s ago: executing program 0 (id=367): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='devices.list\x00', 0x275a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000740)={0x30}, 0x30) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') fchdir(r1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) creat(&(0x7f0000000000)='./file1\x00', 0xc8) 4.550724235s ago: executing program 0 (id=369): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e03"], 0xffdd) 4.550513325s ago: executing program 32 (id=369): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e03"], 0xffdd) 3.096113666s ago: executing program 1 (id=388): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x8, 0x7fe2, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) socket$key(0xf, 0x3, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=@newsa={0x138, 0x10, 0x713, 0x14, 0x0, {{@in=@broadcast, @in=@multicast2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x40}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000}, {0x2}, {0x1}, 0x0, 0x0, 0xa, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0xe}, 0x0) 3.093565295s ago: executing program 5 (id=389): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000300)='qdisc_dequeue\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000640)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd020f4c0c8c56147d66527da307bf731fef97861750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3665f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447c2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72e7ead0509d380578673f8b6e74ce23877a6b24db0000000000000003629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d7b90dfae158b94f50adab988dd8e12b1b56073d0d10f7067c881434af5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf77bfc95769a9294df517d90bdc01e73835efd98ad5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b31592479ecf2392548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbe1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5646ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4766e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec859c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f250057931d828ec78e116ae46c4897e2795b6ff92e9a1f63a6ed8fb4f8f3a6ec4e76f8621e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403f02734137ff47257f164391c673b6071b6ad0f05eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb79f5589829b6b0679b5d65a81826fc9b38f791c8f1892b51ad65a89bc84646ebf78f5d5d4804d9abb071fd711b5e7cc163b42a6510b8f5ee6747df0b560eabe0499bf1fef7c18bb9f55effa018679845c6598fb78bf1b8d9d9f04a5f6062c2bbb91952755b3f7c948268cb647d0a0bb1286480615941154a01d23734bcafe3b164474e2f2efa77850686ee4541f3e79efa63545a7ae53d5f0c40cc86473f7eb093980bd0d97bb4750128d9c519984c5f731ea259e71b2f12d67ce12e52c283e74594dfc933e625737ed231d61263721d46daf093f770357cd78fe1431aef52b4a0a933f1a5334ad03f3876fc8a8e187f80318427b4c922075cf829e3cc49d71d52137b48e1fb6b05dd1c7b251a7059f0a4b4f3431f67fc65b75c202e43816e34ff41db85bacd77b25242830b788ae1e00"/2566], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x18000000000002a0, 0xe40, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f005dd1be0ffff00fe3a21632f77fbac14141de007031762079f4b4d2f87e5feca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x8, 0x60000000}, 0x1e) 3.045814376s ago: executing program 1 (id=390): io_setup(0x2278, &(0x7f0000000180)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) io_submit(r0, 0x2, &(0x7f0000000140)=[&(0x7f00000001c0)={0x0, 0x4, 0x0, 0x0, 0x0, r2, &(0x7f0000000100)="7f", 0x1, 0x0, 0x0, 0x2}, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x5, 0x0, r1, 0x0, 0x0, 0x6}]) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 3.025791097s ago: executing program 5 (id=391): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x13, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x80000000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r2}, 0x10) sendmsg$unix(r0, &(0x7f0000000640)={&(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e, 0x0}, 0x0) 2.964807448s ago: executing program 5 (id=393): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000004c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ff8}]}) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ppoll(0x0, 0x0, &(0x7f0000000300)={0x0, 0x3938700}, 0x0, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) setpriority(0x1, 0x0, 0x3) 2.76180429s ago: executing program 1 (id=396): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) unlinkat(0xffffffffffffffff, 0x0, 0x200) 2.723758331s ago: executing program 1 (id=397): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x2000003, &(0x7f0000000140)={[{@nobarrier}, {@noblock_validity}, {@bsdgroups}, {@journal_dev={'journal_dev', 0x3d, 0xb}}, {@barrier_val={'barrier', 0x3d, 0x81}}, {@minixdf}, {@stripe}]}, 0x1, 0x501, &(0x7f0000000800)="$eJzs3d9rXFkdAPDvvcl0027WyaJILbi72Eq6aGeSjbsbRNYVRJ8W1PU9xmQSQiaZkJmsTVg0i6+CIKKCTz75IvgHCLL4F4iwqO+iRRFt9cEH7ZW5c6dN05kkbdJMOvl84OSec8+98z3nhLlzf3FvAOfWSxHxZkSMRMTLEVEu5qdFmmsXdjvL3bn97kI7JZFlb/8jiaSY1/2sdnk0Ip7trBJjEfG1L0d8M3k4bnN7Z3W+Xq9tFuVqa22j2tzeubGyNr9cW66tz8xMvzb7+uyrs1NZ4Vj9vBIRb3zx1o++//MvvfHrT3/rT3N/u/7tdrM+99FOuyNi4VgB+uh8dikfi672GG0+iWADMFL0pzTohgAAcCTtffyrEfGJfP+/HCP53txh7O0BAADA0yT7/Hj8N4nIAAAAgKGVRsR4JGmluBdgPNK0Uuncw/uRuJTWG83Wp5YaW+uL7bqIiSilSyv12lRxr/BElJJ2eTrP3y+/sq88ExHPR8QPyxfzcmWhUV8c9MkPAAAAOCeeffHB4/9/l9M8DwAAAAyZib4FAAAAYFg45AcAAIDh5/gfAAAAhtpX3nqrnbLue7wX39neWm28c2Ox1lytrG0tVBYamxuV5UZjOX9m31qfj/leN1NvNDY+E+tbN6utWrNVbW7vzK01ttZbcysPvAIbAAAAOEXPv/j+H5OI2P3sxTxF8RzAwu9/M7imAWfJXwbdAOAkjQy6AcDAjA66AcDAlA5dYvQRlgWeRskh9X1v3vnt48dMH39VAADgMUx+7OHr/xeKOsf7MNwcgwPA+eP6P5xfJXcAwrl3rTN5pl/98a//Z9kjNwoAADhR43lK0kpxLXA80rRSiXgufy1AKVlaqdemIuJDEfGHcumZdnk6XzM59J5hAAAAAAAAAAAAAAAAAAAAAAAAAKAjy5LIAAAAgKEWkf41yZ/mHzFZvja+//zAheQ/5bhVFH769o9vzrdam9Pt+f8s5/UR0fpJMf+VzCsBAAAA4AzoHKcX0+lBtwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAYXPn9rsL3XSacf/+hYiY6BV/NMby6ViUIuLSv5IY3bNeEhEjJxB/972IuLw3fnYvwt0syyaKVvSKf/EE4mff2R+/2/+kPSyxL/5Yd730BGLDefd+e/vzZq/vXxov5dPe3//RIh1X/+1fem/7N9Jn+/PcEWNc+eCX1b7x34u4Mtp7+9ONn/SJf/WI8b/x9Z2dfnXZzyIme/7+JA/EqrbWNqrN7Z0bK2vzy7Xl2vrMzPRrs6/Pvjo7VV1aqdeKvz1j/ODjv7p7UP8v9Yk/cUj/rx2x///74ObtD3eypV7xr1/t/ft7uU/8tPjt+2SRb9dPdvKXY7eT3+uFX/zuhYP6v9in/4f9/68fsf8vf/W7fz7iogDAKWhu76zO1+u1zQMyY0dYRmZv5kIxumelPWc/k58HOfaInfSAZ4MelgFmBrlVAgAAnoT7O/2DbgkAAAAAAAAAAAAAAAAAAACcX6fxOLH9MXcH01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAP9PwAA///Ymd3G") mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x1480, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x32d800, 0x0) r0 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) mount$bind(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x64, 0x0) 2.705679711s ago: executing program 5 (id=398): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0xb}, 0x1c) listen(r0, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) accept4(r0, 0x0, 0x0, 0x0) 2.657994342s ago: executing program 5 (id=401): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fbffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='kmem_cache_free\x00', r1}, 0x10) r2 = socket(0x1e, 0x805, 0x0) connect$tipc(r2, &(0x7f0000000000)=@id={0x1e, 0x3, 0x1}, 0x10) close(r2) 2.628878143s ago: executing program 5 (id=404): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000140)={{0x12, 0x1, 0x150, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xa2}, {0xd, 0x24, 0xf, 0x1, 0xfffffff9, 0xfffd, 0x8}, {0x6, 0x24, 0x1a, 0x0, 0x8}}, {{0x9, 0x5, 0x81, 0x3, 0x400}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x0, 0x7, 0x4}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000240)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.230967518s ago: executing program 1 (id=412): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000017850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r1}, 0x10) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1, @loopback, 0x9, 0x4, 0x0, 0x480, 0x3, 0x2}) 2.07758998s ago: executing program 2 (id=418): rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r0 = gettid() r1 = gettid() tkill(r0, 0x12) tkill(r0, 0x1) tkill(r1, 0x14) 2.07700811s ago: executing program 4 (id=419): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) socket$nl_route(0x10, 0x3, 0x0) pipe2$9p(0x0, 0x84000) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)=""/204, 0xcc) 2.07682495s ago: executing program 2 (id=420): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000040)={[0x7fffffffffffffff]}, 0x8, 0x0) ppoll(&(0x7f0000000000)=[{r0}, {r0, 0x2004}], 0x2, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x2, &(0x7f000049efa0)={0x0, 0xb, 0x4, @tid=r1}, &(0x7f0000044000)=0x0) syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) 2.07645919s ago: executing program 4 (id=421): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000002c0)='sys_enter\x00', r1}, 0x18) r2 = epoll_create1(0x0) epoll_pwait(r2, &(0x7f00000000c0)=[{}], 0x1, 0x200, 0x0, 0x0) 1.943821022s ago: executing program 1 (id=422): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000080), &(0x7f00000006c0)='%-010d \x00'}, 0x20) getresuid(&(0x7f0000000440), &(0x7f0000000400), &(0x7f00000004c0)) 1.939708822s ago: executing program 33 (id=422): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000080), &(0x7f00000006c0)='%-010d \x00'}, 0x20) getresuid(&(0x7f0000000440), &(0x7f0000000400), &(0x7f00000004c0)) 1.530903648s ago: executing program 4 (id=430): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='mm_lru_insertion\x00', r0}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r1, &(0x7f0000000180), 0x40010) 1.44640271s ago: executing program 4 (id=432): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000004c0)={0x79, 0x0, 0x6}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x78, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.183434883s ago: executing program 2 (id=434): socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@ipv6_newroute={0x1c, 0x18, 0xffffffffffffffff, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0xfd, 0x9}}, 0x1c}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) sendmmsg$inet6(r1, &(0x7f0000004f00)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @private1}, 0x1c, 0x0}}], 0x1, 