last executing test programs: 17.078193728s ago: executing program 4 (id=2836): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x100000, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005e00"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000080)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') socket$kcm(0x10, 0x2, 0x4) listen(0xffffffffffffffff, 0xffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r4, 0x80044940, &(0x7f0000000240)=0x14) read(r4, &(0x7f00000019c0)=""/4097, 0x1001) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20004882) symlink(0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) lseek(r1, 0x1000000, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x18, 0x0, 0x0, 0x0, 0x4}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001c00357428bd7000fed3df25020000", @ANYRES32=r6, @ANYBLOB="040082040a0001000180b6fc8d5800010000"], 0x28}, 0x306}, 0x80c0) 12.46903313s ago: executing program 4 (id=2848): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001540)={0x11, 0x15, &(0x7f0000001fc0)=ANY=[@ANYBLOB="1800000009000000000000000800000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000950000000000000085100000f8ffffff85200000030000007c6518000400000018000000faffffff000000000d000000bf9100000084260f263e7495751b5bb0000000b7020000000000008500000084000000b700000000a5958d34ea5ca5a3a94e7bca81f541a1dd7967089733f984357c1d0bdade7ca1addfc6b12ebf24c4c81f03ceecfd9fb9014e4d1046c8de28e6b3596f7176e0a8bb7e0d000790a483c1d74340e9b5242c59297950348843440b40ce638f7423b0b95b21b24c16e6d9fc8320dbc719e37d830736246f5c83360c46da169c9271186c8aab7b3305a12f289141414a50f0184eff357c3e5f36ef"], &(0x7f0000000280)='GPL\x00', 0x1200000, 0x1000, &(0x7f0000000400)=""/4096, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001400)={0x1, 0x2, 0x80000000, 0x2}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000001440)=[r0, r0, r0, 0xffffffffffffffff, 0x1, r0], &(0x7f0000001480)=[{0x4, 0x2, 0x7, 0x5}, {0x4, 0x2, 0xc, 0x6}, {0x4, 0x1, 0x8, 0x5}, {0x1, 0x1, 0xc, 0x5}, {0x5, 0x3, 0x5, 0x1}, {0x4, 0x4, 0x4, 0x4}, {0x0, 0x5, 0x8, 0x9}, {0x3, 0x3, 0x2, 0xc}, {0x2, 0x1, 0x3, 0x9}], 0x10, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x10, &(0x7f00000002c0)=ANY=[@ANYBLOB="18120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000008000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000008500000082000000183000000200"/72], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x62, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x780}, 0x94) eventfd(0x3) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x8000, 0x0) getdents64(r2, &(0x7f0000000e00)=""/4102, 0x1006) r3 = creat(&(0x7f0000000200)='./file0\x00', 0x17e) close(r3) lseek(0xffffffffffffffff, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r6, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r5, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) 9.018876467s ago: executing program 0 (id=2856): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0xffffffffffffffff, 0x4, &(0x7f0000000080)={0x10002, 0x10000009}, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) unshare(0x60040000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r4, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x18) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x17, 0x0, 'lblcr\x00', 0xd, 0x38, 0x5d}, 0x2c) socket$kcm(0xa, 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@local}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) 8.135161723s ago: executing program 2 (id=2858): mknod$loop(0x0, 0x6000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) writev(r4, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}, {0x0, 0x900}], 0x2) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="05072bbd7000ffdbdf2501000000100002800c00"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_IFNAME={0x14, 0x3, 'ipvlan1\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6, 0x1, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x8040) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000100)=[{'SPEAKER', @val={' \'', 'Capture'}}], 0x27) syz_emit_vhci(&(0x7f0000000780)=ANY=[@ANYBLOB="02c93010000c0005"], 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0xe) io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000040)={0x191, 0x258, 0x300, 0x3f, 0x100032, 0x1, 0x0, 0x0, {}, {0x0, 0x0, 0x20000000}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe07, 0x0, 0x0, 0xfffffffe, 0x0, 0x4, 0x0, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 8.125766729s ago: executing program 4 (id=2859): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x1c0) statx(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x100, 0x7ff, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_io_uring_setup(0x12e, &(0x7f0000000340)={0x0, 0x5cb1, 0x2, 0x3, 0xfffffffd}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f00000003c0)) r4 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc4c85513, &(0x7f0000000b80)={0x7, 0x0, 0x2008, 0x7, 'syz1\x00', 0x900005}) r5 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r5, 0x0, 0x60, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x44) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0x206, 0x0, 0x4) io_uring_enter(r2, 0x1e76, 0xf728, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000ffa000/0x1000)=nil) io_uring_register$IORING_REGISTER_IOWQ_AFF(r2, 0x11, &(0x7f0000000040)="732fbfdb019d7da37edad2e06a44164ecdaa2c0071e55d0f2412f7561e683df8bf8bec", 0x23) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000007, 0x40032, 0xffffffffffffffff, 0x40000000) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110e22fff6) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r7, 0x4004743d, 0x110e22ffe6) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0xa600, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r9, 0xc0285700, &(0x7f0000000440)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r10, 0xc0303e03, &(0x7f0000000140)={"400add079f2b765e989bc2efc4cbfd90f3f00d7cfd3daa4e8a0e47a79aa1737f", 0xffffffffffffffff, 0xffffffffffffffff, 0x500}) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYRES8=r7], 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 7.851299617s ago: executing program 0 (id=2860): sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)}, 0x4010) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r2}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x0, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x200, 0x1, &(0x7f0000000440)=[r2], &(0x7f0000000200), &(0x7f0000000300)=[r3], &(0x7f0000000340)}) 6.996057936s ago: executing program 2 (id=2861): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, 0x0) ioctl$VIDIOC_G_CTRL(0xffffffffffffffff, 0xc008561b, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r4) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) ioctl$VIDIOC_DBG_G_CHIP_INFO(0xffffffffffffffff, 0xc0c85666, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x4044040) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a31000000001400038010000080"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r9, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NL80211_CMD_TDLS_OPER(r6, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000440)={0x48, r7, 0x20, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x1}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x2}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x4}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x2}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x40010}, 0x24004800) sendmsg$TIPC_CMD_GET_NODES(r8, &(0x7f0000000600)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) 6.526610474s ago: executing program 0 (id=2862): pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0xfffffcfa}], 0x1, 0x2) r2 = socket$inet(0x2, 0x3, 0x7f) splice(r0, 0x0, r2, 0x0, 0x8000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)=@delchain={0x1ec, 0x65, 0x2, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x1b0, 0x2, [@TCA_BPF_ACT={0x124, 0x1, [@m_gact={0x120, 0xb, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x7, 0x4, 0x0, 0xd, 0x6d4c}}]}, {0xd9, 0x6, "3532565adeea82a6d355b04e82cf0d976e9e3d561f7832a2553c4393a1a4d9d755a3ca015b8308cae8430cb3ee720daf513b7d09d45af79089af4ca0f7ae568b98646f301384cfe6ba628a461810b458401b48d92b11c4b84c4fc318de1f6827de4e78cdbcf73ddf84c995030329bc7513206fbbbaff80269acd40d48bee53c5d29ae26ac4f4be644348ff30d97b9cb02360266994fa3a862b1418bc3eaede1bb9463c1926a947cf619ae9e30d95e4fafecf091aba5ad491096d09ff089a4344e72ae7c5fcb84862d7cba26dd8f3a4c326a5596ea8"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x70, 0x1, [@m_connmark={0x6c, 0xc05, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0x2, 0x10000000, 0x9, 0x4}, 0x1e}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffc, 0x7, 0x0, 0x7, 0x9}, 0x25}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_BPF_OPS={{0x6}, {0x4}}]}}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mknod$loop(&(0x7f0000001fc0)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x400, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r6 = socket$packet(0x11, 0x2, 0x300) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="7000000010000100"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000500012800e0001006970366772657461700000003c000280140007002001000000000000000000000000000014000600fe80000000000000000000000000001508000100", @ANYRES32=r8, @ANYBLOB='\b\x00\r'], 0x70}}, 0x0) sendto$packet(r6, 0x0, 0x300, 0x15, &(0x7f0000000400)={0x11, 0x88a8, r8, 0x1, 0x0, 0x6, @multicast}, 0x6e) 4.932033995s ago: executing program 0 (id=2864): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000001280)=ANY=[@ANYBLOB], 0xd0}}, 0x0) ioperm(0x1, 0x9, 0x4) prctl$PR_SET_SECCOMP(0x16, 0xe7, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 4.127967804s ago: executing program 0 (id=2865): r0 = socket$packet(0x11, 0x2, 0x300) socket$inet(0x2, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x1800, 0x0) write(r0, &(0x7f00000005c0)="184f71530df5e0f672f7dd7f72ecc4c2ac7ccadabcc92d8d693b964f082767043dd090471d07d33f3e17c811ae3ca6ab7505a0b27ee4cc40e3b252d862b4be2bfa098a2f4169b0745a90306b477eff73e027b31729239d99d1c50da7bee5e49ae38556af39562f655f8ebb5fc4eaf9b13d39b86b57527f88aea173396e93290d7769266af6505ebfdc7a84175fe9eeb6d7b8e6c75af84d95e92664f87da0bc6d410ca37f3dac43a5dcb3f85cf24041c7e80fd7a245177cee6963293972dc66d4f2a988532632148f3b0e3998e9645485198c0e51fb07fb153cb6a5f91d1c7d914b", 0xe1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x46) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000080)) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xc, 0x4, 0xffffbe0000000001, 0x8, 0xffffffff}, 0x0) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="000426bd7000fcdbdf250c00000034000980080002000010000008000100fbffffff08000100ffffff7f08000200d63c0000080001000400000008000100090000002c0101800d0001007564703a73797a3200000000380004001400010002004e23ac1e00010000000000000000200002000a004e227ffffffffc00000000000000000000000000000001000080080003000400000038000400200001000a004e2000000009ff020000000000000000000000000001040000001400020002004e240000000000000000000000004c00028008000300ff0100000800040001040000080003000900000008000200f6000000080001001c0000000800020001000000080001001a0000000800030009000000080001001700000054000280080001001c"], 0x2d0}, 0x1, 0x0, 0x0, 0x40408c1}, 0x40) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x8a2b81) write$char_usb(r4, &(0x7f0000000040)="e2", 0x12d8) 3.957661669s ago: executing program 2 (id=2866): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x2f, 0x35, 0xb, 0x7, 0x20, @private2, @mcast1, 0x1, 0x1, 0x7, 0xfffffffd}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x8000, 0x7800, 0x8, 0x3, {{0xa, 0x4, 0x2, 0xa, 0x28, 0x65, 0x0, 0x1, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x2b}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2f, 0x0, 0x7, [0x0, 0x9, 0xffffffff]}]}}}}}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000400)={0xffffffffffffffff, r7, 0x25, 0x0, @val=@netkit}, 0x1c) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="00042bbd7000ffdbdf25090000000c000180080003000100000024000180080003000100000008000100", @ANYRES32=r3, @ANYBLOB="080003000200000008000300030000004c00018008000100", @ANYRES32=r4, @ANYBLOB="0800030003000000140002006d61637365633000000000000000000008000100", @ANYRES32=r5, @ANYBLOB="00000000d3745fc427549113d415c2ef6740b1f2647dcf02223870dceba83b82e126e4c2b803009687079b9430104c2709268a0fca6ba3ea0c3a5bd162205097909fedf3555b30d80f50c1c52bdaf22fb32647f38afe836aff5c8c512e5fad97b81cea3db58b177d86a7bc6e7a336839784d6d75f67b7960416daf4d48f0d710217d76114b1364233c53e5acd100b9a849523c89f3cc9fd47c0cab35aefb46eee77918da4853896e5a175e79133b97b758ddeb8c32d4c0e94191a5d659bb", @ANYRES32=r7, @ANYBLOB="140002007866726d3000"/20], 0x90}, 0x1, 0x0, 0x0, 0x48000}, 0x10) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @default, @netrom={'nr', 0x0}, 0x5, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) 3.917522822s ago: executing program 3 (id=2868): socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000e56000/0x4000)=nil, 0x4000, 0x11) openat$iommufd(0xffffffffffffff9c, 0x0, 0x20000, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r4, 0x29, 0xce, &(0x7f0000000040), &(0x7f00000000c0)=0x4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b18, &(0x7f0000000140)={'wlan1\x00'}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000100)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r5, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x6}], 0x1}}], 0x1, 0x20008000) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) 3.7810119s ago: executing program 4 (id=2869): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r1, 0x0, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_NAN(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040001}, 0x4000800) mount$overlay(0x0, &(0x7f0000000580)='.\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000000)={[{@upperdir, 0x5c}]}) r7 = syz_open_dev$video4linux(&(0x7f0000000000), 0x2, 0x1a1003) ioctl$VIDIOC_SUBDEV_G_FMT(r7, 0xc0585604, &(0x7f00000000c0)={0x0, 0x0, {0xfffff001, 0x1, 0x2019, 0x5, 0x6, 0x4, 0x2, 0x3}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) fsopen(&(0x7f0000000380)='udf\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3004c8d4}, 0x80) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ip6_tables_matches\x00') sendfile(r8, r8, &(0x7f0000000240)=0x3, 0x8f) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x80000005, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xe}, 0x1c) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000200)={@multicast1, @local}, 0xc) 3.288054963s ago: executing program 1 (id=2870): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) 3.107205019s ago: executing program 3 (id=2871): r0 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f0000000280), &(0x7f0000000a80)=@udp6, 0x2}, 0x20) 2.755688961s ago: executing program 1 (id=2872): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x38, 0x24, 0x2, 0x0, 0x6, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_EVICT_TIMEOUT={0x8, 0x6, 0xfffffff7}]}}]}, 0x38}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0xb, 0x4}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_u32={{0x8}, {0x68, 0x2, [@TCA_U32_SEL={0x64, 0x5, {0x41, 0x18, 0x5, 0xfd7, 0xffa0, 0x6, 0xa, 0x5, [{0x400, 0x7, 0x6a7, 0xfffff20e}, {0x2, 0x1, 0x1000, 0x10000000}, {0x100, 0x3, 0x1ff, 0x9}, {0x0, 0x3, 0x3ff, 0x2}, {0x88c, 0xfffffff7, 0x9, 0x9}]}}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$kcm(0x10, 0x400000002, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0xc}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 2.739468788s ago: executing program 4 (id=2873): fsopen(&(0x7f0000000580)='overlay\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x20801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)="2c385aa3d49100b36d26c892b6bc436a", 0xfffffffffffffed8) r4 = accept4(r0, 0x0, 0x0, 0xc0000) recvmsg$qrtr(r4, 0x0, 0x0, 0x40) sendmmsg$alg(r4, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x40}], 0x30, 0x88010}], 0x1, 0x20000010) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x20000045}, 0x40046) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r4) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000200)={0x48}) creat(0x0, 0xecf86c37d53049cc) socketpair$unix(0x1, 0x3, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) r6 = syz_io_uring_setup(0x10e, &(0x7f0000000540)={0x0, 0xd4bb, 0x0, 0xfffffffb, 0x267}, &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(r6, 0x3517, 0xc2de, 0x9, 0x0, 0x0) 2.682677839s ago: executing program 3 (id=2874): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x0, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x0) sendmsg$netlink(r4, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="180000002c000100000000000000000008004000", @ANYRES32=0x0, @ANYBLOB="a08089380aaa6a6a09b1c78171453f8e1c0c09674988567658a1af0cf5c822f5266188b3883375"], 0x18}], 0x1}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r7, 0x40505331, &(0x7f0000000540)={{}, {0x18}, 0x0, 0x7}) getsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f00000001c0), &(0x7f00000000c0)=0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0xd, 0x8, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x8004881, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000005c0)="97357f76b59d33a3ca50c7955332c9c374c6a69423797770fa8c47c4b581df60bd5c813d1bb9553af598268686facd3b9bc3ce11e703875fc47ec183cdce02f00a59ad27f8696c4cf0ff55c6f0aecd63a03c51f274c6576aca9bdb8223532bf047942d3d213ddaf3d157f427296cf15d651abc32d6ff53ea190658316a0a073c32463bd76b5f99cd8a89ffc3a74f168eefeaf502058ca67272239f56732a1c7197821eae329e8df5fbd5aa0a020b599095af32aa0b43493b19f199af0c87e981de8889b91b7ff26157ce59edde6bb8694a2dfa862a3e4c35aef5cc39417821cf388f", 0x16, 0x0, 0x0, 0x0) 2.618028935s ago: executing program 2 (id=2875): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r0, &(0x7f0000000100), 0x4003) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r3 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0x5, 0x7, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) ftruncate(0xffffffffffffffff, 0x1000006) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) syz_open_dev$sndpcmp(&(0x7f0000000980), 0x1, 0x2) syz_emit_ethernet(0x47, &(0x7f0000000080)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x11, 0x11, 0x0, @empty, @mcast2, {[], {0x4000, 0xe22, 0x11, 0x0, @opaque="03e6c6c583de1ef674"}}}}}}, 0x0) 2.541576708s ago: executing program 3 (id=2876): fsopen(&(0x7f0000000580)='overlay\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x20801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)="2c385aa3d49100b36d26c892b6bc436a", 0xfffffffffffffed8) r4 = accept4(r0, 0x0, 0x0, 0xc0000) recvmsg$qrtr(r4, 0x0, 0x0, 0x40) sendmmsg$alg(r4, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x40}], 0x30, 0x88010}], 0x1, 0x20000010) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x20000045}, 0x40046) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r4) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000200)={0x48}) creat(0x0, 0xecf86c37d53049cc) socketpair$unix(0x1, 0x3, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0x10000, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(0xffffffffffffffff, 0x3517, 0xc2de, 0x9, 0x0, 0x0) 2.144950703s ago: executing program 1 (id=2877): r0 = socket$key(0xf, 0x3, 0x2) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x854}}, './file0\x00'}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x3}) sendmsg$key(r0, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x18, 0x1, 0x0, 0x10, 0x0, 0x0, 0x10, [@sadb_address={0x3, 0x5, 0xff, 0x0, 0x0, @in={0x2, 0x0, @multicast2}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @in6=@mcast1, @in6=@mcast2}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x80}}, 0x20000000) 1.950378482s ago: executing program 1 (id=2878): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000cc0)="adf802e5370fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000600)="690ea45e73b0f0cf753118819f4495f47e6f016788d1baf8ca32cd50b4e0c5e6dba50b792c169e503a43e7dc48728495f22683f1014d66f000e5896e52249ab47aeb9c96af631ec206b3f8a848b0705b5468ef666c803350b0a857d63cb91f3389019085fe41a717db4d01ba4755a171635a0e86ccff009b66bcd9a7b4c333a53e8c04455397aef78e379cd5e13aec6c2332faaef6ca310547d38e3f94414ebf33411ace8acabb11db28b8d4a121aabc746e6654556cab1e2de77b082d2e061e3fe4c58efe4f8e0ca956bedc5763cc2da2151eb0ac6a937560b54dd5dc11b4e65a4bdf04414605200a", 0xe9}, {&(0x7f0000000700)="2f34cd6d8761518fc37786de0792c4ccf8adc46f7498733cf2e70c1d23e3f03a0b70e587a6207c4293ecf03d5637e5059ca92df6b0f4627881ab21645a8237b01ac953a0810f5cd720a08bb356f7030db22777a29e201d", 0xff95}], 0x2, 0x0, 0x0, 0x4}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)=""/196, 0xc4}, {&(0x7f0000000240)=""/156, 0x9c}], 0x2}, 0x0) 1.060566666s ago: executing program 2 (id=2879): memfd_create(&(0x7f00000002c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9\xd6\x1c\x1b*\x9a!?\x7f\xa5\xad\x9a,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{&\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+\x02\x00\x00\x00\x00\x00\x00\x00\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00xffffffffffffffff}, 0x0) splice(r2, 0x0, r6, 0x0, 0x7ffff000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r8, 0x0, r9, 0x0, 0x6, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r9, 0x0) write$vhost_msg_v2(r9, &(0x7f0000000300)={0x2, 0x0, {&(0x7f0000000180)=""/32, 0x20, &(0x7f0000001580)=""/219, 0x3, 0x1}}, 0x48) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001480)=@newtfilter={0xf8, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc8, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0xc4, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xff}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x24, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xe}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x44, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0xb}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}]}]}]}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r12 = dup(r0) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000000000)="b7983aa0e7f99c229215cf9243297cab3b15506646b615ecea9d1803ad2a68a78caf1ea87e902a9c01a7560344c523fb553cb18abd193a41f433dad8f52762aee21c2f2ae8fddac2bbe3d75ab49ba35c503bbf32a957650efc2185ce2b7d9b615f95fb8dba4df3a9d299475237ec531d94f3eb6dfa5985bade4b06c9f69148638791e7ae2d0dd9cce0bd6409aa76afbd4b600e9866d7da2173fd03e89110c890680f293be8c9117556623aa269d737473e39398b7d688c68580ddefa42cc93ea73f18d8251a3f76efc51ce97e69c53e39e50016c487de724b8a620b955ce918fff3257ff20bf4176ca14f22fbcb3", 0xee) write$UHID_INPUT(r12, &(0x7f0000000440)={0xf, {"a2e3ad21e08eeb661b5d310987f70e06d038e7ff7fc6e5539b0d750e8b089b3f363b68090890e0878f0e1ac6e7049b3b48959b649a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07410936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63da1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e6409000000000000002fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec1109110900d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e1505f6bf39ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97912507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000010000008000bea37ce0d0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f6435f7590000008271a1f5f8528f227eabc1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b649f07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076a882e8020f06c47f8156832369c33076da865d258734dd73583df292892448839ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059ec01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c27155005e797b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02c67141a360c3ace48aee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7fdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e44e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333b25bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475fb7807fb33b72685ec37a2d3f7664fe2f0459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b6cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5dd40b0000000000005f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128060000008261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b6c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb00600000000000000dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69cce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) 711.914895ms ago: executing program 1 (id=2882): socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x200000000114, 0x5, 0xffffffffffffffff, &(0x7f0000000000)=0xfffffe73) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) syz_emit_ethernet(0x11dc0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', 0x0}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) r3 = socket(0x10, 0x803, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x4040880) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=ANY=[@ANYBLOB="38000000100039042cbd7000eaffffff000003e4", @ANYRES32=0x0, @ANYBLOB="83000400000000001800128008002000736974000c00028008000300ffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x4840) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x100001, 0x0) ioctl$TCXONC(r4, 0x540a, 0x3) 658.626853ms ago: executing program 3 (id=2883): recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)={0x0, 0x0, @pic={0x2e, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x67, 0x58, 0xa0, 0x2, 0x6, 0x7e}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x18addbae, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x3, 0xfffffffffffffffe, 0x45, 0x4, 0xbdb], 0xffff1000, 0x1c4213}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x31) 367.298834ms ago: executing program 4 (id=2884): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001540)={0x11, 0x15, &(0x7f0000001fc0)=ANY=[@ANYBLOB="1800000009000000000000000800000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000950000000000000085100000f8ffffff85200000030000007c6518000400000018000000faffffff000000000d000000bf9100000084260f263e7495751b5bb0000000b7020000000000008500000084000000b700000000a5958d34ea5ca5a3a94e7bca81f541a1dd7967089733f984357c1d0bdade7ca1addfc6b12ebf24c4c81f03ceecfd9fb9014e4d1046c8de28e6b3596f7176e0a8bb7e0d000790a483c1d74340e9b5242c59297950348843440b40ce638f7423b0b95b21b24c16e6d9fc8320dbc719e37d830736246f5c83360c46da169c9271186c8aab7b3305a12f289141414a50f0184eff357c3e5f36ef"], &(0x7f0000000280)='GPL\x00', 0x1200000, 0x1000, &(0x7f0000000400)=""/4096, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001400)={0x1, 0x2, 0x80000000, 0x2}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000001440)=[r0, r0, r0, 0xffffffffffffffff, 0x1, r0], &(0x7f0000001480)=[{0x4, 0x2, 0x7, 0x5}, {0x4, 0x2, 0xc, 0x6}, {0x4, 0x1, 0x8, 0x5}, {0x1, 0x1, 0xc, 0x5}, {0x5, 0x3, 0x5, 0x1}, {0x4, 0x4, 0x4, 0x4}, {0x0, 0x5, 0x8, 0x9}, {0x3, 0x3, 0x2, 0xc}, {0x2, 0x1, 0x3, 0x9}], 0x10, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x10, &(0x7f00000002c0)=ANY=[@ANYBLOB="18120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000008000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000008500000082000000183000000200"/72], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x62, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x780}, 0x94) eventfd(0x3) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x8000, 0x0) getdents64(r2, &(0x7f0000000e00)=""/4102, 0x1006) r3 = creat(&(0x7f0000000200)='./file0\x00', 0x17e) close(r3) lseek(0xffffffffffffffff, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r6, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r5, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) dup(r7) 342.594903ms ago: executing program 1 (id=2885): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000004f80), r0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(0x0, 0xe, 0x65c100) socket$kcm(0x10, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x3, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) socket(0x10, 0x80002, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x5e1140, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000100)='5\x00', 0x2) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) write$P9_RSTATu(r4, 0x0, 0x4d6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000a, 0x204031, r4, 0xffffd000) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, 0x0, 0x34) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) 0s ago: executing program 3 (id=2886): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000180), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)=@phonet, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)="b8c12b8ec85e0cfd984fd64a5add4c4decda74fb56b8abdacfea87152fb59e03af4c33b082c35e199e84e967af4984e2b9ec34320b8aed0f1156aee4a7e767872210e593ff7f64cfbe94164fc7c59e31bf25b5aaaad9b5a7fde68487195d53e5ec", 0x61}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0400000004000000040000000280000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000000000000000000000d23c797f0941b4aa20eb0be37bf6e25c75d0601456abd11e57a9582bd4a05f9ae6efa347aa3c07000891ceb480a6781ee2ac92b46cf8766a41837072bdb73bfbf6077db3d3f20dcaabd1c189262ed9b8c7faffffff9a0459e650a81f2ccccdeab4feda0eab441a0b03714de715be361f7c83d679fdcb41006662f29621db62846f3fb8fc7e3ea1ce075fb771dc8aa878ac516f9c38c06dea7bba891f8f6767614bab24541b8b8d4d2462db1f542522569df4b5", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0xffffffff7fffffff, 0x4000009, 0xfffffffffffffffd, 0x4, 0x2, 0x3, 0x4002004c2, 0x5, 0x1, 0x0, 0x400, 0x15, 0x88, 0x0, 0x7, 0x8d], 0xeeee8000, 0x240046}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x458, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000002010400000000000000000a00000004000180440003800c00028005000100890000002c0b018014000300fe80000000000000000000000000002a1400040029ff01000000000000000000000000000106000340000200003c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffff7f0000010c0002800500010086000000"], 