0x0) syz_emit_ethernet(0x44e, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000186dd60d5b3320418000020010010000000000000000000000000000000000000000000000000000000006253000000000000050200030502000706cc09bf801dc6719ffdcfff23c1667314a2b063736265ab4a7e2e609e98c51c93acdbf11f789062e208bdc6dff340b3fc4ee58d1d9c4af654730b716e3747319eb5f4aa7d6c213136807fe816423f3f3f33016c80d4b9d0c39f6b8ab438bb2dacb429ca0845a308882e5fcff98082a47aac1e7a268ff2b1485edce7f3f812a0db70c2e3696c96c8f0c7ba5b5924fe1359e053551c3eb861c28f7e9de69498dae86bd83be96841421707ec3eea00b8f41b0e85eeff0b8ddb04b6363a9eb587af6e22371e894a1bf4f694bdcc2f98c204", @ANYBLOB="ca1cb8f3"], 0x0) 1.152751364s ago: executing program 2 (id=435): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2f00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000008500000006000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r0}, 0x10) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) ppoll(&(0x7f0000000080)=[{r1, 0x1141}], 0x1, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) signalfd4(r1, &(0x7f0000000340)={[0x1]}, 0x8, 0x800) 1.144604143s ago: executing program 6 (id=423): open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setresuid(0x0, 0xee00, 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0x17c) 1.071239985s ago: executing program 6 (id=436): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = openat$incfs(r0, &(0x7f0000000000)='.pending_reads\x00', 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x40106726, &(0x7f00000000c0)) 1.069517424s ago: executing program 6 (id=437): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020641700000000002020007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x2, &(0x7f0000002400)=0x0) io_submit(r2, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r1, &(0x7f0000000040)="5400ffff0000", 0x6, 0x0, 0x0, 0x2}]) 981.022266ms ago: executing program 6 (id=439): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xe, &(0x7f0000000040)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffa}]}) r1 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)={0xffffffee, 0x0, 0x0, 0x2000000, 0xf, "1241b72d7fffff5b000f000000462200"}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) close_range(r0, 0xffffffffffffffff, 0x0) 694.4447ms ago: executing program 3 (id=441): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000180), &(0x7f0000000840)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r2}, 0x10) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 612.543431ms ago: executing program 4 (id=442): syz_mount_image$ext4(&(0x7f0000000540)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x88, &(0x7f00000005c0)={[{@nogrpid}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@nobarrier}, {@nodiscard}, {@quota}]}, 0x3, 0x438, &(0x7f0000000d80)="$eJzs289rHFUcAPDv7GZT01+Jpf5oWjVaxeCPpElr7cGLouBBQdBDPcYkLbHbRpoItgSNIvUoBe/iUfAv8KQXUU8Fr3oXoUgurZ5WZncm2d1sfnaTrd3PByb5vpm3vPfNzNt9My8bQNcaSn8kEfsj4veI6K8VGysM1X7dXlqY/GdpYTKJSuXtv5NqvVtLC5N51fx1+/JCT0Th8ySOtmh37srVCxPl8vTlrDw6f/GD0bkrV5+fuThxfvr89KXxM2dOnRx78fT4C23JM83r1uDHs8eOvP7u9Tcnz15/75fvkjz/pjzaZGi9g09VKm1urrMO1MVJTwc7wpYUa8M0StXx3x/FWDl5/fHaZx3tHLCjKpVK5cG1Dy9WgHtYEp3uAdAZ+Qd9ev+bb7s09bgr3Hy5dgOU5n0722pHeqKQ1Sk13d+201BEnF389+t0i515DgEA0OCHdP7zXKv5XyHqnwsdzNZQBiLi/og4FBGnI+JwRDwQUa37UEQ8vMX2mxdJVs9/Dm4rr81K538vZWtbjfO/fPYXA8WsdKCafyk5N1OePpH1bDhKe9Ly2Dpt/Pjqb1+2PJA1kc//0i1tP58LZpX+6tnT+LKpifmJO8m53s1PIwZ7WuWfLK8EJBFxJCIGt9nGzDPfHlvr2NCG+a+jDetMlW8inq6d/8Voyj+XrL8+OXpflKdPjOZXxWq/3rj21lrt31H+bZCe/70tr//l/AeS+vXaua23ce2PL9a8p9k4/9bXf2/yTsO+jybm5y+PRfQmb9Q6Xb9/vKne+Er9NP/h463H/6FY+UscjYj0In4kIh6NiMeyvj8eEU9ExPHVqd3ozYKfX3ny/WpQ2k7+OyvNf2pL538l6I3mPa2D4oWfvm9odGAr+afn/1Q1Gs72bOb9bzP92t7VDAAAAP8/hYjYH0lhZDkuFEZGav/Dfzj2Fsqzc/PPnpv98NJU7TsCA1Eq5E+6+uueh45lt/V5ebypfDJ7bvxVsa9aHpmcLU91OnnocvvWGP+pP4ud7h2w43xfC7qX8Q/dy/iH7mX8Q/dqMf77OtEPYPe1+vz/pAP9AHZf0/i37AddxP0/dC/jH7qX8Q9daa4vNv6SvECwKojCXdENwQ4FnX5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaI//AgAA//9Lr+a0") creat(&(0x7f0000000100)='./bus\x00', 0x30) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000040)='./file1\x00') preadv2(r0, &(0x7f0000000d80)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0x1, 0x0, 0x0, 0x1b) 611.615741ms ago: executing program 3 (id=443): syz_open_procfs(0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) capget(&(0x7f0000000440)={0x19980330}, 0x0) 582.069872ms ago: executing program 3 (id=444): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r1}, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 470.611613ms ago: executing program 3 (id=445): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000002000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000f00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 470.266603ms ago: executing program 3 (id=446): listen(0xffffffffffffffff, 0x2) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x1008002, &(0x7f00000002c0)={[{@nouid32}, {@oldalloc}, {@i_version}, {@barrier}, {@dioread_nolock}, {@nodiscard}, {@nodelalloc}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8000000000000000}}]}, 0x81, 0x601, &(0x7f00000011c0)="$eJzs3c9vFFUcAPDv7LalpWgLMSoepIkxkCgtLWCI8QBXQxr8ES8etNKCSIGG1mjRhJLgxcR4McbEkwfxv1AiVy7qyYMXT4aEKOFo4prd7pRuO7ttt+0OYT6fZOnMvB3ed7r97nsz+95sAIU1VP2nFLE3ImaSiIFkYamsK+qFQ4vPu3/v09PVRxKVyht/J5HUt6XPT+o/++s790bErz8nsae8ut7Z+SvnJ6anpy7X10fmLsyMzM5fOXjuwsTZqbNTF8deGjt29MjRY6OH2jquqxnbTl7/4KOBz8ff/v7bf5PRH/4YT+J4vFp/4vLj2CpDMVT7nSSri/qPbXVlOSnX/06Wv8RJV44BsSHp69cdEU/FQJTjwYs3EJ+9lmtwwLaqJBEVoKAS+Q8FlfYD0nP7lefBpVx6JUAn3D2xeAFgdf53LV4bjN7atYGd95NYflkniYj2rsw12hURt2+NXz9za/x6bNN1OCDbwrWIeDor/5Na/g9GbwzW8r/UkP/VfsGp+s/q9te3KJ618l9/BLbOYv73tsz/aJL/7y7L//farH/oweL7fQ3539fuIQEAAAAAAEBh3TwRES9mff5fWhr/Exnjf/oj4vgW1D+0Yn315/+lO1tQDZDh7omIVzLH/5bS0TaD5WVrg9GdnDk3PXUoIh6PiAPRvaO6PtqijoNf7PmmWdlQffxf+qjWf7s+FrAex52uHY37TE7MTWz2uIGIu9cinskc/5sstf9JRvtffS+YWWcde56/capZ2dr5D2yXyncR+zPb/wd3rUha359jpNYfGEl7Bas9+8mXPzarv938d4sJ2Lxq+7+zdf4PJsvv1zO78ToOz3dVmpW12//vSd6s3XKmp77t44m5ucujET3JyXJ1a8P2sY3HDI+iNB/SfKnm/4HnWl//y+r/90XEwor/O/mncU5x6sn/+v9sFo/+P+Snmv+TG2r/N74wdmPwp2b1p/mfNvHZ7f+RWlt/oL5lMuN+glBEX6dp2tO4PSMdu7KKOh0vAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwKShGxK5LS8NJyqTQ8HNEfEU/EztL0pdm5F85c+vDiZLWs9v3/pfSbfgcW15P0+/8Hl62PrVg/HBG7I+Krcl9tffj0penJvA8eAAAAAAAAAAAAAAAAAAAAHhL9Teb/V/1Vzjs6YNt15R0AkJuM/P8tjziAztP+Q3G1zP937nUuEKDj1tP+93YgDqDz9P+huOQ/FNfq/G/1yf+9SqWyreEAHaT9h+KS/wAAAAAA8EjZve/m70lELLzcV3tU9dTLunONDNhupbwDAHLjFj9QXIb+QHE5xweSNcozp/8n69mzlZnTm9gZAAAAAAAAAAAAAApn/17z/6GozP+H4jL/H4ornf+/L+c4gM5zjg/EGjP5V83/L69nLwAAAAAAAAAAAABgK83OXzk/MT09ddnCW23u/stjEbkH395CpVK5Wv0reFjieQgWdmxi93QofP5HkbmQzvVb3175vScBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACN/g8AAP//Z+EiqQ==") bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f00000003c0)='virtio_transport_alloc_pkt\x00'}, 0x10) ptrace$getregset(0x4205, r0, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) 451.267103ms ago: executing program 4 (id=447): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x20009, 0x1, 0x100, 0x1, 0x1ff, 0x4007}, 0x20) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r0, @ANYBLOB="05"], 0x0) 145.915058ms ago: executing program 2 (id=448): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r2}, 0x10) sendto$inet6(r1, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) 46.451109ms ago: executing program 3 (id=449): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) recvmmsg(r1, &(0x7f0000002500)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x1, 0x0) 0s ago: executing program 2 (id=450): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000002500)='\f7', 0x2}, {&(0x7f0000000080)='0', 0x1}], 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.33' (ED25519) to the list of known hosts. [ 22.240863][ T30] audit: type=1400 audit(1747988927.381:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.242303][ T273] cgroup: Unknown subsys name 'net' [ 22.263554][ T30] audit: type=1400 audit(1747988927.381:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.290833][ T30] audit: type=1400 audit(1747988927.411:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.291124][ T273] cgroup: Unknown subsys name 'devices' [ 22.437174][ T273] cgroup: Unknown subsys name 'hugetlb' [ 22.442776][ T273] cgroup: Unknown subsys name 'rlimit' [ 22.644306][ T30] audit: type=1400 audit(1747988927.781:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.667461][ T30] audit: type=1400 audit(1747988927.781:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.692235][ T30] audit: type=1400 audit(1747988927.781:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.699458][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.724210][ T30] audit: type=1400 audit(1747988927.861:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.734822][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.749669][ T30] audit: type=1400 audit(1747988927.861:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.784287][ T30] audit: type=1400 audit(1747988927.871:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.810461][ T30] audit: type=1400 audit(1747988927.871:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.523766][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.531069][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.538590][ T281] device bridge_slave_0 entered promiscuous mode [ 23.545614][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.552651][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.560167][ T281] device bridge_slave_1 entered promiscuous mode [ 23.579555][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.586644][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.593993][ T282] device bridge_slave_0 entered promiscuous mode [ 23.602012][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.609102][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.616569][ T282] device bridge_slave_1 entered promiscuous mode [ 23.697019][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.704069][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.711577][ T283] device bridge_slave_0 entered promiscuous mode [ 23.718779][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.725864][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.733326][ T283] device bridge_slave_1 entered promiscuous mode [ 23.784249][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.791345][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.798928][ T284] device bridge_slave_0 entered promiscuous mode [ 23.806000][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.813216][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.820691][ T284] device bridge_slave_1 entered promiscuous mode [ 23.855536][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.862845][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.870451][ T285] device bridge_slave_0 entered promiscuous mode [ 23.886781][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.893823][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.901284][ T285] device bridge_slave_1 entered promiscuous mode [ 23.944570][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.951654][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.958990][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.966030][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.041215][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.048276][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.056211][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.063244][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.070527][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.077568][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.114189][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.121545][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.129502][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.137066][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.144429][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.151791][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.183223][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.191637][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.198700][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.206293][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.214458][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.221501][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.257977][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.265888][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.273307][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.281062][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.289635][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.298068][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.305131][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.312604][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.320976][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.328033][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.335423][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.343371][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.360651][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.368909][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.375971][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.383374][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.391791][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.398871][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.417660][ T281] device veth0_vlan entered promiscuous mode [ 24.425455][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.434123][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.442331][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.450756][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.458461][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.466559][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.486227][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.493658][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.501774][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.510030][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.517073][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.524553][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.532824][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.541002][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.548047][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.575594][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.584773][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.592843][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.602574][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.610958][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.629394][ T281] device veth1_macvtap entered promiscuous mode [ 24.636039][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.644549][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.652830][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.660683][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.668830][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.677483][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.685446][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.694798][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.702813][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.711285][ T282] device veth0_vlan entered promiscuous mode [ 24.725936][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.733466][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.741420][ T283] device veth0_vlan entered promiscuous mode [ 24.755370][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.763679][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.772372][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.780054][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.787725][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.796343][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.804623][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.813230][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.821516][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.828566][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.836214][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.844573][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.852923][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.859965][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.867685][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.881939][ T284] device veth0_vlan entered promiscuous mode [ 24.888408][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.896349][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.904371][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.912976][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.921616][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.930110][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.938611][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.946222][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.954582][ T282] device veth1_macvtap entered promiscuous mode [ 24.968376][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.976360][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.984495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.002470][ T283] device veth1_macvtap entered promiscuous mode [ 25.009761][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.017976][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.026265][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.034208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.042344][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.050670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.059064][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.070487][ T284] device veth1_macvtap entered promiscuous mode [ 25.078757][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 25.093640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.101444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.110581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.119073][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.127447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.135847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.144049][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.152507][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.160880][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.180483][ T285] device veth0_vlan entered promiscuous mode [ 25.192274][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.201471][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.212209][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.221052][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.230786][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.239238][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.247574][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.256047][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.264482][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.272268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.303741][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.314110][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.360128][ T285] device veth1_macvtap entered promiscuous mode [ 25.390670][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.398955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.407601][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.413142][ T316] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 25.424160][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.433917][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.477326][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 25.715808][ T357] syz.2.15 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 25.781309][ T364] SELinux: security_context_str_to_sid(user_u) failed for (dev ?, type ?) errno=-22 [ 25.797019][ T364] SELinux: security_context_str_to_sid(user_u) failed for (dev incremental-fs, type incremental-fs) errno=-22 [ 25.891192][ T376] loop4: detected capacity change from 0 to 1024 [ 25.960531][ T376] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,nombcache,dioread_lock,norecovery,barrier=0x000000000000004c,lazytime,init_itable=0x0000000000000005,usrquota,errors=continue,,errors=continue. Quota mode: writeback. [ 26.119402][ T393] process 'syz.4.28' launched './file0' with NULL argv: empty string added [ 26.166388][ T399] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.195305][ T26] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.391369][ T424] device sit0 entered promiscuous mode [ 26.398714][ T424] netlink: 'syz.3.42': attribute type 1 has an invalid length. [ 26.407097][ T424] netlink: 1 bytes leftover after parsing attributes in process `syz.3.42'. [ 26.441973][ T424] syz.3.42 (424) used greatest stack depth: 22208 bytes left [ 26.451954][ T430] netlink: 44 bytes leftover after parsing attributes in process `syz.2.44'. [ 26.480003][ T433] loop2: detected capacity change from 0 to 512 [ 26.527419][ T433] EXT4-fs (loop2): Ignoring removed nobh option [ 26.542177][ T433] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobh,stripe=0x0000000000010000,dioread_nolock,,errors=continue. Quota mode: none. [ 26.585579][ T26] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.595876][ T26] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.613751][ T440] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 26.695040][ T26] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 26.707437][ T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 26.724242][ T26] usb 2-1: SerialNumber: syz [ 26.736064][ T453] loop3: detected capacity change from 0 to 8192 [ 26.748026][ T457] netlink: 27 bytes leftover after parsing attributes in process `syz.2.57'. [ 26.828683][ T453] FAT-fs (loop3): error, fat_free_clusters: deleting FAT entry beyond EOF [ 26.846222][ T453] FAT-fs (loop3): Filesystem has been set read-only [ 26.920678][ T461] loop2: detected capacity change from 0 to 40427 [ 26.932998][ T461] F2FS-fs (loop2): fault_injection options not supported [ 26.955613][ T461] F2FS-fs (loop2): invalid crc value [ 26.962532][ T461] F2FS-fs (loop2): Found nat_bits in checkpoint [ 27.005324][ T461] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 27.083118][ T285] attempt to access beyond end of device [ 27.083118][ T285] loop2: rw=2049, want=45104, limit=40427 [ 27.091391][ T465] loop3: detected capacity change from 0 to 40427 [ 27.123218][ T26] usb 2-1: 0:2 : does not exist [ 27.129894][ T26] usb 2-1: USB disconnect, device number 2 [ 27.184066][ T465] F2FS-fs (loop3): Found nat_bits in checkpoint [ 27.222869][ T465] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 27.268175][ T30] kauditd_printk_skb: 131 callbacks suppressed [ 27.268193][ T30] audit: type=1400 audit(1747988932.411:205): avc: denied { lock } for pid=464 comm="syz.3.61" path="/19/file0/file1" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.297325][ T281] attempt to access beyond end of device [ 27.297325][ T281] loop3: rw=2049, want=45112, limit=40427 [ 27.298433][ T30] audit: type=1400 audit(1747988932.411:206): avc: denied { link } for pid=464 comm="syz.3.61" name="file1" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.330667][ T30] audit: type=1400 audit(1747988932.411:207): avc: denied { create } for pid=477 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.361316][ T30] audit: type=1400 audit(1747988932.411:208): avc: denied { connect } for pid=477 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.381089][ T30] audit: type=1400 audit(1747988932.491:209): avc: denied { setopt } for pid=477 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.381513][ T382] udevd[382]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.466411][ T30] audit: type=1400 audit(1747988932.611:210): avc: denied { name_bind } for pid=482 comm="syz.4.67" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 27.489300][ T483] syz.4.67 (483) used greatest stack depth: 21536 bytes left [ 27.505232][ T20] Bluetooth: hci0: command 0x1003 tx timeout [ 27.511314][ T319] Bluetooth: hci0: sending frame failed (-49) [ 27.514967][ T30] audit: type=1400 audit(1747988932.611:211): avc: denied { node_bind } for pid=482 comm="syz.4.67" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 27.575015][ T30] audit: type=1400 audit(1747988932.711:212): avc: denied { write } for pid=492 comm="syz.2.71" name="mcfilter" dev="proc" ino=4026532618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 27.616692][ T491] SELinux: policydb version 0 does not match my version range 15-33 [ 27.643319][ T491] SELinux: failed to load policy [ 27.659777][ T30] audit: type=1400 audit(1747988932.761:213): avc: denied { create } for pid=488 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.689118][ T501] loop4: detected capacity change from 0 to 512 [ 27.695664][ T495] syz.2.72 (495) used greatest stack depth: 21280 bytes left [ 27.701769][ T30] audit: type=1400 audit(1747988932.761:214): avc: denied { load_policy } for pid=488 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 27.728142][ T505] loop1: detected capacity change from 0 to 128 [ 27.752046][ T505] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 27.792951][ T515] netlink: 64 bytes leftover after parsing attributes in process `syz.2.81'. [ 27.803098][ T501] EXT4-fs (loop4): Ignoring removed bh option [ 27.809413][ T501] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 27.829522][ T501] EXT4-fs (loop4): 1 truncate cleaned up [ 27.835397][ T501] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,bh,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 27.931736][ T527] netlink: 96 bytes leftover after parsing attributes in process `syz.3.88'. [ 28.194977][ T307] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 28.470758][ T555] loop2: detected capacity change from 0 to 2048 [ 28.516731][ T555] EXT4-fs (loop2): mounted filesystem without journal. Opts: min_batch_time=0x000000007ffffffd,noblock_validity,grpquota,errors=remount-ro,. Quota mode: writeback. [ 28.536931][ T555] EXT4-fs error (device loop2): ext4_find_extent:929: inode #2: comm syz.2.99: pblk 1 bad header/extent: invalid magic - magic 2, entries 0, max 3(0), depth 0(4) [ 28.553766][ T555] EXT4-fs (loop2): Remounting filesystem read-only [ 28.565074][ T307] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.576322][ T307] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.586123][ T307] usb 5-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 28.595212][ T307] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.604038][ T307] usb 5-1: config 0 descriptor?? [ 28.813800][ T576] loop1: detected capacity change from 0 to 512 [ 28.867147][ T571] loop2: detected capacity change from 0 to 40427 [ 28.887811][ T576] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 28.901203][ T576] EXT4-fs (loop1): invalid journal inode [ 28.907592][ T576] EXT4-fs (loop1): can't get journal size [ 28.916191][ T571] F2FS-fs (loop2): Wrong SIT boundary, start(1536) end(50334208) blocks(1024) [ 28.919201][ T576] EXT4-fs (loop1): 1 truncate cleaned up [ 28.938283][ T571] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 28.944818][ T576] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,,errors=continue. Quota mode: none. [ 28.973235][ T571] F2FS-fs (loop2): invalid crc value [ 28.982654][ T571] F2FS-fs (loop2): Found nat_bits in checkpoint [ 29.034480][ T571] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 29.044566][ T571] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 29.086240][ T307] hid-thrustmaster 0003:044F:B65D.0001: unknown main item tag 0x0 [ 29.100279][ T307] hid-thrustmaster 0003:044F:B65D.0001: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.4-1/input0 [ 29.112882][ T307] hid-thrustmaster 0003:044F:B65D.0001: Wrong number of endpoints? [ 29.112893][ T285] attempt to access beyond end of device [ 29.112893][ T285] loop2: rw=2049, want=45104, limit=40427 [ 29.229833][ T611] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 29.366872][ T6] usb 5-1: USB disconnect, device number 2 [ 29.374950][ C1] hid-thrustmaster 0003:044F:B65D.0001: URB to get model id failed with error -71 [ 29.388823][ T628] input: syz1 as /devices/virtual/input/input4 [ 29.509818][ T647] IPv6: Can't replace route, no match found [ 29.585936][ T288] Bluetooth: hci0: command 0x1001 tx timeout [ 29.592450][ T319] Bluetooth: hci0: sending frame failed (-49) [ 29.852532][ T688] ======================================================= [ 29.852532][ T688] WARNING: The mand mount option has been deprecated and [ 29.852532][ T688] and is ignored by this kernel. Remove the mand [ 29.852532][ T688] option from the mount to silence this warning. [ 29.852532][ T688] ======================================================= [ 30.136181][ T718] loop3: detected capacity change from 0 to 256 [ 30.232765][ T722] overlayfs: missing 'lowerdir' [ 30.265434][ T724] loop3: detected capacity change from 0 to 4096 [ 30.286249][ T724] EXT4-fs (loop3): Test dummy encryption mode enabled [ 30.295841][ T724] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,nobarrier,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 30.353751][ T730] futex_wake_op: syz.1.178 tries to shift op by -1; fix this program [ 30.510332][ T748] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.518349][ T748] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.598660][ T748] syz.2.185 (748) used greatest stack depth: 21152 bytes left [ 30.645751][ T400] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 30.723836][ T767] kvm: MWAIT instruction emulated as NOP! [ 31.014992][ T400] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.025320][ T400] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 31.055592][ T797] loop3: detected capacity change from 0 to 40427 [ 31.105041][ T400] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 31.106863][ T797] F2FS-fs (loop3): invalid crc value [ 31.118110][ T400] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 31.128040][ T400] usb 2-1: SerialNumber: syz [ 31.134536][ T797] F2FS-fs (loop3): Found nat_bits in checkpoint [ 31.165543][ T797] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 31.242959][ T797] attempt to access beyond end of device [ 31.242959][ T797] loop3: rw=0, want=49160, limit=40427 [ 31.280855][ T797] attempt to access beyond end of device [ 31.280855][ T797] loop3: rw=2049, want=45112, limit=40427 [ 31.405786][ T400] usb 2-1: 0:2 : does not exist [ 31.411138][ T400] usb 2-1: unit 1 not found! [ 31.423615][ T400] usb 2-1: USB disconnect, device number 3 [ 31.433229][ T382] udevd[382]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.549723][ T817] loop3: detected capacity change from 0 to 512 [ 31.561446][ T817] EXT4-fs error (device loop3): ext4_orphan_get:1401: inode #15: comm syz.3.216: casefold flag without casefold feature [ 31.574540][ T817] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.216: couldn't read orphan inode 15 (err -117) [ 31.586905][ T817] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 31.641217][ T824] Zero length message leads to an empty skb [ 31.657613][ T826] loop3: detected capacity change from 0 to 256 [ 31.665019][ T20] Bluetooth: hci0: command 0x1009 tx timeout [ 32.019980][ T866] syz.1.238[866] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 32.020065][ T866] syz.1.238[866] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 32.067098][ T866] SELinux: failed to load policy [ 32.092547][ T870] netlink: 40 bytes leftover after parsing attributes in process `syz.3.240'. [ 32.101891][ T870] netlink: 40 bytes leftover after parsing attributes in process `syz.3.240'. [ 32.110929][ T870] netlink: 40 bytes leftover after parsing attributes in process `syz.3.240'. [ 32.120299][ T870] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 32.245477][ T888] loop1: detected capacity change from 0 to 1024 [ 32.298548][ T888] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 2: comm syz.1.248: lblock 2 mapped to illegal pblock 2 (length 1) [ 32.312702][ T888] __quota_error: 113 callbacks suppressed [ 32.312719][ T888] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 32.327236][ T888] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 48: comm syz.1.248: lblock 0 mapped to illegal pblock 48 (length 1) [ 32.341445][ T888] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 32.350303][ T888] EXT4-fs error (device loop1): ext4_acquire_dquot:6195: comm syz.1.248: Failed to acquire dquot type 0 [ 32.361637][ T888] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5866: Corrupt filesystem [ 32.371239][ T888] EXT4-fs error (device loop1): ext4_evict_inode:283: inode #11: comm syz.1.248: mark_inode_dirty error [ 32.384561][ T888] EXT4-fs warning (device loop1): ext4_evict_inode:286: couldn't mark inode dirty (err -117) [ 32.394871][ T888] EXT4-fs (loop1): 1 orphan inode deleted [ 32.400677][ T888] EXT4-fs (loop1): mounted filesystem without journal. Opts: auto_da_alloc,noblock_validity,init_itable,max_batch_time=0x00000000000008c9,nodiscard,inlinecrypt,i_version,,errors=continue. Quota mode: none. [ 32.432290][ T888] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #2: block 16: comm syz.1.248: lblock 0 mapped to illegal pblock 16 (length 1) [ 32.446789][ T10] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 32.461774][ T10] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 32.476508][ T10] EXT4-fs error (device loop1): ext4_release_dquot:6231: comm kworker/u4:1: Failed to release dquot type 0 [ 32.490486][ T282] EXT4-fs error (device loop1): __ext4_get_inode_loc:4352: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 32.503569][ T282] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5866: Corrupt filesystem [ 32.513370][ T282] EXT4-fs error (device loop1): ext4_quota_off:6501: inode #3: comm syz-executor: mark_inode_dirty error [ 32.539102][ T899] loop3: detected capacity change from 0 to 256 [ 32.646032][ T30] audit: type=1400 audit(1747988937.791:328): avc: denied { wake_alarm } for pid=906 comm="syz.2.256" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.893858][ T921] loop3: detected capacity change from 0 to 2048 [ 33.040220][ T936] loop2: detected capacity change from 0 to 512 [ 33.096197][ T936] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 33.134252][ T940] loop4: detected capacity change from 0 to 1024 [ 33.187045][ T936] EXT4-fs (loop2): 1 orphan inode deleted [ 33.194973][ T936] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.206743][ T940] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 33.210361][ T936] ext4 filesystem being mounted at /87/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.233721][ T30] audit: type=1400 audit(1747988938.371:329): avc: denied { write } for pid=949 comm="syz.3.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.277775][ T30] audit: type=1400 audit(1747988938.411:330): avc: denied { map } for pid=935 comm="syz.2.270" path="/87/file1/bus" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.300776][ T30] audit: type=1400 audit(1747988938.411:331): avc: denied { execute } for pid=935 comm="syz.2.270" path="/87/file1/bus" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.805020][ T39] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 34.165084][ T39] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 34.176204][ T39] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 34.345154][ T39] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.367580][ T39] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.381442][ T39] usb 3-1: Product: syz [ 34.385704][ T39] usb 3-1: Manufacturer: syz [ 34.390365][ T39] usb 3-1: SerialNumber: syz [ 34.404756][ T996] netlink: 40 bytes leftover after parsing attributes in process `syz.1.296'. [ 34.408950][ T995] loop3: detected capacity change from 0 to 1024 [ 34.415053][ T979] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 34.424544][ T996] netlink: 40 bytes leftover after parsing attributes in process `syz.1.296'. [ 34.436763][ T996] netlink: 40 bytes leftover after parsing attributes in process `syz.1.296'. [ 34.445898][ T996] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 34.477486][ T995] EXT4-fs error (device loop3): ext4_map_blocks:630: inode #3: block 2: comm syz.3.295: lblock 2 mapped to illegal pblock 2 (length 1) [ 34.485508][ T999] loop1: detected capacity change from 0 to 512 [ 34.496601][ T995] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 34.506626][ T995] EXT4-fs error (device loop3): ext4_map_blocks:630: inode #3: block 48: comm syz.3.295: lblock 0 mapped to illegal pblock 48 (length 1) [ 34.521048][ T995] Quota error (device loop3): v2_write_file_info: Can't write info structure [ 34.523369][ T999] EXT4-fs (loop1): Ignoring removed nobh option [ 34.530570][ T995] EXT4-fs error (device loop3): ext4_acquire_dquot:6195: comm syz.3.295: Failed to acquire dquot type 0 [ 34.548056][ T995] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5866: Corrupt filesystem [ 34.557704][ T995] EXT4-fs error (device loop3): ext4_evict_inode:283: inode #11: comm syz.3.295: mark_inode_dirty error [ 34.561034][ T999] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobh,stripe=0x0000000000010000,dioread_nolock,,errors=continue. Quota mode: none. [ 34.569290][ T995] EXT4-fs warning (device loop3): ext4_evict_inode:286: couldn't mark inode dirty (err -117) [ 34.593939][ T995] EXT4-fs (loop3): 1 orphan inode deleted [ 34.599777][ T995] EXT4-fs (loop3): mounted filesystem without journal. Opts: auto_da_alloc,noblock_validity,init_itable,max_batch_time=0x00000000000008c9,nodiscard,inlinecrypt,i_version,,errors=continue. Quota mode: none. [ 34.619985][ T322] EXT4-fs error (device loop3): ext4_map_blocks:630: inode #3: block 1: comm kworker/u4:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 34.634483][ T322] Quota error (device loop3): remove_tree: Can't read quota data block 1 [ 34.647871][ T322] EXT4-fs error (device loop3): ext4_release_dquot:6231: comm kworker/u4:3: Failed to release dquot type 0 [ 34.677554][ T995] EXT4-fs error (device loop3): ext4_map_blocks:630: inode #2: block 16: comm syz.3.295: lblock 0 mapped to illegal pblock 16 (length 1) [ 34.699246][ T281] EXT4-fs error (device loop3): __ext4_get_inode_loc:4352: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 34.713155][ T281] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5866: Corrupt filesystem [ 34.723151][ T281] EXT4-fs error (device loop3): ext4_quota_off:6501: inode #3: comm syz-executor: mark_inode_dirty error [ 35.037761][ T1010] loop4: detected capacity change from 0 to 40427 [ 35.065931][ T1010] F2FS-fs (loop4): fault_injection options not supported [ 35.074309][ T1010] F2FS-fs (loop4): invalid crc value [ 35.081487][ T1010] F2FS-fs (loop4): Found nat_bits in checkpoint [ 35.113472][ T1010] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 35.146372][ T1011] attempt to access beyond end of device [ 35.146372][ T1011] loop4: rw=2049, want=45104, limit=40427 [ 35.525041][ T39] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 35.531790][ T39] cdc_ncm 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 35.539366][ T39] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 35.745977][ T39] cdc_ncm 3-1:1.0: setting tx_max = 184 [ 35.767625][ T39] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM, 42:42:42:42:42:42 [ 35.779843][ T39] usb 3-1: USB disconnect, device number 2 [ 35.786050][ T39] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM [ 35.870091][ T1038] loop0: detected capacity change from 0 to 1024 [ 35.926284][ T1038] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 35.991292][ T1040] loop3: detected capacity change from 0 to 40427 [ 36.027271][ T1040] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 36.035864][ T1040] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 36.063081][ T1040] F2FS-fs (loop3): Found nat_bits in checkpoint [ 36.114181][ T1040] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 36.121400][ T1040] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 36.321996][ T1054] loop0: detected capacity change from 0 to 40427 [ 36.387631][ T1054] F2FS-fs (loop0): Found nat_bits in checkpoint [ 36.435859][ T1054] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 36.461338][ T1054] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 36.527769][ T1054] attempt to access beyond end of device [ 36.527769][ T1054] loop0: rw=0, want=77832, limit=40427 [ 36.535018][ T871] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 36.575320][ T283] attempt to access beyond end of device [ 36.575320][ T283] loop0: rw=2049, want=45104, limit=40427 [ 36.620812][ T1087] loop4: detected capacity change from 0 to 512 [ 36.665246][ T1087] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 36.673886][ T1087] EXT4-fs (loop4): orphan cleanup on readonly fs [ 36.689010][ T1087] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.331: invalid indirect mapped block 256 (level 2) [ 36.730960][ T1087] EXT4-fs (loop4): 2 truncates cleaned up [ 36.738621][ T1087] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 36.804649][ T1100] loop4: detected capacity change from 0 to 1024 [ 36.817199][ T1100] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 36.878740][ T1111] netlink: 20 bytes leftover after parsing attributes in process `syz.0.340'. [ 36.896148][ T1113] loop4: detected capacity change from 0 to 128 [ 36.912803][ T1113] EXT4-fs (loop4): mounted filesystem without journal. Opts: usrjquota=,bsddf,,errors=continue. Quota mode: none. [ 36.925139][ T871] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.942015][ T1113] ext4 filesystem being mounted at /43/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 36.954989][ T871] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.972975][ T871] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 36.988724][ T871] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 36.998124][ T871] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.007386][ T871] usb 3-1: config 0 descriptor?? [ 37.410818][ T1149] loop0: detected capacity change from 0 to 512 [ 37.431549][ T1149] EXT4-fs (loop0): test_dummy_encryption requires encrypt feature [ 37.500140][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.519994][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.528171][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.544468][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.558028][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.564310][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 37.564327][ T30] audit: type=1400 audit(1747988942.701:344): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 37.566392][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.626882][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.641432][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.650936][ T871] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 37.651675][ T1165] xt_hashlimit: max too large, truncated to 1048576 [ 37.659040][ T871] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 37.685820][ T871] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 37.796720][ T1170] loop0: detected capacity change from 0 to 1024 [ 37.809863][ T871] usb 3-1: USB disconnect, device number 3 [ 37.872343][ T1157] loop4: detected capacity change from 0 to 40427 [ 37.883361][ T1170] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 37.889211][ T1157] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 37.901931][ T400] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 37.925438][ T1157] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 37.933679][ T30] audit: type=1400 audit(1747988943.071:345): avc: denied { mounton } for pid=1169 comm="syz.0.365" path="/24/file1/bus" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 37.958982][ T30] audit: type=1400 audit(1747988943.071:346): avc: denied { map } for pid=1169 comm="syz.0.365" path="/24/file1/bus" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 37.962345][ T1170] EXT4-fs error (device loop0): ext4_xattr_ibody_get:603: inode #18: comm syz.0.365: corrupted in-inode xattr [ 37.996297][ T1157] F2FS-fs (loop4): Found nat_bits in checkpoint [ 38.005024][ T1170] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.365: Invalid block bitmap block 0 in block_group 0 [ 38.055327][ T1157] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 38.065140][ T283] EXT4-fs error (device loop0): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 11 [ 38.075688][ T1172] loop3: detected capacity change from 0 to 40427 [ 38.078281][ T1157] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 38.084847][ T283] EXT4-fs error (device loop0): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 11 [ 38.163309][ T1172] F2FS-fs (loop3): Found nat_bits in checkpoint [ 38.228157][ T1172] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 38.230405][ T30] audit: type=1400 audit(1747988943.371:347): avc: denied { execmem } for pid=1182 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 38.261499][ T1172] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 38.306827][ T30] audit: type=1400 audit(1747988943.451:348): avc: denied { mounton } for pid=1184 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 38.329161][ T400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.342484][ T400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.371197][ T400] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 38.381951][ T400] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.408446][ T400] usb 2-1: config 0 descriptor?? [ 38.433983][ T1172] attempt to access beyond end of device [ 38.433983][ T1172] loop3: rw=0, want=77832, limit=40427 [ 38.456468][ T281] attempt to access beyond end of device [ 38.456468][ T281] loop3: rw=2049, want=45104, limit=40427 [ 38.487064][ T1184] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.498299][ T1184] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.508411][ T1184] device bridge_slave_0 entered promiscuous mode [ 38.524515][ T1184] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.532552][ T1184] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.540274][ T1184] device bridge_slave_1 entered promiscuous mode [ 38.607247][ T30] audit: type=1400 audit(1747988943.751:349): avc: denied { relabelfrom } for pid=1199 comm="syz.3.373" name="" dev="pipefs" ino=19545 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 38.656583][ T1184] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.664503][ T1184] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.672136][ T1184] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.679205][ T1184] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.709339][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.718450][ T895] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.726371][ T895] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.744854][ T10] device bridge_slave_1 left promiscuous mode [ 38.751387][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.759701][ T10] device bridge_slave_0 left promiscuous mode [ 38.766038][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.774421][ T10] device veth1_macvtap left promiscuous mode [ 38.781784][ T10] device veth0_vlan left promiscuous mode [ 38.869829][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.878475][ T895] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.885592][ T895] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.893811][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.902883][ T895] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.905847][ T400] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 38.910102][ T895] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.926551][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.934674][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.935959][ T400] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0003/input/input5 [ 38.954688][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.968933][ T1184] device veth0_vlan entered promiscuous mode [ 38.975916][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.984502][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.992713][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.009929][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.018877][ T1184] device veth1_macvtap entered promiscuous mode [ 39.031266][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.041895][ T400] keytouch 0003:0926:3333.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 39.061468][ T895] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.083636][ T30] audit: type=1400 audit(1747988944.221:350): avc: denied { mounton } for pid=1184 comm="syz-executor" path="/root/syzkaller.ONs3PY/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 39.151621][ T1205] loop5: detected capacity change from 0 to 512 [ 39.158964][ T400] usb 2-1: USB disconnect, device number 4 [ 39.179022][ T30] audit: type=1400 audit(1747988944.221:351): avc: denied { mount } for pid=1184 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 39.203709][ T30] audit: type=1400 audit(1747988944.221:352): avc: denied { mounton } for pid=1184 comm="syz-executor" path="/root/syzkaller.ONs3PY/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 39.233825][ T30] audit: type=1400 audit(1747988944.221:353): avc: denied { mounton } for pid=1184 comm="syz-executor" path="/root/syzkaller.ONs3PY/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=19248 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 39.276808][ T1205] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 39.296516][ T1205] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.634339][ T1228] loop3: detected capacity change from 0 to 2048 [ 39.642180][ T1219] loop4: detected capacity change from 0 to 40427 [ 39.691317][ T1219] F2FS-fs (loop4): invalid crc value [ 39.716420][ T1228] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 39.734330][ T1219] F2FS-fs (loop4): Found nat_bits in checkpoint [ 39.793856][ T1219] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 40.062011][ T1264] loop1: detected capacity change from 0 to 512 [ 40.134682][ T284] attempt to access beyond end of device [ 40.134682][ T284] loop4: rw=2049, want=45104, limit=40427 [ 40.185861][ T1264] EXT4-fs (loop1): orphan cleanup on readonly fs [ 40.213052][ T1264] EXT4-fs warning (device loop1): ext4_enable_quotas:6447: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 40.219765][ T1281] loop3: detected capacity change from 0 to 512 [ 40.247417][ T1264] EXT4-fs (loop1): Cannot turn on quotas: error -117 [ 40.260305][ T1264] EXT4-fs error (device loop1): ext4_orphan_get:1406: comm syz.1.397: couldn't read orphan inode 26 (err -116) [ 40.281052][ T1264] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobarrier,noblock_validity,bsdgroups,journal_dev=0x000000000000000b,barrier=0x0000000000000081,minixdf,stripe=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 40.336027][ T1281] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,nodiscard,min_batch_time=0x00000000000003ff,,errors=continue. Quota mode: none. [ 40.356420][ T1264] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 40.425026][ T307] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 40.454119][ T1264] EXT4-fs warning (device loop1): ext4_enable_quotas:6447: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 40.474219][ T1288] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 40.486638][ T1294] device batadv_slave_1 entered promiscuous mode [ 40.497843][ T1288] EXT4-fs warning (device loop1): ext4_enable_quotas:6447: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 40.544024][ T282] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /60/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 40.590209][ T282] EXT4-fs error (device loop1): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 16 [ 40.609772][ T1293] device batadv_slave_1 left promiscuous mode [ 40.613887][ T282] EXT4-fs error (device loop1): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 16 [ 40.706635][ T1316] loop3: detected capacity change from 0 to 1024 [ 40.714964][ T1316] EXT4-fs (loop3): Ignoring removed orlov option [ 40.721691][ T1316] EXT4-fs (loop3): Test dummy encryption mode enabled [ 40.729655][ T1316] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 40.741024][ T1316] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (12914!