0x98}, 0x1, 0x0, 0x0, 0x24000801}, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x2, 0x5, 0x430, 0x1c0, 0x290, 0xffffffff, 0x0, 0x0, 0x360, 0x360, 0xffffffff, 0x360, 0x360, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @remote, [], [], 'batadv0\x00', 'pim6reg1\x00'}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@local, @ipv6=@remote, @icmp_id=0x65}}}, {{@ipv6={@dev, @loopback, [0x0, 0xff], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x290}}, {{@ipv6={@remote, @remote, [0x0, 0xffffffff], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x490) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) unshare(0x60400) kernel console output (not intermixed with test programs): 0][T15324] should_fail_ex.cold+0x5/0xa [ 957.230477][T15324] _copy_to_user+0x32/0xd0 [ 957.230489][T15324] sctp_getsockopt+0x2634/0x7100 [ 957.230503][T15324] ? find_held_lock+0x2b/0x80 [ 957.230518][T15324] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 957.230530][T15324] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 957.230542][T15324] ? __pfx_sctp_getsockopt+0x10/0x10 [ 957.230561][T15324] ? avc_has_perm_noaudit+0x145/0x3b0 [ 957.230574][T15324] ? avc_has_perm+0x135/0x1e0 [ 957.230585][T15324] ? __pfx_avc_has_perm+0x10/0x10 [ 957.230598][T15324] ? __lock_acquire+0x4a5/0x2630 [ 957.230611][T15324] ? sock_has_perm+0x258/0x2f0 [ 957.230628][T15324] ? find_held_lock+0x2b/0x80 [ 957.230642][T15324] ? __might_fault+0xc5/0x140 [ 957.230657][T15324] ? __might_fault+0xc5/0x140 [ 957.230677][T15324] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 957.230707][T15324] do_sock_getsockopt+0x259/0x3d0 [ 957.230727][T15324] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 957.230751][T15324] __sys_getsockopt+0x148/0x260 [ 957.230769][T15324] ? __x64_sys_getsockopt+0xbd/0x160 [ 957.230783][T15324] __x64_sys_getsockopt+0xbd/0x160 [ 957.230796][T15324] ? do_syscall_64+0x95/0xf80 [ 957.230811][T15324] ? lockdep_hardirqs_on+0x78/0x100 [ 957.230826][T15324] do_syscall_64+0x106/0xf80 [ 957.230840][T15324] ? clear_bhb_loop+0x40/0x90 [ 957.230854][T15324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 957.230866][T15324] RIP: 0033:0x7f13efb9c799 [ 957.230877][T15324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 957.230887][T15324] RSP: 002b:00007f13f0ae3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 957.230900][T15324] RAX: ffffffffffffffda RBX: 00007f13efe15fa0 RCX: 00007f13efb9c799 [ 957.230907][T15324] RDX: 0000000000000022 RSI: 0000000000000084 RDI: 0000000000000003 [ 957.230914][T15324] RBP: 00007f13f0ae3090 R08: 0000200000000480 R09: 0000000000000000 [ 957.230920][T15324] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001 [ 957.230926][T15324] R13: 00007f13efe16038 R14: 00007f13efe15fa0 R15: 00007ffc2653cf38 [ 957.230941][T15324] [ 957.244795][ T6018] usb 5-1: Using ep0 maxpacket: 32 [ 957.529104][T15329] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 957.544620][T15326] bridge0: port 2(bridge_slave_1) entered disabled state [ 957.552136][T15326] bridge0: port 1(bridge_slave_0) entered disabled state [ 957.563097][ T29] audit: type=1400 audit(2000000702.739:2549): avc: denied { mount } for pid=15316 comm="syz.2.2392" name="/" dev="rpc_pipefs" ino=44086 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 957.587386][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 957.637633][ T3600] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 957.675048][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 957.943426][ T5874] hub 1-1:0.0: activate --> -90 [ 957.948918][T10514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 957.993377][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.115289][T14869] hub 1-1:0.0: hub_ext_port_status failed (err = -71) [ 958.123537][ T5874] usb 1-1: USB disconnect, device number 36 [ 958.500597][ T6018] usb 5-1: unable to get BOS descriptor or descriptor too short [ 958.509967][ T6018] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 958.523154][ T6018] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 958.541745][ T6018] usb 5-1: New USB device found, idVendor=17cc, idProduct=1021, bcdDevice= 0.40 [ 958.550963][ T6018] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.568468][ T6018] usb 5-1: Product: Đš [ 958.573062][ T6018] usb 5-1: Manufacturer: ŕ ľ [ 958.577902][ T6018] usb 5-1: SerialNumber: ĘŞęĄâ‘“ć–®ě¬ę©ąćŠľâ˝™á°żě‹¦ć–¬á˛°Ý굸䭎ὔﭕ൛汎㨤â­ä Ťîś±ŕąŤç®é«°ë¬łä… ä·¦ëŤĄé™ŚăžŹé©’貄Ę娛槿䧔ꤏ唬嵯⏀暱⛴₫漶魯ę…켒피풺⦩쪵㭙î“힠꺀孮⫕ă”粸焕擙뺾閥뢴呾奲폽쮜čľę«ˇęź—ﵬ䍷䀬囬斫揇薸⣲ظ뙝︧晻á™éš‡Ď•ë‹šçŹłá·µçĄšâĄ”鑮趄ă‚â¬ĺ‘ꋓߗ瞞뺥뤪逇婗쪂䛿撑 [ 958.822984][ T29] audit: type=1400 audit(2000000703.843:2550): avc: denied { execute_no_trans } for pid=15333 comm="syz.1.2397" path="/478/file1" dev="tmpfs" ino=2563 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 959.110847][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.157396][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.174856][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.185602][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.202084][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.305484][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.326889][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.346096][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 959.381753][ T6018] usb 5-1: unable to issue vendor read request (ret = -71) [ 960.260571][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 960.293484][ T6018] usb 5-1: USB disconnect, device number 44 [ 960.372263][T15353] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 960.380552][T15353] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 960.389335][T15353] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 961.237203][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 961.260666][T15206] udevd[15206]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 961.415458][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 961.468797][T15364] fuse: Bad value for 'user_id' [ 961.474209][T15364] fuse: Bad value for 'user_id' [ 961.512467][T15360] input: syz0 as /devices/virtual/input/input47 [ 961.528687][ T29] audit: type=1400 audit(2000000706.520:2551): avc: denied { read } for pid=5168 comm="acpid" name="event4" dev="devtmpfs" ino=3122 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 961.663270][ T29] audit: type=1400 audit(2000000706.520:2552): avc: denied { open } for pid=5168 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3122 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 961.697376][ T29] audit: type=1400 audit(2000000706.520:2553): avc: denied { ioctl } for pid=5168 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3122 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 962.715062][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.194387][T15377] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.202668][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.427608][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.443645][T15376] lo speed is unknown, defaulting to 1000 [ 963.804610][T15379] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 963.813310][T15379] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 963.821822][T15379] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 963.993727][T13630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.843867][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.922828][ T29] audit: type=1400 audit(2000000709.692:2554): avc: denied { create } for pid=15383 comm="syz.0.2409" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 965.085659][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.308347][T15398] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.316586][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.356734][T15397] lo speed is unknown, defaulting to 1000 [ 966.343519][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 967.134256][T15420] syzkaller0: entered promiscuous mode [ 967.139865][T15420] syzkaller0: entered allmulticast mode [ 967.477633][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 967.532822][ T29] audit: type=1400 audit(2000000712.116:2555): avc: denied { setopt } for pid=15422 comm="syz.4.2418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 967.698956][T15431] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 967.707386][T15431] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 967.716019][T15431] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 967.755351][ T978] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 968.076398][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.588977][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.669514][T15437] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2422'. [ 968.717098][ T978] usb 4-1: Using ep0 maxpacket: 8 [ 968.724466][ T978] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 968.937421][T15445] netlink: 'syz.4.2422': attribute type 11 has an invalid length. [ 970.318758][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 970.326797][T15437] lo speed is unknown, defaulting to 1000 [ 970.334416][T15445] netlink: 199828 bytes leftover after parsing attributes in process `syz.4.2422'. [ 970.345361][ T978] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 970.345783][ T29] audit: type=1326 audit(2000000714.773:2556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15436 comm="syz.4.2422" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x0 [ 970.354634][ T978] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 970.456704][ T978] usb 4-1: Product: syz [ 970.468044][ T978] usb 4-1: Manufacturer: syz [ 970.481916][ T29] audit: type=1400 audit(2000000714.886:2557): avc: denied { ioctl } for pid=15436 comm="syz.4.2422" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=43556 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 970.485108][ T978] usb 4-1: SerialNumber: syz [ 970.872536][ T978] usb 4-1: can't set config #1, error -71 [ 970.949074][ T978] usb 4-1: USB disconnect, device number 33 [ 971.077823][ T29] audit: type=1400 audit(2000000715.447:2558): avc: denied { create } for pid=15457 comm="syz.3.2425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 971.258184][T15461] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2426'. [ 971.300822][ T29] audit: type=1400 audit(2000000715.475:2559): avc: denied { listen } for pid=15457 comm="syz.3.2425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 971.417641][T10378] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.629560][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.325028][ T29] audit: type=1400 audit(2000000716.617:2560): avc: denied { map } for pid=15468 comm="syz.0.2428" path="socket:[44402]" dev="sockfs" ino=44402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 972.359302][ T29] audit: type=1400 audit(2000000716.654:2561): avc: denied { ioctl } for pid=15470 comm="syz.4.2429" path="socket:[43577]" dev="sockfs" ino=43577 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 972.362412][ T29] audit: type=1400 audit(2000000716.654:2562): avc: denied { bind } for pid=15470 comm="syz.4.2429" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 972.782301][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 973.330932][ T29] audit: type=1400 audit(2000000717.450:2563): avc: denied { mount } for pid=15481 comm="syz.1.2432" name="/" dev="overlay" ino=2605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 973.578419][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 973.866280][ T29] audit: type=1800 audit(2000000717.459:2564): pid=15487 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2432" name="file0" dev="overlay" ino=2613 res=0 errno=0 [ 973.958314][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 974.074241][ T29] audit: type=1400 audit(2000000717.562:2565): avc: denied { name_bind } for pid=15481 comm="syz.1.2432" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 974.615820][T14869] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 974.623646][T10378] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 974.658840][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 974.787100][T14869] usb 2-1: Using ep0 maxpacket: 8 [ 974.821143][T10378] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 974.833390][T14869] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 974.874543][T10378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.909797][T14869] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 974.926379][T10378] usb 3-1: Product: syz [ 974.949413][T10378] usb 3-1: Manufacturer: syz [ 974.960963][T14869] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 974.987615][T10378] usb 3-1: SerialNumber: syz [ 975.021911][T14869] usb 2-1: Product: syz [ 975.037287][T14869] usb 2-1: Manufacturer: syz [ 975.124318][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 975.141250][T10378] usb 3-1: config 0 descriptor?? [ 975.150263][T14869] usb 2-1: SerialNumber: syz [ 975.829387][T10378] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 032 [ 976.048588][T10378] (null): failure setting delay to 10us [ 976.078451][T14869] usb 2-1: Invalid connection information received from device [ 976.086463][T10378] i2c-tiny-usb 3-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 976.201547][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 976.402050][T10378] usb 3-1: USB disconnect, device number 32 [ 976.901333][T14869] usb 2-1: USB disconnect, device number 38 [ 977.227582][T15524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 977.311612][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 977.550041][T15527] overlayfs: missing 'lowerdir' [ 978.089353][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.522508][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.603403][T15547] FAULT_INJECTION: forcing a failure. [ 978.603403][T15547] name failslab, interval 1, probability 0, space 0, times 0 [ 978.616770][T15547] CPU: 1 UID: 0 PID: 15547 Comm: syz.3.2448 Tainted: G L syzkaller #0 PREEMPT(full) [ 978.616800][T15547] Tainted: [L]=SOFTLOCKUP [ 978.616807][T15547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 978.616817][T15547] Call Trace: [ 978.616824][T15547] [ 978.616830][T15547] dump_stack_lvl+0x100/0x190 [ 978.616869][T15547] should_fail_ex.cold+0x5/0xa [ 978.616894][T15547] ? constrain_params_by_rules+0x175/0xcc0 [ 978.616916][T15547] should_failslab+0xc2/0x120 [ 978.616935][T15547] __kmalloc_noprof+0xe0/0x850 [ 978.616960][T15547] ? unwind_get_return_address+0x59/0xa0 [ 978.616988][T15547] constrain_params_by_rules+0x175/0xcc0 [ 978.617015][T15547] ? stack_trace_save+0x8e/0xc0 [ 978.617043][T15547] ? __pfx_constrain_params_by_rules+0x10/0x10 [ 978.617070][T15547] ? __kasan_kmalloc+0xaa/0xb0 [ 978.617094][T15547] ? snd_pcm_oss_change_params_locked+0x247/0x39f0 [ 978.617113][T15547] ? snd_pcm_oss_make_ready_locked+0xb7/0x130 [ 978.617130][T15547] ? snd_pcm_oss_write+0x4bb/0xa30 [ 978.617155][T15547] ? rcu_is_watching+0x12/0xc0 [ 978.617177][T15547] ? snd_interval_refine+0x2d0/0x580 [ 978.617204][T15547] snd_pcm_hw_refine+0x7e7/0xad0 [ 978.617229][T15547] ? __pfx_snd_pcm_hw_refine+0x10/0x10 [ 978.617259][T15547] ? __asan_memset+0x23/0x50 [ 978.617282][T15547] ? _snd_pcm_hw_param_min+0x1ea/0x670 [ 978.617314][T15547] snd_pcm_oss_change_params_locked+0x2594/0x39f0 [ 978.617343][T15547] ? snd_pcm_oss_write+0x49a/0xa30 [ 978.617361][T15547] ? __lock_acquire+0x4a5/0x2630 [ 978.617378][T15547] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 978.617400][T15547] ? __pfx___mutex_lock+0x10/0x10 [ 978.617436][T15547] ? get_pid_task+0xfc/0x250 [ 978.617463][T15547] ? get_pid_task+0xfc/0x250 [ 978.617493][T15547] snd_pcm_oss_make_ready_locked+0xb7/0x130 [ 978.617514][T15547] snd_pcm_oss_write+0x4bb/0xa30 [ 978.617533][T15547] ? bpf_lsm_file_permission+0x9/0x10 [ 978.617559][T15547] ? security_file_permission+0x76/0x210 [ 978.617592][T15547] vfs_write+0x2aa/0x1070 [ 978.617629][T15547] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 978.617650][T15547] ? __pfx_vfs_write+0x10/0x10 [ 978.617675][T15547] ? find_held_lock+0x2b/0x80 [ 978.617698][T15547] ? __fget_files+0x215/0x3d0 [ 978.617717][T15547] ? __fget_files+0x215/0x3d0 [ 978.617741][T15547] ? __fget_files+0x21f/0x3d0 [ 978.617767][T15547] ksys_write+0x12a/0x250 [ 978.617794][T15547] ? __pfx_ksys_write+0x10/0x10 [ 978.617828][T15547] do_syscall_64+0x106/0xf80 [ 978.617850][T15547] ? clear_bhb_loop+0x40/0x90 [ 978.617872][T15547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.617892][T15547] RIP: 0033:0x7f80c499c799 [ 978.617908][T15547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 978.617925][T15547] RSP: 002b:00007f80c57be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 978.617944][T15547] RAX: ffffffffffffffda RBX: 00007f80c4c16090 RCX: 00007f80c499c799 [ 978.617956][T15547] RDX: 0000000000088020 RSI: 0000200000002000 RDI: 0000000000000006 [ 978.617966][T15547] RBP: 00007f80c57be090 R08: 0000000000000000 R09: 0000000000000000 [ 978.617977][T15547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 978.617987][T15547] R13: 00007f80c4c16128 R14: 00007f80c4c16090 R15: 00007ffe367b4428 [ 978.618012][T15547] [ 978.655251][ T10] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 978.981055][T15547] geneve2: entered promiscuous mode [ 979.575997][T15555] mkiss: ax0: crc mode is auto. [ 979.599896][ T10] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 979.609132][ T10] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 979.627141][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 979.811217][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 979.929172][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 980.019581][ T10] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 980.044083][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 980.052389][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 980.052406][ T29] audit: type=1400 audit(2000000723.514:2567): avc: denied { setcurrent } for pid=15553 comm="syz.2.2451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 980.078554][ T29] audit: type=1401 audit(2000000723.514:2568): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 980.105296][ T10] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 980.114302][ T10] usb 2-1: Product: syz [ 980.118550][ T10] usb 2-1: Manufacturer: syz [ 980.136085][ T10] cdc_wdm 2-1:1.0: skipping garbage [ 980.149692][ T10] cdc_wdm 2-1:1.0: skipping garbage [ 980.178741][ T10] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 980.184745][ T10] cdc_wdm 2-1:1.0: Unknown control protocol [ 980.384233][ T10] usb 2-1: USB disconnect, device number 39 [ 981.279236][T15578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 981.287539][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 981.314017][T15577] lo speed is unknown, defaulting to 1000 [ 981.592385][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 981.600756][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 981.661077][ T5895] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 982.256404][T15590] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 982.264639][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 982.296433][T15589] lo speed is unknown, defaulting to 1000 [ 982.719273][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 982.728087][ T5895] usb 2-1: device descriptor read/all, error -71 [ 983.064864][T15595] misc userio: Can't change port type on an already running userio instance [ 983.292064][ T29] audit: type=1400 audit(2000000726.658:2569): avc: denied { remount } for pid=15587 comm="syz.1.2459" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 983.781145][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.806055][ T978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.818608][ T3600] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.828977][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.841965][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 984.809796][ T29] audit: type=1326 audit(2000000728.277:2570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 984.882110][ T29] audit: type=1326 audit(2000000728.277:2571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 984.905948][T15614] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 985.057205][ T29] audit: type=1326 audit(2000000728.277:2572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f585415cfce code=0x7ffc0000 [ 985.085538][ T29] audit: type=1326 audit(2000000728.277:2573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 985.433245][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2464'. [ 985.600331][T15619] mkiss: ax0: crc mode is auto. [ 985.636867][ T29] audit: type=1326 audit(2000000728.277:2574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 985.812079][ T29] audit: type=1326 audit(2000000728.286:2575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=17 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 985.836275][ T29] audit: type=1326 audit(2000000728.286:2576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.121031][T15628] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2466'. [ 986.286410][ T29] audit: type=1326 audit(2000000728.286:2577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.480787][T15633] lo speed is unknown, defaulting to 1000 [ 986.773497][ T29] audit: type=1326 audit(2000000728.286:2578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.830372][ T29] audit: type=1326 audit(2000000728.286:2579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.854572][ T29] audit: type=1326 audit(2000000728.286:2580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.917831][ T29] audit: type=1326 audit(2000000728.286:2581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.961133][ T29] audit: type=1326 audit(2000000728.530:2582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 986.987138][ T29] audit: type=1326 audit(2000000728.530:2583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15604 comm="syz.4.2463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f585419c799 code=0x7ffc0000 [ 987.239886][ T6018] net_ratelimit: 4 callbacks suppressed [ 987.239906][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 987.481346][T15644] netlink: 'syz.0.2472': attribute type 2 has an invalid length. [ 987.509860][T15644] netlink: 'syz.0.2472': attribute type 1 has an invalid length. [ 987.558562][T15647] trusted_key: encrypted_key: insufficient parameters specified [ 987.560713][T15644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2472'. [ 987.682950][T15644] trusted_key: encrypted_key: master key parameter 'user:' is invalid [ 988.554372][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 988.573342][ T5818] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 988.597205][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 989.163940][T15674] geneve2: entered promiscuous mode [ 991.575371][T15670] fuse: Unknown parameter '0x000000000000000300000000000000000000' [ 992.090944][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 992.103266][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 992.143613][T15670] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2476'. [ 992.797635][T15679] block nbd3: NBD_DISCONNECT [ 992.972377][T15685] lo speed is unknown, defaulting to 1000 [ 993.305194][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 993.476665][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 993.476677][ T29] audit: type=1400 audit(2000000736.372:2595): avc: denied { create } for pid=15689 comm="syz.2.2482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 993.751210][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 993.842022][T15706] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2482'. [ 993.874510][T15706] input: syz0 as /devices/virtual/input/input51 [ 994.525800][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 995.369578][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 995.634238][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 996.118624][T15728] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2488'. [ 996.507333][T15736] fuse: Unknown parameter '0x000000000000000300000000000000000000' [ 996.598898][T15736] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2491'. [ 996.717975][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 996.749283][ T5818] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 997.839890][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 998.597897][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 998.734292][ T5896] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 998.941073][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 999.754268][ T5896] usb 5-1: Using ep0 maxpacket: 32 [ 999.913151][ T29] audit: type=1400 audit(2000000742.426:2596): avc: denied { getopt } for pid=15772 comm="syz.2.2501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1000.103102][ T5896] usb 5-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 1000.119815][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.128157][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1000.186439][ T5896] usb 5-1: Product: syz [ 1000.200990][T15780] fuse: Unknown parameter '0x000000000000000300000000000000000000' [ 1000.217550][ T5896] usb 5-1: Manufacturer: syz [ 1000.224859][ T5896] usb 5-1: SerialNumber: syz [ 1000.230487][T15780] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2502'. [ 1000.233519][ T5896] usb 5-1: config 0 descriptor?? [ 1000.274974][ T5896] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 1000.313127][ T5896] dvb-usb: bulk message failed: -22 (4/0) [ 1000.326809][ T5896] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1000.378793][ T5896] dvb-usb: bulk message failed: -22 (5/0) [ 1000.387883][ T5896] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1000.420841][ T5896] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1000.880721][ T5896] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 1000.902415][T15759] ttusb2: more than 2 i2c messages at a time is not handled yet. TODO. [ 1000.929973][ T5896] usb 5-1: media controller created [ 1000.961488][T15759] dvb-usb: bulk message failed: -22 (7/0) [ 1000.999873][T15759] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 1001.275258][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1001.317062][T15759] ttusb2: i2c transfer failed. [ 1001.588707][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1001.885474][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1002.063272][ T5896] usb 5-1: selecting invalid altsetting 3 [ 1002.118651][ T5896] ttusb2: set interface to alts=3 failed [ 1002.227362][ T5896] DVB: Unable to find symbol tda10086_attach() [ 1002.255407][ T5896] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 1002.365076][T13630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1002.902956][ T5896] dvb-usb: bulk message failed: -22 (4/0) [ 1002.916267][ T5896] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1002.968334][ T5896] dvb-usb: bulk message failed: -22 (5/0) [ 1002.985079][ T5896] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1003.047823][ T5896] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 1003.221528][ T5896] usb 5-1: USB disconnect, device number 45 [ 1004.207593][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1004.223482][ T29] audit: type=1400 audit(2000000745.720:2597): avc: denied { mount } for pid=15816 comm="syz.0.2512" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1004.796715][ T29] audit: type=1400 audit(2000000746.740:2598): avc: denied { write } for pid=15818 comm="syz.3.2513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1004.845556][ T29] audit: type=1400 audit(2000000746.993:2599): avc: denied { write } for pid=15818 comm="syz.3.2513" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1004.895978][ T29] audit: type=1400 audit(2000000746.993:2600): avc: denied { allowed } for pid=15818 comm="syz.3.2513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1004.953847][ T29] audit: type=1400 audit(2000000747.012:2601): avc: denied { read write } for pid=15818 comm="syz.3.2513" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1004.987465][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1004.990526][ T29] audit: type=1400 audit(2000000747.012:2602): avc: denied { open } for pid=15818 comm="syz.3.2513" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1005.067582][ T29] audit: type=1400 audit(2000000747.012:2603): avc: denied { ioctl } for pid=15818 comm="syz.3.2513" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1005.100350][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1005.173678][ T29] audit: type=1400 audit(2000000747.012:2604): avc: denied { execmem } for pid=15818 comm="syz.3.2513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1005.200842][T15831] fuse: Unknown parameter '0x000000000000000300000000000000000000' [ 1005.237478][T15831] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2514'. [ 1005.266017][ T29] audit: type=1400 audit(2000000747.283:2605): avc: denied { prog_load } for pid=15814 comm="syz.2.2511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1005.352034][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 1005.358438][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1005.392255][ T29] audit: type=1400 audit(2000000747.283:2606): avc: denied { bpf } for pid=15814 comm="syz.2.2511" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1005.416388][ T29] audit: type=1400 audit(2000000747.283:2607): avc: denied { perfmon } for pid=15814 comm="syz.2.2511" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1005.438931][ T29] audit: type=1400 audit(2000000747.302:2608): avc: denied { read write } for pid=5810 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1006.075498][ T5818] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 1006.102832][ T29] audit: type=1400 audit(2000000747.302:2609): avc: denied { open } for pid=5810 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1006.152932][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1006.153871][ T29] audit: type=1400 audit(2000000747.302:2610): avc: denied { ioctl } for pid=5810 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1006.242330][ T5896] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 1006.265152][ T29] audit: type=1400 audit(2000000747.377:2611): avc: denied { read write } for pid=15830 comm="syz.3.2514" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1006.329798][ T29] audit: type=1400 audit(2000000747.377:2612): avc: denied { open } for pid=15830 comm="syz.3.2514" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1006.354442][ T29] audit: type=1400 audit(2000000747.386:2613): avc: denied { mounton } for pid=15830 comm="syz.3.2514" path="/506/file0" dev="tmpfs" ino=2694 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1006.428401][T14869] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1006.609135][T15846] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1007.036146][T14869] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1007.058661][T14869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1007.066666][T14869] usb 4-1: Product: syz [ 1007.079371][ T29] audit: type=1400 audit(2000000747.386:2614): avc: denied { unmount } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1007.128357][T14869] usb 4-1: Manufacturer: syz [ 1007.134277][T14869] usb 4-1: SerialNumber: syz [ 1007.158047][T14869] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1007.231554][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1007.334209][T10378] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1007.482667][T15853] netlink: 228 bytes leftover after parsing attributes in process `syz.1.2520'. [ 1008.335012][T14869] usb 4-1: USB disconnect, device number 34 [ 1008.345102][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1008.354742][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1008.497247][T10378] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1008.536705][T15871] fuse: Unknown parameter 'fd0x000000000000000300000000000000000000' [ 1008.552903][T10378] ath9k_htc: Failed to initialize the device [ 1008.560489][T15871] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2526'. [ 1008.631614][ T10] kernel read not supported for file /cpu/0/msr (pid: 10 comm: kworker/0:1) [ 1008.771887][T14869] usb 4-1: ath9k_htc: USB layer deinitialized [ 1009.605859][T15882] lo speed is unknown, defaulting to 1000 [ 1009.820160][T15883] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1009.828590][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1010.490940][T15878] lo speed is unknown, defaulting to 1000 [ 1010.589114][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1010.625000][ T29] kauditd_printk_skb: 70 callbacks suppressed [ 1010.625018][ T29] audit: type=1400 audit(2000000752.458:2685): avc: denied { mount } for pid=15887 comm="syz.2.2529" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1011.539318][ T29] audit: type=1400 audit(2000000753.319:2686): avc: denied { ioctl } for pid=15886 comm="syz.4.2530" path="socket:[46605]" dev="sockfs" ino=46605 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1011.600594][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.640799][ T29] audit: type=1400 audit(2000000753.319:2687): avc: denied { create } for pid=15886 comm="syz.4.2530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1011.702053][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.710257][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.710324][ T29] audit: type=1400 audit(2000000753.328:2688): avc: denied { getopt } for pid=15886 comm="syz.4.2530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1011.718679][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.746725][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.238682][T15893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.270032][T15893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.279769][ T3647] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.288702][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.308883][ T29] audit: type=1400 audit(2000000753.384:2689): avc: denied { getopt } for pid=15886 comm="syz.4.2530" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1012.350085][ T29] audit: type=1400 audit(2000000753.469:2690): avc: denied { read write } for pid=15886 comm="syz.4.2530" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1012.433811][ T29] audit: type=1400 audit(2000000753.469:2691): avc: denied { open } for pid=15886 comm="syz.4.2530" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1012.458929][ T29] audit: type=1400 audit(2000000753.525:2692): avc: denied { read } for pid=15894 comm="syz.3.2531" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1012.483243][ T29] audit: type=1400 audit(2000000753.525:2693): avc: denied { ioctl } for pid=15894 comm="syz.3.2531" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1012.540756][ T29] audit: type=1400 audit(2000000753.600:2694): avc: denied { ioctl } for pid=15894 comm="syz.3.2531" path="socket:[45596]" dev="sockfs" ino=45596 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1013.448892][T10378] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 1013.744823][T10378] usb 5-1: Using ep0 maxpacket: 32 [ 1013.756524][T10378] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 1013.769409][T10378] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1014.000441][T10378] usb 5-1: config 0 has no interface number 0 [ 1014.026350][T10378] usb 5-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1014.044737][T10378] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1014.053940][T10378] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.064722][T10378] usb 5-1: Product: syz [ 1014.083772][T10378] usb 5-1: Manufacturer: syz [ 1014.098959][T10378] usb 5-1: SerialNumber: syz [ 1014.109811][T10378] usb 5-1: config 0 descriptor?? [ 1014.124351][T10378] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1014.161956][T15929] block nbd3: NBD_DISCONNECT [ 1014.256719][T15932] syzkaller0: entered promiscuous mode [ 1014.263088][T15932] syzkaller0: entered allmulticast mode [ 1014.288272][ C0] vcan0: j1939_tp_rxtimer: 0xffff888079edc800: rx timeout, send abort [ 1014.464314][T15938] netlink: 'syz.4.2538': attribute type 4 has an invalid length. [ 1014.823401][ C0] vcan0: j1939_tp_rxtimer: 0xffff888079ede800: rx timeout, send abort [ 1014.832245][ C0] vcan0: j1939_tp_rxtimer: 0xffff888079edc800: abort rx timeout. Force session deactivation [ 1015.365920][ C0] vcan0: j1939_tp_rxtimer: 0xffff888079ede800: abort rx timeout. Force session deactivation [ 1016.804375][ T6018] net_ratelimit: 13 callbacks suppressed [ 1016.804394][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1018.079754][ T6018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1018.104591][T14869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1018.705314][T15959] lo speed is unknown, defaulting to 1000 [ 1018.715273][T15965] lo speed is unknown, defaulting to 1000 [ 1018.909970][T10378] usb 5-1: qt2_attach - failed to power on unit: -71 [ 1018.924757][T10378] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 1018.973055][T10378] usb 5-1: USB disconnect, device number 46 [ 1019.304654][T15977] lo speed is unknown, defaulting to 1000 [ 1020.121374][ T29] kauditd_printk_skb: 24 callbacks suppressed [ 1020.121391][ T29] audit: type=1400 audit(2000000761.348:2719): avc: denied { read write } for pid=15981 comm="syz.0.2552" name="video7" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1020.175781][ T29] audit: type=1400 audit(2000000761.348:2720): avc: denied { open } for pid=15981 comm="syz.0.2552" path="/dev/video7" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1020.239118][T15990] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47720 sclass=netlink_route_socket pid=15990 comm=syz.0.2552 [ 1020.255662][ T29] audit: type=1400 audit(2000000761.460:2721): avc: denied { write } for pid=15981 comm="syz.0.2552" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1020.340974][ T29] audit: type=1400 audit(2000000761.470:2722): avc: denied { ioctl } for pid=15981 comm="syz.0.2552" path="/dev/video7" dev="devtmpfs" ino=951 ioctlcmd=0x5605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1020.614699][ T29] audit: type=1400 audit(2000000761.638:2723): avc: denied { read write } for pid=15993 comm="syz.4.2555" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1020.638777][ T978] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1020.650503][ T29] audit: type=1400 audit(2000000761.638:2724): avc: denied { open } for pid=15993 comm="syz.4.2555" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1020.793415][ T978] usb 1-1: device descriptor read/64, error -71 [ 1020.864395][ T29] audit: type=1400 audit(2000000761.919:2725): avc: denied { read } for pid=15999 comm="syz.3.2556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1020.916470][ T29] audit: type=1400 audit(2000000761.984:2726): avc: denied { connect } for pid=15993 comm="syz.4.2555" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1021.667079][ T29] audit: type=1400 audit(2000000761.994:2727): avc: denied { name_connect } for pid=15993 comm="syz.4.2555" dest=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1021.689457][ T29] audit: type=1400 audit(2000000762.041:2728): avc: denied { shutdown } for pid=15993 comm="syz.4.2555" lport=52407 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1021.748295][ T978] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1022.051141][ T978] usb 1-1: device descriptor read/64, error -71 [ 1022.136258][T16014] syzkaller0: entered promiscuous mode [ 1022.193396][ T978] usb usb1-port1: attempt power cycle [ 1022.252180][T16014] syzkaller0: entered allmulticast mode [ 1022.618879][ T978] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1022.639685][ T978] usb 1-1: device descriptor read/8, error -71 [ 1023.016351][ T978] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1023.048367][ T978] usb 1-1: device descriptor read/8, error -71 [ 1023.165274][ T978] usb usb1-port1: unable to enumerate USB device [ 1023.197008][T16028] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1023.351223][T16025] netlink: 'syz.2.2561': attribute type 1 has an invalid length. [ 1023.416547][T16029] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2561'. [ 1026.025905][T16025] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1026.169577][T16036] lo speed is unknown, defaulting to 1000 [ 1026.694892][ T29] kauditd_printk_skb: 15 callbacks suppressed [ 1026.726160][ T29] audit: type=1400 audit(2000000767.206:2744): avc: denied { read write } for pid=16045 comm="syz.4.2566" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1026.750631][ T5818] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1026.798918][ T29] audit: type=1400 audit(2000000767.206:2745): avc: denied { open } for pid=16045 comm="syz.4.2566" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1026.823168][ T29] audit: type=1400 audit(2000000767.216:2746): avc: denied { ioctl } for pid=16045 comm="syz.4.2566" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1026.881259][ T29] audit: type=1400 audit(2000000767.618:2747): avc: denied { ioctl } for pid=5810 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.002885][ T29] audit: type=1400 audit(2000000767.768:2748): avc: denied { read write } for pid=5822 comm="syz-executor" name="loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.040249][ T29] audit: type=1400 audit(2000000767.768:2749): avc: denied { open } for pid=5822 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.107449][ T29] audit: type=1400 audit(2000000767.814:2750): avc: denied { read } for pid=16051 comm="syz.4.2569" dev="nsfs" ino=4026533222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1027.161945][T16061] netlink: 148 bytes leftover after parsing attributes in process `syz.3.2570'. [ 1027.195207][ T29] audit: type=1400 audit(2000000767.814:2751): avc: denied { open } for pid=16051 comm="syz.4.2569" path="net:[4026533222]" dev="nsfs" ino=4026533222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1027.262210][ T29] audit: type=1400 audit(2000000767.814:2752): avc: denied { create } for pid=16051 comm="syz.4.2569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1027.308642][ T29] audit: type=1400 audit(2000000767.814:2753): avc: denied { create } for pid=16053 comm="syz.3.2568" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1027.435472][T16065] FAULT_INJECTION: forcing a failure. [ 1027.435472][T16065] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1027.470647][T16065] CPU: 0 UID: 0 PID: 16065 Comm: syz.3.2572 Tainted: G L syzkaller #0 PREEMPT(full) [ 1027.470674][T16065] Tainted: [L]=SOFTLOCKUP [ 1027.470679][T16065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1027.470686][T16065] Call Trace: [ 1027.470690][T16065] [ 1027.470695][T16065] dump_stack_lvl+0x100/0x190 [ 1027.470717][T16065] should_fail_ex.cold+0x5/0xa [ 1027.470732][T16065] _copy_from_user+0x2e/0xd0 [ 1027.470745][T16065] input_event_from_user+0x123/0x310 [ 1027.470763][T16065] ? __pfx_input_event_from_user+0x10/0x10 [ 1027.470780][T16065] ? __pfx___might_resched+0x10/0x10 [ 1027.470795][T16065] ? input_inject_event+0x1c9/0x3b0 [ 1027.470813][T16065] evdev_write+0x342/0x610 [ 1027.470832][T16065] ? __pfx_evdev_write+0x10/0x10 [ 1027.470849][T16065] ? bpf_lsm_file_permission+0x9/0x10 [ 1027.470868][T16065] ? security_file_permission+0x76/0x210 [ 1027.470886][T16065] ? rw_verify_area+0xce/0x6d0 [ 1027.470904][T16065] vfs_write+0x2aa/0x1070 [ 1027.470922][T16065] ? __pfx_evdev_write+0x10/0x10 [ 1027.470939][T16065] ? __pfx_vfs_write+0x10/0x10 [ 1027.470955][T16065] ? find_held_lock+0x2b/0x80 [ 1027.470970][T16065] ? __fget_files+0x215/0x3d0 [ 1027.470982][T16065] ? __fget_files+0x215/0x3d0 [ 1027.470996][T16065] ? __fget_files+0x21f/0x3d0 [ 1027.471011][T16065] ksys_write+0x1f8/0x250 [ 1027.471029][T16065] ? __pfx_ksys_write+0x10/0x10 [ 1027.471050][T16065] do_syscall_64+0x106/0xf80 [ 1027.471066][T16065] ? clear_bhb_loop+0x40/0x90 [ 1027.471081][T16065] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.471093][T16065] RIP: 0033:0x7f80c499c799 [ 1027.471104][T16065] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1027.471115][T16065] RSP: 002b:00007f80c57df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1027.471128][T16065] RAX: ffffffffffffffda RBX: 00007f80c4c15fa0 RCX: 00007f80c499c799 [ 1027.471140][T16065] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 1027.471147][T16065] RBP: 00007f80c57df090 R08: 0000000000000000 R09: 0000000000000000 [ 1027.471153][T16065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1027.471160][T16065] R13: 00007f80c4c16038 R14: 00007f80c4c15fa0 R15: 00007ffe367b4428 [ 1027.471174][T16065] [ 