=20869) [ 40.754325][ T1316] EXT4-fs error (device loop3): __ext4_iget:4924: inode #2: block 127754: comm syz.3.417: invalid block [ 40.766828][ T1316] EXT4-fs (loop3): no journal found [ 40.772197][ T1316] EXT4-fs (loop3): can't get journal size [ 40.778902][ T1316] EXT4-fs error (device loop3): __ext4_iget:4924: inode #2: block 127754: comm syz.3.417: invalid block [ 40.785131][ T307] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 40.802155][ T307] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 40.812068][ T1316] EXT4-fs (loop3): get root inode failed [ 40.819796][ T1316] EXT4-fs (loop3): mount failed [ 40.948541][ T1325] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.964712][ T1325] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.976831][ T307] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 40.986957][ T1325] device bridge_slave_0 entered promiscuous mode [ 40.994020][ T307] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.006255][ T1325] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.014080][ T307] usb 6-1: Product: syz [ 41.019071][ T1325] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.027180][ T307] usb 6-1: Manufacturer: syz [ 41.032210][ T307] usb 6-1: SerialNumber: syz [ 41.037938][ T1325] device bridge_slave_1 entered promiscuous mode [ 41.064434][ T1336] loop3: detected capacity change from 0 to 512 [ 41.076598][ T1275] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.087758][ T1336] EXT4-fs error (device loop3): ext4_orphan_get:1401: inode #15: comm syz.3.427: casefold flag without casefold feature [ 41.103445][ T1336] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.427: couldn't read orphan inode 15 (err -117) [ 41.116516][ T1336] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 41.214242][ T1325] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.221466][ T1325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.228950][ T1325] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.236602][ T1325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.268922][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.287272][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.300982][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.336543][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.346143][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.353412][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.364501][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.374077][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.381794][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.403409][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.411935][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.433044][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.455165][ T1325] device veth0_vlan entered promiscuous mode [ 41.462712][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.472014][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.480720][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.503929][ T1325] device veth1_macvtap entered promiscuous mode [ 41.512355][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.532678][ T1350] loop3: detected capacity change from 0 to 40427 [ 41.543194][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.562761][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.582741][ T1350] F2FS-fs (loop3): Found nat_bits in checkpoint [ 41.641782][ T1350] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 41.664626][ T1350] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 41.739941][ T1350] attempt to access beyond end of device [ 41.739941][ T1350] loop3: rw=10241, want=53256, limit=40427 [ 41.763645][ T281] attempt to access beyond end of device [ 41.763645][ T281] loop3: rw=2049, want=45104, limit=40427 [ 41.866085][ T895] device bridge_slave_1 left promiscuous mode [ 41.872414][ T895] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.880504][ T895] device bridge_slave_0 left promiscuous mode [ 41.887414][ T895] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.896275][ T895] device veth1_macvtap left promiscuous mode [ 41.902531][ T895] device veth0_vlan left promiscuous mode [ 41.940792][ T1373] loop3: detected capacity change from 0 to 1024 [ 41.955230][ T1373] EXT4-fs (loop3): Ignoring removed nobh option [ 41.964439][ T1373] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 41.987217][ T1373] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,grpid,barrier=0x0000000000000001,bsdgroups,nouid32,max_dir_size_kb=0x00000000004007b1,abort,grpquota,nobh,user_xattr,dioread_lock,dioread_nolock,,errors=continue. Quota mode: writeback. [ 42.018922][ T1373] EXT4-fs warning (device loop3): ext4_rename_delete:3792: inode #12: comm syz.3.440: Deleting old file: nlink 2, error=-2 [ 42.085064][ T26] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 42.171177][ T1380] capability: warning: `syz.3.443' uses 32-bit capabilities (legacy support in use) [ 42.178592][ T1382] loop4: detected capacity change from 0 to 512 [ 42.196790][ T1382] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 42.206850][ T307] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 42.213652][ T307] cdc_ncm 6-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 42.228963][ T307] cdc_ncm 6-1:1.0: setting rx_max = 2048 [ 42.233034][ T1382] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2825: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 42.255208][ T1382] EXT4-fs (loop4): 1 truncate cleaned up [ 42.260902][ T1382] EXT4-fs (loop4): mounted filesystem without journal. Opts: nogrpid,min_batch_time=0x0000000000000004,debug_want_extra_isize=0x0000000000000068,nobarrier,nodiscard,quota,,errors=continue. Quota mode: writeback. [ 42.322755][ T1390] loop3: detected capacity change from 0 to 1024 [ 42.328420][ T284] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /64/file2/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 42.352881][ T284] EXT4-fs error (device loop4): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 42.353598][ T1390] EXT4-fs (loop3): Ignoring removed oldalloc option [ 42.373803][ T26] usb 7-1: Using ep0 maxpacket: 8 [ 42.386313][ T284] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /64/file2/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 42.409836][ T284] EXT4-fs error (device loop4): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 42.415083][ T307] cdc_ncm 6-1:1.0: setting tx_max = 184 [ 42.430847][ T284] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /64/file2/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 42.458096][ T284] EXT4-fs error (device loop4): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 42.478741][ T284] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /64/file2/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 42.480382][ T307] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM, 42:42:42:42:42:42 [ 42.512260][ T284] EXT4-fs error (device loop4): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 42.521546][ T307] usb 6-1: USB disconnect, device number 2 [ 42.538864][ T284] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /64/file2/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 42.560685][ T26] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 42.566760][ T284] EXT4-fs error (device loop4): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 42.573372][ T30] kauditd_printk_skb: 55 callbacks suppressed [ 42.573390][ T30] audit: type=1400 audit(1747988947.711:406): avc: denied { search } for pid=140 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.643240][ T26] usb 7-1: config 179 has no interface number 0 [ 42.651394][ T307] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM [ 42.676653][ T26] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 42.705496][ T1394] netlink: 96 bytes leftover after parsing attributes in process `syz.2.448'. [ 42.714985][ T26] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 42.741387][ T30] audit: type=1400 audit(1747988947.771:407): avc: denied { read } for pid=140 comm="dhcpcd" name="n16" dev="tmpfs" ino=3086 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.750885][ T26] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 42.787179][ T26] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 42.800377][ T26] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 42.817134][ T26] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 42.820724][ T30] audit: type=1400 audit(1747988947.771:408): avc: denied { open } for pid=140 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=3086 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.835003][ T26] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.856107][ T30] audit: type=1400 audit(1747988947.771:409): avc: denied { getattr } for pid=140 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=3086 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.885588][ T1386] ================================================================== [ 42.893793][ T1386] BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x120 [ 42.901768][ T1386] Read of size 8 at addr ffff888111644c70 by task kworker/1:5/1386 [ 42.903476][ T30] audit: type=1400 audit(1747988947.871:410): avc: denied { read } for pid=1396 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.909672][ T1386] [ 42.909689][ T1386] CPU: 1 PID: 1386 Comm: kworker/1:5 Not tainted 5.15.184-syzkaller-00118-g4b77ae0e7f58 #0 [ 42.909712][ T1386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 42.909723][ T1386] Workqueue: events_long br_fdb_cleanup [ 42.909759][ T1386] Call Trace: [ 42.909765][ T1386] [ 42.909772][ T1386] __dump_stack+0x21/0x30 [ 42.909791][ T1386] dump_stack_lvl+0xee/0x150 [ 42.909807][ T1386] ? show_regs_print_info+0x20/0x20 [ 42.935054][ T30] audit: type=1400 audit(1747988947.871:411): avc: denied { open } for pid=1396 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.945489][ T1386] ? load_image+0x3a0/0x3a0 [ 42.945525][ T1386] print_address_description+0x7f/0x2c0 [ 42.945548][ T1386] ? __list_del_entry_valid+0xa6/0x120 [ 42.945569][ T1386] kasan_report+0xf1/0x140 [ 42.945588][ T1386] ? __list_del_entry_valid+0xa6/0x120 [ 42.945608][ T1386] __asan_report_load8_noabort+0x14/0x20 [ 42.945627][ T1386] __list_del_entry_valid+0xa6/0x120 [ 42.945645][ T1386] process_one_work+0x453/0xba0 [ 42.945669][ T1386] worker_thread+0xa59/0x1200 [ 42.945687][ T1386] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 42.945714][ T1386] kthread+0x411/0x500 [ 42.956967][ T30] audit: type=1400 audit(1747988947.871:412): avc: denied { getattr } for pid=1396 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.961491][ T1386] ? worker_clr_flags+0x190/0x190 [ 42.961524][ T1386] ? kthread_blkcg+0xd0/0xd0 [ 42.965219][ T30] audit: type=1400 audit(1747988947.881:413): avc: denied { bind } for pid=1399 comm="syz.3.449" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.967903][ T1386] ret_from_fork+0x1f/0x30 [ 42.967932][ T1386] [ 42.967940][ T1386] [ 42.967945][ T1386] Allocated by task 307: [ 42.972506][ T30] audit: type=1400 audit(1747988947.891:414): avc: denied { listen } for pid=1399 comm="syz.3.449" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.977030][ T1386] __kasan_kmalloc+0xda/0x110 [ 42.977053][ T1386] __kmalloc+0x13d/0x2c0 [ 42.977070][ T1386] kvmalloc_node+0x242/0x330 [ 42.982954][ T30] audit: type=1400 audit(1747988947.961:415): avc: denied { read } for pid=1399 comm="syz.3.449" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 43.007545][ T1386] alloc_netdev_mqs+0x8d/0xc90 [ 43.007576][ T1386] alloc_etherdev_mqs+0x34/0x40 [ 43.007594][ T1386] usbnet_probe+0x219/0x2860 [ 43.007612][ T1386] usb_probe_interface+0x5ff/0xae0 [ 43.207957][ T1386] really_probe+0x285/0x970 [ 43.212491][ T1386] __driver_probe_device+0x198/0x280 [ 43.217807][ T1386] driver_probe_device+0x54/0x3e0 [ 43.222855][ T1386] __device_attach_driver+0x2a6/0x460 [ 43.228251][ T1386] bus_for_each_drv+0x175/0x200 [ 43.233302][ T1386] __device_attach+0x2a2/0x400 [ 43.238087][ T1386] device_initial_probe+0x1a/0x20 [ 43.243264][ T1386] bus_probe_device+0xc0/0x1e0 [ 43.248206][ T1386] device_add+0xb31/0xed0 [ 43.252571][ T1386] usb_set_configuration+0x19c2/0x1f10 [ 43.258159][ T1386] usb_generic_driver_probe+0x91/0x150 [ 43.264178][ T1386] usb_probe_device+0x148/0x260 [ 43.269163][ T1386] really_probe+0x285/0x970 [ 43.274046][ T1386] __driver_probe_device+0x198/0x280 [ 43.280197][ T1386] driver_probe_device+0x54/0x3e0 [ 43.285447][ T1386] __device_attach_driver+0x2a6/0x460 [ 43.291314][ T1386] bus_for_each_drv+0x175/0x200 [ 43.296727][ T1386] __device_attach+0x2a2/0x400 [ 43.302109][ T1386] device_initial_probe+0x1a/0x20 [ 43.307158][ T1386] bus_probe_device+0xc0/0x1e0 [ 43.311951][ T1386] device_add+0xb31/0xed0 [ 43.316601][ T1386] usb_new_device+0xd06/0x1620 [ 43.321473][ T1386] hub_event+0x27d8/0x42c0 [ 43.326010][ T1386] process_one_work+0x6be/0xba0 [ 43.330911][ T1386] worker_thread+0xa59/0x1200 [ 43.339098][ T1386] kthread+0x411/0x500 [ 43.343369][ T1386] ret_from_fork+0x1f/0x30 [ 43.347823][ T1386] [ 43.350156][ T1386] Freed by task 307: [ 43.354250][ T1386] kasan_set_track+0x4a/0x70 [ 43.359208][ T1386] kasan_set_free_info+0x23/0x40 [ 43.365043][ T1386] ____kasan_slab_free+0x125/0x160 [ 43.370965][ T1386] __kasan_slab_free+0x11/0x20 [ 43.376211][ T1386] slab_free_freelist_hook+0xc2/0x190 [ 43.381926][ T1386] kfree+0xc4/0x270 [ 43.385774][ T1386] kvfree+0x35/0x40 [ 43.389799][ T1386] netdev_freemem+0x3f/0x60 [ 43.394574][ T1386] netdev_release+0x7f/0xb0 [ 43.399103][ T1386] device_release+0x96/0x1c0 [ 43.403754][ T1386] kobject_put+0x18a/0x270 [ 43.408478][ T1386] put_device+0x1f/0x30 [ 43.412662][ T1386] free_netdev+0x34b/0x450 [ 43.417131][ T1386] usbnet_disconnect+0x24b/0x3a0 [ 43.422295][ T1386] usb_unbind_interface+0x212/0x8c0 [ 43.427630][ T1386] device_release_driver_internal+0x4c1/0x760 [ 43.433857][ T1386] device_release_driver+0x19/0x20 [ 43.450327][ T1386] bus_remove_device+0x2dd/0x340 [ 43.456272][ T1386] device_del+0x696/0xe90 [ 43.460721][ T1386] usb_disable_device+0x3a8/0x750 [ 43.466122][ T1386] usb_disconnect+0x31e/0x850 [ 43.470816][ T1386] hub_event+0x190c/0x42c0 [ 43.475502][ T1386] process_one_work+0x6be/0xba0 [ 43.481134][ T1386] worker_thread+0xd7b/0x1200 [ 43.487013][ T1386] kthread+0x411/0x500 [ 43.491647][ T1386] ret_from_fork+0x1f/0x30 [ 43.496337][ T1386] [ 43.498946][ T1386] Last potentially related work creation: [ 43.506612][ T1386] kasan_save_stack+0x3a/0x60 [ 43.512420][ T1386] __kasan_record_aux_stack+0xd2/0x100 [ 43.519383][ T1386] kasan_record_aux_stack_noalloc+0xb/0x10 [ 43.525926][ T1386] insert_work+0x51/0x310 [ 43.530432][ T1386] __queue_work+0x8e5/0xc60 [ 43.535332][ T1386] queue_work_on+0xd2/0x140 [ 43.540737][ T1386] usbnet_link_change+0x176/0x1a0 [ 43.546395][ T1386] usbnet_probe+0x1dfd/0x2860 [ 43.552000][ T1386] usb_probe_interface+0x5ff/0xae0 [ 43.558098][ T1386] really_probe+0x285/0x970 [ 43.563372][ T1386] __driver_probe_device+0x198/0x280 [ 43.568671][ T1386] driver_probe_device+0x54/0x3e0 [ 43.574223][ T1386] __device_attach_driver+0x2a6/0x460 [ 43.579837][ T1386] bus_for_each_drv+0x175/0x200 [ 43.585713][ T1386] __device_attach+0x2a2/0x400 [ 43.591573][ T1386] device_initial_probe+0x1a/0x20 [ 43.597669][ T1386] bus_probe_device+0xc0/0x1e0 [ 43.602816][ T1386] device_add+0xb31/0xed0 [ 43.607687][ T1386] usb_set_configuration+0x19c2/0x1f10 [ 43.614522][ T1386] usb_generic_driver_probe+0x91/0x150 [ 43.620724][ T1386] usb_probe_device+0x148/0x260 [ 43.626120][ T1386] really_probe+0x285/0x970 [ 43.632572][ T1386] __driver_probe_device+0x198/0x280 [ 43.638165][ T1386] driver_probe_device+0x54/0x3e0 [ 43.643445][ T1386] __device_attach_driver+0x2a6/0x460 [ 43.649326][ T1386] bus_for_each_drv+0x175/0x200 [ 43.656650][ T1386] __device_attach+0x2a2/0x400 [ 43.663024][ T1386] device_initial_probe+0x1a/0x20 [ 43.668399][ T1386] bus_probe_device+0xc0/0x1e0 [ 43.673672][ T1386] device_add+0xb31/0xed0 [ 43.678008][ T1386] usb_new_device+0xd06/0x1620 [ 43.683035][ T1386] hub_event+0x27d8/0x42c0 [ 43.687465][ T1386] process_one_work+0x6be/0xba0 [ 43.692781][ T1386] worker_thread+0xa59/0x1200 [ 43.698336][ T1386] kthread+0x411/0x500 [ 43.702425][ T1386] ret_from_fork+0x1f/0x30 [ 43.707448][ T1386] [ 43.709802][ T1386] The buggy address belongs to the object at ffff888111644000 [ 43.709802][ T1386] which belongs to the cache kmalloc-4k of size 4096 [ 43.725391][ T1386] The buggy address is located 3184 bytes inside of [ 43.725391][ T1386] 4096-byte region [ffff888111644000, ffff888111645000) [ 43.739937][ T1386] The buggy address belongs to the page: [ 43.745742][ T1386] page:ffffea0004459000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111640 [ 43.756713][ T1386] head:ffffea0004459000 order:3 compound_mapcount:0 compound_pincount:0 [ 43.765493][ T1386] flags: 0x4000000000010200(slab|head|zone=1) [ 43.771764][ T1386] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043380 [ 43.780649][ T1386] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 43.789554][ T1386] page dumped because: kasan: bad access detected [ 43.797295][ T1386] page_owner tracks the page as allocated [ 43.803016][ T1386] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 307, ts 41103173702, free_ts 41048459363 [ 43.827939][ T1386] post_alloc_hook+0x192/0x1b0 [ 43.833506][ T1386] prep_new_page+0x1c/0x110 [ 43.838568][ T1386] get_page_from_freelist+0x2cc5/0x2d50 [ 43.844135][ T1386] __alloc_pages+0x18f/0x440 [ 43.849175][ T1386] new_slab+0xa1/0x4d0 [ 43.853317][ T1386] ___slab_alloc+0x381/0x810 [ 43.858056][ T1386] __slab_alloc+0x49/0x90 [ 43.862578][ T1386] __kmalloc+0x16a/0x2c0 [ 43.867028][ T1386] kvmalloc_node+0x242/0x330 [ 43.871755][ T1386] alloc_netdev_mqs+0x8d/0xc90 [ 43.876839][ T1386] alloc_etherdev_mqs+0x34/0x40 [ 43.881880][ T1386] usbnet_probe+0x219/0x2860 [ 43.886726][ T1386] usb_probe_interface+0x5ff/0xae0 [ 43.892017][ T1386] really_probe+0x285/0x970 [ 43.896756][ T1386] __driver_probe_device+0x198/0x280 [ 43.902183][ T1386] driver_probe_device+0x54/0x3e0 [ 43.907525][ T1386] page last free stack trace: [ 43.912799][ T1386] free_unref_page_prepare+0x542/0x550 [ 43.919049][ T1386] free_unref_page+0xa2/0x550 [ 43.924445][ T1386] __free_pages+0x6c/0x100 [ 43.928973][ T1386] __free_slab+0xe8/0x1e0 [ 43.933789][ T1386] __unfreeze_partials+0x160/0x190 [ 43.939695][ T1386] put_cpu_partial+0xc6/0x120 [ 43.944597][ T1386] __slab_free+0x1d4/0x290 [ 43.949472][ T1386] ___cache_free+0x104/0x120 [ 43.954604][ T1386] qlink_free+0x4d/0x90 [ 43.959138][ T1386] qlist_free_all+0x5f/0xb0 [ 43.964290][ T1386] kasan_quarantine_reduce+0x14a/0x170 [ 43.970519][ T1386] __kasan_slab_alloc+0x2f/0xf0 [ 43.976485][ T1386] slab_post_alloc_hook+0x4f/0x2b0 [ 43.982706][ T1386] kmem_cache_alloc_trace+0xfb/0x270 [ 43.990648][ T1386] kset_create_and_add+0x59/0x2b0 [ 43.996803][ T1386] netdev_register_kobject+0x1a5/0x320 [ 44.004203][ T1386] [ 44.008102][ T1386] Memory state around the buggy address: [ 44.014715][ T1386] ffff888111644b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.023569][ T1386] ffff888111644b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.032173][ T1386] >ffff888111644c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.041286][ T1386] ^ [ 44.050193][ T1386] ffff888111644c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.059705][ T1386] ffff888111644d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.068373][ T1386] ================================================================== [ 44.077980][ T1386] Disabling lock debugging due to kernel taint [ 44.115468][ T1369] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 44.396246][ T26] input: Generic X-Box pad as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:179.65/input/input6 [ 44.577465][ T871] usb 7-1: USB disconnect, device number 2 [ 44.594956][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 44.604133][ T871] xpad 7-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 44.942734][ T895] device bridge_slave_1 left promiscuous mode [ 44.949697][ T895] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.960093][ T895] device bridge_slave_0 left promiscuous mode [ 44.967364][ T895] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.976121][ T895] device veth1_macvtap left promiscuous mode [ 44.982861][ T895] device veth0_vlan left promiscuous mode