1029.815943][T16098] netlink: 'syz.2.2583': attribute type 10 has an invalid length. [ 1029.858272][T16098] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 1029.894884][T16098] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1029.939331][T16098] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 1030.514048][T16105] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1032.066496][ T29] kauditd_printk_skb: 60 callbacks suppressed [ 1032.066513][ T29] audit: type=1400 audit(2000000772.531:2814): avc: denied { read write } for pid=16124 comm="syz.0.2587" name="sg0" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1032.097528][T16125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2587'. [ 1032.259283][ T29] audit: type=1400 audit(2000000772.531:2815): avc: denied { open } for pid=16124 comm="syz.0.2587" path="/dev/sg0" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1032.663794][ T29] audit: type=1400 audit(2000000773.074:2816): avc: denied { setopt } for pid=16129 comm="syz.1.2589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1032.949477][T16134] lo speed is unknown, defaulting to 1000 [ 1033.137926][ T29] audit: type=1400 audit(2000000773.532:2817): avc: denied { search } for pid=16133 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.171963][ T29] audit: type=1400 audit(2000000773.532:2818): avc: denied { search } for pid=16133 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1837 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.204019][ T29] audit: type=1400 audit(2000000773.532:2819): avc: denied { search } for pid=16133 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.354251][ T29] audit: type=1400 audit(2000000773.532:2820): avc: denied { search } for pid=16133 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.549538][ T29] audit: type=1400 audit(2000000773.551:2821): avc: denied { read open } for pid=16137 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.624162][ T29] audit: type=1400 audit(2000000773.551:2822): avc: denied { getattr } for pid=16137 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1033.705137][ T29] audit: type=1400 audit(2000000773.551:2823): avc: denied { getattr } for pid=16137 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1881 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1034.492324][T16161] x_tables: duplicate underflow at hook 2 [ 1036.072889][T16179] lo speed is unknown, defaulting to 1000 [ 1036.441190][T16171] block nbd3: NBD_DISCONNECT [ 1036.818099][T16201] lo speed is unknown, defaulting to 1000 [ 1037.560233][ T29] kauditd_printk_skb: 21 callbacks suppressed [ 1037.560251][ T29] audit: type=1400 audit(2000000777.668:2845): avc: denied { create } for pid=16208 comm="syz.2.2606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1037.741895][T16210] lo speed is unknown, defaulting to 1000 [ 1038.403870][ T29] audit: type=1400 audit(2000000778.445:2846): avc: denied { create } for pid=16208 comm="syz.2.2606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1038.630030][ T29] audit: type=1400 audit(2000000778.473:2847): avc: denied { create } for pid=16218 comm="syz.1.2608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1039.394603][T10378] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1039.402368][ T29] audit: type=1400 audit(2000000778.473:2848): avc: denied { setopt } for pid=16218 comm="syz.1.2608" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1040.014607][T10378] usb 3-1: Using ep0 maxpacket: 16 [ 1040.038306][ T29] audit: type=1400 audit(2000000778.557:2849): avc: denied { read write } for pid=16218 comm="syz.1.2608" name="video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1040.075739][T10378] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1040.209615][T10378] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1040.230910][ T29] audit: type=1400 audit(2000000778.557:2850): avc: denied { open } for pid=16218 comm="syz.1.2608" path="/dev/video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1040.369351][T10378] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 1040.407622][T10378] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.991141][T10378] usb 3-1: config 0 descriptor?? [ 1041.066451][ T29] audit: type=1400 audit(2000000778.557:2851): avc: denied { ioctl } for pid=16218 comm="syz.1.2608" path="/dev/video2" dev="devtmpfs" ino=932 ioctlcmd=0x6720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1041.424972][ T29] audit: type=1400 audit(2000000778.557:2852): avc: denied { read } for pid=16218 comm="syz.1.2608" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1041.793135][ T29] audit: type=1400 audit(2000000778.557:2853): avc: denied { open } for pid=16218 comm="syz.1.2608" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1041.818103][ T29] audit: type=1400 audit(2000000778.557:2854): avc: denied { ioctl } for pid=16218 comm="syz.1.2608" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1042.230124][T16271] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=16271 comm=syz.4.2620 [ 1042.283304][T10378] usb 3-1: can't set config #0, error -71 [ 1042.290505][T10378] usb 3-1: USB disconnect, device number 33 [ 1044.067477][ T29] kauditd_printk_skb: 22 callbacks suppressed [ 1044.067491][ T29] audit: type=1400 audit(2000000783.751:2877): avc: denied { create } for pid=16290 comm="syz.4.2625" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1044.192661][ T29] audit: type=1400 audit(2000000783.751:2878): avc: denied { getopt } for pid=16290 comm="syz.4.2625" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1045.327880][ T29] audit: type=1400 audit(2000000784.865:2879): avc: denied { bind } for pid=16272 comm="syz.3.2619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1045.625825][ T29] audit: type=1400 audit(2000000785.220:2880): avc: denied { mounton } for pid=16311 comm="syz.4.2628" path="/516/file0" dev="tmpfs" ino=2761 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1045.722603][ T29] audit: type=1400 audit(2000000785.239:2881): avc: denied { mount } for pid=16311 comm="syz.4.2628" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1045.806311][ T29] audit: type=1400 audit(2000000785.258:2882): avc: denied { ioctl } for pid=16311 comm="syz.4.2628" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1045.919622][ T29] audit: type=1400 audit(2000000785.286:2883): avc: denied { unmount } for pid=5822 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1046.522314][ T29] audit: type=1800 audit(2000000785.791:2884): pid=16327 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2629" name="file0" dev="overlay" ino=2775 res=0 errno=0 [ 1046.757356][T16328] input: syz1 as /devices/virtual/input/input55 [ 1046.808018][ T29] audit: type=1400 audit(2000000786.315:2885): avc: denied { read } for pid=5168 comm="acpid" name="event4" dev="devtmpfs" ino=3153 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1046.835709][ T29] audit: type=1400 audit(2000000786.315:2886): avc: denied { open } for pid=5168 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3153 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1046.850864][T16328] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2631'. [ 1047.313007][T16344] lo speed is unknown, defaulting to 1000 [ 1050.081194][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 1050.081237][ T29] audit: type=1800 audit(2000000789.375:2889): pid=16369 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.2639" name="file0" dev="overlay" ino=2838 res=0 errno=0 [ 1054.047417][ T29] audit: type=1400 audit(2000000792.688:2890): avc: denied { write } for pid=16425 comm="syz.1.2648" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1054.098068][ T29] audit: type=1400 audit(2000000792.697:2891): avc: denied { read write } for pid=16425 comm="syz.1.2648" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1054.281262][ T29] audit: type=1400 audit(2000000792.697:2892): avc: denied { open } for pid=16425 comm="syz.1.2648" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1054.505284][ T29] audit: type=1400 audit(2000000792.707:2893): avc: denied { ioctl } for pid=16425 comm="syz.1.2648" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1054.714230][T16444] lo speed is unknown, defaulting to 1000 [ 1055.108307][ T29] audit: type=1400 audit(2000000793.278:2894): avc: denied { read write } for pid=5814 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1055.194390][ T29] audit: type=1400 audit(2000000793.278:2895): avc: denied { open } for pid=5814 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1055.284463][ T29] audit: type=1400 audit(2000000793.278:2896): avc: denied { ioctl } for pid=5814 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1055.642637][ T29] audit: type=1400 audit(2000000793.296:2897): avc: denied { search } for pid=16413 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.758364][ T29] audit: type=1400 audit(2000000793.296:2898): avc: denied { search } for pid=16413 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1837 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.781603][ T29] audit: type=1400 audit(2000000793.296:2899): avc: denied { search } for pid=16413 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.807705][ T29] audit: type=1400 audit(2000000793.296:2900): avc: denied { getattr } for pid=16413 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.836440][ T29] audit: type=1400 audit(2000000793.296:2901): avc: denied { add_name } for pid=16413 comm="dhcpcd-run-hook" name="resolv.conf.lapb5.dhcp" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.859239][ T29] audit: type=1400 audit(2000000793.296:2902): avc: denied { create } for pid=16413 comm="dhcpcd-run-hook" name="resolv.conf.lapb5.dhcp" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1056.000105][ T29] audit: type=1400 audit(2000000793.296:2903): avc: denied { write open } for pid=16413 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.lapb5.dhcp" dev="tmpfs" ino=6779 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1056.252516][ T29] audit: type=1400 audit(2000000793.296:2904): avc: denied { append } for pid=16413 comm="dhcpcd-run-hook" name="resolv.conf.lapb5.dhcp" dev="tmpfs" ino=6779 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1056.318939][ T29] audit: type=1400 audit(2000000793.306:2905): avc: denied { getattr } for pid=16413 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.lapb5.dhcp" dev="tmpfs" ino=6779 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1056.486502][ T29] audit: type=1400 audit(2000000793.343:2906): avc: denied { allowed } for pid=16429 comm="syz.2.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1057.394598][T16470] syzkaller0: entered promiscuous mode [ 1057.659436][T16470] syzkaller0: entered allmulticast mode [ 1058.180606][ T978] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1058.458831][ T978] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xCE, changing to 0x8E [ 1058.471194][ T978] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 999, setting to 64 [ 1058.503286][ T978] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 1058.523665][ T978] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1058.531834][ T978] usb 2-1: Product: syz [ 1058.536372][ T978] usb 2-1: Manufacturer: syz [ 1058.540971][ T978] usb 2-1: SerialNumber: syz [ 1059.177509][T16488] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2660'. [ 1059.687439][ T5896] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1059.849612][ T5896] usb 3-1: Using ep0 maxpacket: 32 [ 1059.865406][ T5896] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1059.876600][ T5896] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1059.895360][ T5896] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1059.907602][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1059.924108][ T5896] usb 3-1: config 0 descriptor?? [ 1059.932131][ T5896] hub 3-1:0.0: USB hub found [ 1060.161632][ T5896] hub 3-1:0.0: 1 port detected [ 1060.818119][T16498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1060.829597][T16498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1060.993568][T16488] ŞŞŞŞŞŞ: renamed from vlan0 (while UP) [ 1061.009311][T16494] lo speed is unknown, defaulting to 1000 [ 1061.094403][T10378] usb 3-1: USB disconnect, device number 34 [ 1061.102001][ T978] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1061.132535][ T978] usb 2-1: MIDIStreaming interface descriptor not found [ 1061.229577][ T978] usb 2-1: USB disconnect, device number 42 [ 1061.527617][ T29] kauditd_printk_skb: 48 callbacks suppressed [ 1061.527636][ T29] audit: type=1400 audit(2000000800.100:2955): avc: denied { map_create } for pid=16510 comm="syz.3.2666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1061.554487][ T29] audit: type=1400 audit(2000000800.100:2956): avc: denied { map_read map_write } for pid=16510 comm="syz.3.2666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1062.194701][ T29] audit: type=1400 audit(2000000800.717:2957): avc: denied { read } for pid=16510 comm="syz.3.2666" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1062.229049][T16514] syzkaller0: entered promiscuous mode [ 1062.235120][T16514] syzkaller0: entered allmulticast mode [ 1062.243205][ T29] audit: type=1400 audit(2000000800.717:2958): avc: denied { open } for pid=16510 comm="syz.3.2666" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1063.167119][ T29] audit: type=1400 audit(2000000800.998:2959): avc: denied { write } for pid=16519 comm="syz.1.2669" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1063.252750][ T29] audit: type=1400 audit(2000000801.007:2960): avc: denied { read write } for pid=16519 comm="syz.1.2669" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1063.873753][ T29] audit: type=1400 audit(2000000801.007:2961): avc: denied { open } for pid=16519 comm="syz.1.2669" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1063.897837][ T29] audit: type=1400 audit(2000000801.017:2962): avc: denied { ioctl } for pid=16519 comm="syz.1.2669" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1063.951340][ T29] audit: type=1400 audit(2000000801.578:2963): avc: denied { prog_load } for pid=16510 comm="syz.3.2666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1063.970694][ T29] audit: type=1400 audit(2000000801.578:2964): avc: denied { bpf } for pid=16510 comm="syz.3.2666" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1064.813083][T16556] FAULT_INJECTION: forcing a failure. [ 1064.813083][T16556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1064.828120][T16556] CPU: 1 UID: 0 PID: 16556 Comm: syz.4.2676 Tainted: G L syzkaller #0 PREEMPT(full) [ 1064.828150][T16556] Tainted: [L]=SOFTLOCKUP [ 1064.828156][T16556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1064.828166][T16556] Call Trace: [ 1064.828172][T16556] [ 1064.828179][T16556] dump_stack_lvl+0x100/0x190 [ 1064.828213][T16556] should_fail_ex.cold+0x5/0xa [ 1064.828234][T16556] _copy_from_user+0x2e/0xd0 [ 1064.828252][T16556] copy_msghdr_from_user+0x9f/0x4f0 [ 1064.828271][T16556] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1064.828298][T16556] ___sys_sendmsg+0x106/0x1e0 [ 1064.828317][T16556] ? __pfx____sys_sendmsg+0x10/0x10 [ 1064.828362][T16556] __sys_sendmsg+0x170/0x220 [ 1064.828385][T16556] ? __pfx___sys_sendmsg+0x10/0x10 [ 1064.828420][T16556] do_syscall_64+0x106/0xf80 [ 1064.828443][T16556] ? clear_bhb_loop+0x40/0x90 [ 1064.828465][T16556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.828483][T16556] RIP: 0033:0x7f585419c799 [ 1064.828499][T16556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1064.828515][T16556] RSP: 002b:00007f5854fcf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1064.828532][T16556] RAX: ffffffffffffffda RBX: 00007f5854415fa0 RCX: 00007f585419c799 [ 1064.828544][T16556] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1064.828554][T16556] RBP: 00007f5854fcf090 R08: 0000000000000000 R09: 0000000000000000 [ 1064.828564][T16556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1064.828574][T16556] R13: 00007f5854416038 R14: 00007f5854415fa0 R15: 00007ffdf3731378 [ 1064.828598][T16556] [ 1066.174228][T14869] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1066.344812][T14869] usb 5-1: Using ep0 maxpacket: 16 [ 1066.357931][T14869] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1066.402407][T14869] usb 5-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 1066.419410][T14869] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.440969][T14869] usb 5-1: Product: syz [ 1066.452611][T14869] usb 5-1: Manufacturer: syz [ 1066.457308][T14869] usb 5-1: SerialNumber: syz [ 1066.725553][T16559] overlay: filesystem on ./file0 not supported as upperdir [ 1067.484164][T16552] syzkaller0: entered promiscuous mode [ 1067.500400][T16552] syzkaller0: entered allmulticast mode [ 1067.587694][ T29] kauditd_printk_skb: 42 callbacks suppressed [ 1067.587710][ T29] audit: type=1400 audit(2000000805.771:3007): avc: denied { read } for pid=16568 comm="syz.0.2680" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1067.617787][ T29] audit: type=1400 audit(2000000805.771:3008): avc: denied { open } for pid=16568 comm="syz.0.2680" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1067.681951][T16570] CUSE: info not properly terminated [ 1067.808956][ T29] audit: type=1400 audit(2000000805.845:3009): avc: denied { shutdown } for pid=16568 comm="syz.0.2680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1067.830846][ T29] audit: type=1400 audit(2000000805.864:3010): avc: denied { connect } for pid=16568 comm="syz.0.2680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1068.002792][ T29] audit: type=1400 audit(2000000805.864:3011): avc: denied { read write } for pid=16568 comm="syz.0.2680" name="sg0" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1068.427898][ T29] audit: type=1400 audit(2000000805.864:3012): avc: denied { open } for pid=16568 comm="syz.0.2680" path="/dev/sg0" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1068.482186][T14869] usb 5-1: USB disconnect, device number 47 [ 1068.495191][ T29] audit: type=1400 audit(2000000805.873:3013): avc: denied { ioctl } for pid=16568 comm="syz.0.2680" path="/dev/sg0" dev="devtmpfs" ino=815 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1068.526892][ T29] audit: type=1400 audit(2000000806.257:3014): avc: denied { create } for pid=16575 comm="syz.2.2681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1068.555793][ T29] audit: type=1400 audit(2000000806.266:3015): avc: denied { ioctl } for pid=16575 comm="syz.2.2681" path="socket:[49526]" dev="sockfs" ino=49526 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1068.582457][ T29] audit: type=1400 audit(2000000806.266:3016): avc: denied { create } for pid=16575 comm="syz.2.2681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1068.611228][T16030] udevd[16030]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1071.074944][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 1071.081330][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1072.307582][T14869] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1072.478685][T14869] usb 5-1: Using ep0 maxpacket: 8 [ 1072.488890][T14869] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1072.524175][T14869] usb 5-1: config 11 has an invalid interface number: 119 but max is 1 [ 1072.544607][T14869] usb 5-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 1072.570086][T14869] usb 5-1: config 11 has an invalid interface number: 171 but max is 1 [ 1072.579608][T14869] usb 5-1: config 11 has no interface number 0 [ 1072.586103][T14869] usb 5-1: config 11 has no interface number 1 [ 1072.592363][T14869] usb 5-1: config 11 interface 119 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1072.609940][T14869] usb 5-1: config 11 interface 119 altsetting 6 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 1072.627800][T14869] usb 5-1: config 11 interface 119 altsetting 6 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 1072.647204][T14869] usb 5-1: config 11 interface 119 altsetting 6 endpoint 0xD has invalid wMaxPacketSize 0 [ 1072.657203][T14869] usb 5-1: config 11 interface 119 altsetting 6 has a duplicate endpoint with address 0x2, skipping [ 1072.669244][T14869] usb 5-1: config 11 interface 119 altsetting 6 has a duplicate endpoint with address 0x2, skipping [ 1072.680140][T14869] usb 5-1: config 11 interface 119 altsetting 6 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 1072.691397][T14869] usb 5-1: config 11 interface 119 altsetting 6 has a duplicate endpoint with address 0xD, skipping [ 1072.702216][T14869] usb 5-1: config 11 interface 119 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 1072.713306][T14869] usb 5-1: config 11 interface 119 has no altsetting 0 [ 1072.721409][T14869] usb 5-1: config 11 interface 171 has no altsetting 0 [ 1072.730202][T14869] usb 5-1: New USB device found, idVendor=0403, idProduct=e001, bcdDevice=c1.fa [ 1072.739499][T14869] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.747606][T14869] usb 5-1: Product: syz [ 1072.751777][T14869] usb 5-1: Manufacturer: syz [ 1072.760645][T14869] usb 5-1: SerialNumber: syz [ 1072.777095][T16605] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1072.818404][T16564] lo speed is unknown, defaulting to 1000 [ 1073.026457][T16603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1073.029297][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 1073.029315][ T29] audit: type=1400 audit(2000000810.861:3026): avc: denied { create } for pid=16602 comm="syz.4.2687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1073.035582][T16603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1073.045384][T16612] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2690'. [ 1073.109053][ T29] audit: type=1400 audit(2000000810.908:3027): avc: denied { ioctl } for pid=16610 comm="syz.3.2691" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1073.463735][T16603] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2687'. [ 1073.523311][ T29] audit: type=1400 audit(2000000810.908:3028): avc: denied { write } for pid=16610 comm="syz.3.2691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1073.544690][T16616] program syz.0.2692 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1073.554118][ T29] audit: type=1400 audit(2000000810.908:3029): avc: denied { bind } for pid=16610 comm="syz.3.2691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1073.574486][T16612] syzkaller0: entered promiscuous mode [ 1073.803650][T16612] syzkaller0: entered allmulticast mode [ 1073.822393][T14869] ftdi_sio 5-1:11.119: FTDI USB Serial Device converter detected [ 1073.857454][ T29] audit: type=1400 audit(2000000810.908:3030): avc: denied { setopt } for pid=16610 comm="syz.3.2691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1073.887964][T14869] ftdi_sio ttyUSB0: unknown device type: 0xc1fa [ 1073.908009][ T29] audit: type=1400 audit(2000000810.908:3031): avc: denied { write } for pid=16610 comm="syz.3.2691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1073.929193][T14869] ftdi_sio 5-1:11.171: FTDI USB Serial Device converter detected [ 1074.829096][T14869] ftdi_sio ttyUSB1: unknown device type: 0xc1fa [ 1074.839693][ T29] audit: type=1800 audit(2000000811.432:3032): pid=16618 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2692" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1074.864599][T14869] usb 5-1: USB disconnect, device number 48 [ 1074.874822][T14869] ftdi_sio 5-1:11.119: device disconnected [ 1074.881032][ T29] audit: type=1400 audit(2000000811.703:3033): avc: denied { setopt } for pid=16625 comm="syz.3.2694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1074.903743][T14869] ftdi_sio 5-1:11.171: device disconnected [ 1075.032501][ T29] audit: type=1400 audit(2000000811.806:3034): avc: denied { setopt } for pid=16625 comm="syz.3.2694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1075.084905][ T29] audit: type=1400 audit(2000000811.806:3035): avc: denied { listen } for pid=16625 comm="syz.3.2694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1076.712101][T16646] syzkaller0: entered promiscuous mode [ 1077.066770][T16646] syzkaller0: entered allmulticast mode [ 1078.275084][T16673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1079.091361][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 1079.091378][ T29] audit: type=1400 audit(2000000816.532:3045): avc: denied { write } for pid=16676 comm="syz.2.2707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1079.554335][ T29] audit: type=1400 audit(2000000816.935:3046): avc: denied { create } for pid=16676 comm="syz.2.2707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1079.638155][T16691] FAULT_INJECTION: forcing a failure. [ 1079.638155][T16691] name failslab, interval 1, probability 0, space 0, times 0 [ 1079.650857][T16691] CPU: 1 UID: 0 PID: 16691 Comm: syz.3.2708 Tainted: G L syzkaller #0 PREEMPT(full) [ 1079.650886][T16691] Tainted: [L]=SOFTLOCKUP [ 1079.650893][T16691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1079.650903][T16691] Call Trace: [ 1079.650910][T16691] [ 1079.650918][T16691] dump_stack_lvl+0x100/0x190 [ 1079.650952][T16691] should_fail_ex.cold+0x5/0xa [ 1079.650976][T16691] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1079.651001][T16691] should_failslab+0xc2/0x120 [ 1079.651020][T16691] __kmalloc_noprof+0xe0/0x850 [ 1079.651050][T16691] tomoyo_realpath_from_path+0xb6/0x690 [ 1079.651081][T16691] tomoyo_path_number_perm+0x23c/0x580 [ 1079.651102][T16691] ? tomoyo_path_number_perm+0x22e/0x580 [ 1079.651125][T16691] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1079.651172][T16691] ? find_held_lock+0x2b/0x80 [ 1079.651195][T16691] ? __fget_files+0x215/0x3d0 [ 1079.651213][T16691] ? hook_file_ioctl_common+0x146/0x410 [ 1079.651245][T16691] ? __fget_files+0x21f/0x3d0 [ 1079.651267][T16691] security_file_ioctl+0xd3/0x230 [ 1079.651293][T16691] __x64_sys_ioctl+0xb7/0x210 [ 1079.651320][T16691] do_syscall_64+0x106/0xf80 [ 1079.651343][T16691] ? clear_bhb_loop+0x40/0x90 [ 1079.651365][T16691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1079.651383][T16691] RIP: 0033:0x7f80c499c799 [ 1079.651398][T16691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1079.651415][T16691] RSP: 002b:00007f80c579d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1079.651433][T16691] RAX: ffffffffffffffda RBX: 00007f80c4c16180 RCX: 00007f80c499c799 [ 1079.651445][T16691] RDX: 0000200000000000 RSI: 000000008038550a RDI: 0000000000000005 [ 1079.651456][T16691] RBP: 00007f80c579d090 R08: 0000000000000000 R09: 0000000000000000 [ 1079.651467][T16691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1079.651477][T16691] R13: 00007f80c4c16218 R14: 00007f80c4c16180 R15: 00007ffe367b4428 [ 1079.651502][T16691] [ 1079.651524][T16691] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1079.798535][ T29] audit: type=1400 audit(2000000817.038:3047): avc: denied { append } for pid=16688 comm="syz.3.2708" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1079.807018][T16691] usb usb9: usbfs: process 16691 (syz.3.2708) did not claim interface 3 before use [ 1081.038195][ T29] audit: type=1800 audit(2000000818.086:3048): pid=16702 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.2710" name="file0" dev="overlay" ino=2919 res=0 errno=0 [ 1081.456942][ T29] audit: type=1400 audit(2000000818.731:3049): avc: denied { read } for pid=16693 comm="syz.3.2709" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1081.480338][ T29] audit: type=1400 audit(2000000818.731:3050): avc: denied { open } for pid=16693 comm="syz.3.2709" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1081.583077][ T29] audit: type=1400 audit(2000000818.731:3051): avc: denied { ioctl } for pid=16693 comm="syz.3.2709" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1083.594695][ T29] audit: type=1400 audit(2000000820.743:3052): avc: denied { bind } for pid=16715 comm="syz.2.2713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1083.614503][ T29] audit: type=1400 audit(2000000820.743:3053): avc: denied { name_bind } for pid=16715 comm="syz.2.2713" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1083.643802][ T29] audit: type=1400 audit(2000000820.743:3054): avc: denied { node_bind } for pid=16715 comm="syz.2.2713" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1083.949766][T16666] lo speed is unknown, defaulting to 1000 [ 1083.959837][T16681] lo speed is unknown, defaulting to 1000 [ 1084.881637][T16734] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2716'. [ 1084.910652][T16734] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1085.273063][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 1085.273080][ T29] audit: type=1400 audit(2000000822.315:3057): avc: denied { ioctl } for pid=16729 comm="syz.4.2716" path="socket:[50433]" dev="sockfs" ino=50433 ioctlcmd=0x42d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1085.313857][T16734] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1086.274517][ T5818] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 1086.295704][ T29] audit: type=1400 audit(2000000822.896:3058): avc: denied { read write } for pid=16738 comm="syz.0.2719" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1086.737669][ T29] audit: type=1400 audit(2000000822.896:3059): avc: denied { open } for pid=16738 comm="syz.0.2719" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1086.818877][ T29] audit: type=1400 audit(2000000822.905:3060): avc: denied { ioctl } for pid=16738 comm="syz.0.2719" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1086.883507][ T29] audit: type=1400 audit(2000000823.335:3061): avc: denied { read } for pid=16743 comm="syz.4.2721" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1087.019524][ T29] audit: type=1400 audit(2000000823.335:3062): avc: denied { open } for pid=16743 comm="syz.4.2721" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1087.757818][ T29] audit: type=1400 audit(2000000823.401:3063): avc: denied { create } for pid=16743 comm="syz.4.2721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1087.919899][ T29] audit: type=1400 audit(2000000823.410:3064): avc: denied { ioctl } for pid=16743 comm="syz.4.2721" path="socket:[49815]" dev="sockfs" ino=49815 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1087.962640][ T29] audit: type=1400 audit(2000000823.466:3065): avc: denied { create } for pid=16743 comm="syz.4.2721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1088.047490][ T29] audit: type=1400 audit(2000000823.466:3066): avc: denied { getopt } for pid=16743 comm="syz.4.2721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1089.186350][T16788] lo speed is unknown, defaulting to 1000 [ 1090.426351][T16802] lo speed is unknown, defaulting to 1000 [ 1090.864737][ T29] kauditd_printk_skb: 46 callbacks suppressed [ 1090.864763][ T29] audit: type=1400 audit(2000000827.547:3113): avc: denied { getopt } for pid=16798 comm="syz.0.2732" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1091.083012][ T29] audit: type=1400 audit(2000000827.612:3114): avc: denied { write } for pid=16798 comm="syz.0.2732" name="event2" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1091.460440][ T29] audit: type=1400 audit(2000000827.612:3115): avc: denied { open } for pid=16798 comm="syz.0.2732" path="/dev/input/event2" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1091.531032][ T29] audit: type=1400 audit(2000000827.631:3116): avc: denied { shutdown } for pid=16809 comm="syz.3.2733" laddr=::1 lport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1091.695401][ T29] audit: type=1400 audit(2000000827.837:3117): avc: denied { write } for pid=16809 comm="syz.3.2733" laddr=::1 lport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1091.958599][T16818] lo speed is unknown, defaulting to 1000 [ 1092.325785][ T29] audit: type=1400 audit(2000000827.837:3118): avc: denied { connect } for pid=16809 comm="syz.3.2733" laddr=::1 lport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1092.354803][ T29] audit: type=1400 audit(2000000827.837:3119): avc: denied { name_connect } for pid=16809 comm="syz.3.2733" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1092.680347][T16831] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1092.706979][ T29] audit: type=1400 audit(2000000829.259:3120): avc: denied { create } for pid=16827 comm="syz.0.2738" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1092.767487][ T29] audit: type=1400 audit(2000000829.306:3121): avc: denied { listen } for pid=16827 comm="syz.0.2738" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1092.855640][ T29] audit: type=1400 audit(2000000829.409:3122): avc: denied { bind } for pid=16808 comm="syz.4.2734" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1093.382179][T16847] lo speed is unknown, defaulting to 1000 [ 1095.530767][ T5896] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1095.710095][ T5896] usb 4-1: Using ep0 maxpacket: 32 [ 1095.722890][ T5896] usb 4-1: New USB device found, idVendor=0763, idProduct=2012, bcdDevice= 0.40 [ 1095.737673][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1095.991781][ T5896] usb 4-1: Product: syz [ 1095.995980][ T5896] usb 4-1: Manufacturer: syz [ 1096.001009][ T5896] usb 4-1: SerialNumber: syz [ 1096.031451][ T5896] usb 4-1: Fast Track Pro switching to config #2 [ 1096.345236][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 1096.345254][ T29] audit: type=1400 audit(2000000832.675:3137): avc: denied { create } for pid=16872 comm="syz.3.2747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1096.579619][T16904] lo speed is unknown, defaulting to 1000 [ 1096.613730][T16905] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 1096.636433][T16905] SELinux: failed to load policy [ 1096.660496][ T29] audit: type=1400 audit(2000000832.890:3139): avc: denied { ioctl } for pid=16897 comm="syz.4.2754" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=50064 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1096.783871][ T29] audit: type=1400 audit(2000000832.890:3138): avc: denied { load_policy } for pid=16872 comm="syz.3.2747" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1096.820602][ T5896] IPVS: starting estimator thread 0... [ 1096.913245][ T29] audit: type=1400 audit(2000000833.068:3140): avc: denied { ioctl } for pid=16897 comm="syz.4.2754" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1096.940602][T16908] IPVS: using max 57 ests per chain, 136800 per kthread [ 1097.132899][ T5895] usb 4-1: USB disconnect, device number 35 [ 1097.875612][ T35] IPVS: stop unused estimator thread 0... [ 1098.173351][ T29] audit: type=1400 audit(2000000834.340:3141): avc: denied { read } for pid=16920 comm="syz.1.2758" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1098.754111][ T29] audit: type=1400 audit(2000000834.340:3142): avc: denied { ioctl } for pid=16920 comm="syz.1.2758" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1098.844269][ T29] audit: type=1400 audit(2000000834.415:3143): avc: denied { write } for pid=16920 comm="syz.1.2758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1099.205291][T16930] lo speed is unknown, defaulting to 1000 [ 1099.533399][ T29] audit: type=1400 audit(2000000834.425:3144): avc: denied { ioctl } for pid=16920 comm="syz.1.2758" path="socket:[50163]" dev="sockfs" ino=50163 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1099.714571][T16938] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1101.494126][T16952] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2766'. [ 1101.682477][ T29] audit: type=1400 audit(2000000837.541:3145): avc: denied { write } for pid=16953 comm="syz.0.2767" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1101.740071][T16957] fuse: Unknown parameter '0000000000000000000001101777777777777777777777' [ 1101.760004][ T29] audit: type=1400 audit(2000000837.728:3146): avc: denied { mounton } for pid=16950 comm="syz.4.2766" path="/547/file0" dev="tmpfs" ino=2949 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1101.819300][T16959] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2767'. [ 1101.907885][T16959] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2767'. [ 1102.704763][ T29] audit: type=1400 audit(2000000838.486:3147): avc: denied { write } for pid=16951 comm="syz.3.2768" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 1103.205667][ T29] audit: type=1400 audit(2000000838.748:3148): avc: denied { unlink } for pid=16963 comm="syz.4.2770" name="#1f" dev="tmpfs" ino=2961 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1103.229277][ T29] audit: type=1400 audit(2000000838.757:3149): avc: denied { mount } for pid=16963 comm="syz.4.2770" name="/" dev="overlay" ino=2955 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1103.312409][ T29] audit: type=1800 audit(2000000838.776:3150): pid=16967 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2770" name="file0" dev="overlay" ino=2963 res=0 errno=0 [ 1103.493432][ T29] audit: type=1400 audit(2000000839.366:3151): avc: denied { unmount } for pid=5822 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1104.054867][ T5818] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 1104.065735][ T29] audit: type=1400 audit(2000000839.525:3152): avc: denied { read write } for pid=16968 comm="syz.0.2771" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1104.147582][ T29] audit: type=1400 audit(2000000839.525:3153): avc: denied { open } for pid=16968 comm="syz.0.2771" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1104.171510][ T29] audit: type=1400 audit(2000000839.525:3154): avc: denied { ioctl } for pid=16968 comm="syz.0.2771" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1104.197783][ T29] audit: type=1400 audit(2000000840.002:3155): avc: denied { read write } for pid=5814 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1105.854729][T16996] lo speed is unknown, defaulting to 1000 [ 1106.993770][T17024] lo speed is unknown, defaulting to 1000 [ 1107.348940][ T29] kauditd_printk_skb: 54 callbacks suppressed [ 1107.348962][ T29] audit: type=1400 audit(2000000842.978:3210): avc: denied { read write } for pid=17027 comm="syz.1.2786" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1107.459416][T17034] fuse: Bad value for 'fd' [ 1108.049173][T17036] lo speed is unknown, defaulting to 1000 [ 1108.113721][ T29] audit: type=1400 audit(2000000843.081:3211): avc: denied { open } for pid=17027 comm="syz.1.2786" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1108.308877][ T29] audit: type=1400 audit(2000000843.081:3212): avc: denied { mounton } for pid=17027 comm="syz.1.2786" path="/548/file0" dev="tmpfs" ino=2952 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1109.230128][ T29] audit: type=1400 audit(2000000844.737:3213): avc: denied { prog_load } for pid=17054 comm="syz.2.2791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1109.612959][ T29] audit: type=1400 audit(2000000844.737:3214): avc: denied { bpf } for pid=17054 comm="syz.2.2791" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1109.679030][ T29] audit: type=1400 audit(2000000844.737:3215): avc: denied { perfmon } for pid=17054 comm="syz.2.2791" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1109.706219][ T29] audit: type=1400 audit(2000000844.859:3216): avc: denied { create } for pid=17054 comm="syz.2.2791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1110.796280][ T29] audit: type=1400 audit(2000000846.197:3217): avc: denied { map_create } for pid=17070 comm="syz.2.2796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1110.817908][T17073] FAULT_INJECTION: forcing a failure. [ 1110.817908][T17073] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1110.852219][T17073] CPU: 1 UID: 0 PID: 17073 Comm: syz.3.2795 Tainted: G L syzkaller #0 PREEMPT(full) [ 1110.852250][T17073] Tainted: [L]=SOFTLOCKUP [ 1110.852257][T17073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1110.852267][T17073] Call Trace: [ 1110.852274][T17073] [ 1110.852281][T17073] dump_stack_lvl+0x100/0x190 [ 1110.852315][T17073] should_fail_ex.cold+0x5/0xa [ 1110.852336][T17073] _copy_from_user+0x2e/0xd0 [ 1110.852355][T17073] ____sys_sendmsg+0x1d1/0xb70 [ 1110.852392][T17073] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1110.852428][T17073] ___sys_sendmsg+0x190/0x1e0 [ 1110.852446][T17073] ? __pfx____sys_sendmsg+0x10/0x10 [ 1110.852488][T17073] __sys_sendmsg+0x170/0x220 [ 1110.852509][T17073] ? __pfx___sys_sendmsg+0x10/0x10 [ 1110.852542][T17073] do_syscall_64+0x106/0xf80 [ 1110.852564][T17073] ? clear_bhb_loop+0x40/0x90 [ 1110.852586][T17073] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.852604][T17073] RIP: 0033:0x7f80c499c799 [ 1110.852618][T17073] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1110.852633][T17073] RSP: 002b:00007f80c57df028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1110.852651][T17073] RAX: ffffffffffffffda RBX: 00007f80c4c15fa0 RCX: 00007f80c499c799 [ 1110.852662][T17073] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 1110.852673][T17073] RBP: 00007f80c57df090 R08: 0000000000000000 R09: 0000000000000000 [ 1110.852684][T17073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1110.852695][T17073] R13: 00007f80c4c16038 R14: 00007f80c4c15fa0 R15: 00007ffe367b4428 [ 1110.852718][T17073] [ 1110.856635][ T29] audit: type=1400 audit(2000000846.197:3218): avc: denied { map_read map_write } for pid=17070 comm="syz.2.2796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1111.672790][T17083] lo speed is unknown, defaulting to 1000 [ 1111.709805][ T29] audit: type=1400 audit(2000000847.011:3219): avc: denied { create } for pid=17077 comm="syz.4.2797" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1112.753256][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 1112.753278][ T29] audit: type=1400 audit(2000000848.031:3231): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1113.108939][ T29] audit: type=1400 audit(2000000848.190:3232): avc: denied { create } for pid=17093 comm="syz.0.2800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1113.171849][ T29] audit: type=1400 audit(2000000848.200:3233): avc: denied { write } for pid=17093 comm="syz.0.2800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1113.543451][ T29] audit: type=1400 audit(2000000848.200:3234): avc: denied { read } for pid=17093 comm="syz.0.2800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1113.646554][ T29] audit: type=1800 audit(2000000848.209:3235): pid=17095 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2800" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 1113.946778][ T29] audit: type=1400 audit(2000000848.565:3236): avc: denied { bind } for pid=17098 comm="syz.3.2801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1114.166630][ T29] audit: type=1400 audit(2000000848.565:3237): avc: denied { write } for pid=17098 comm="syz.3.2801" path="socket:[51200]" dev="sockfs" ino=51200 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1114.272785][T17112] dlm: non-version read from control device 0 [ 1114.367805][ T29] audit: type=1400 audit(2000000848.574:3238): avc: denied { create } for pid=17098 comm="syz.3.2801" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1114.518142][ T29] audit: type=1400 audit(2000000848.817:3239): avc: denied { create } for pid=17096 comm="syz.1.2802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1114.634214][ T29] audit: type=1400 audit(2000000848.827:3240): avc: denied { write } for pid=17096 comm="syz.1.2802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1115.439797][T17135] CUSE: info not properly terminated [ 1115.628863][ T5818] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1115.714322][ T5818] Bluetooth: hci0: command 0x0c1a tx timeout [ 1117.029070][T17146] nbd: must specify an index to disconnect [ 1118.114022][T17164] lo speed is unknown, defaulting to 1000 [ 1118.923239][T17174] FAULT_INJECTION: forcing a failure. [ 1118.923239][T17174] name failslab, interval 1, probability 0, space 0, times 0 [ 1119.241841][T17174] CPU: 1 UID: 0 PID: 17174 Comm: syz.4.2820 Tainted: G L syzkaller #0 PREEMPT(full) [ 1119.241872][T17174] Tainted: [L]=SOFTLOCKUP [ 1119.241878][T17174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1119.241887][T17174] Call Trace: [ 1119.241894][T17174] [ 1119.241902][T17174] dump_stack_lvl+0x100/0x190 [ 1119.241934][T17174] should_fail_ex.cold+0x5/0xa [ 1119.241957][T17174] ? tomoyo_encode2+0xfb/0x3c0 [ 1119.241978][T17174] should_failslab+0xc2/0x120 [ 1119.241995][T17174] __kmalloc_noprof+0xe0/0x850 [ 1119.242016][T17174] ? d_absolute_path+0x136/0x1b0 [ 1119.242045][T17174] tomoyo_encode2+0xfb/0x3c0 [ 1119.242074][T17174] tomoyo_encode+0x29/0x50 [ 1119.242097][T17174] tomoyo_realpath_from_path+0x18c/0x690 [ 1119.242128][T17174] tomoyo_path_number_perm+0x23c/0x580 [ 1119.242148][T17174] ? tomoyo_path_number_perm+0x22e/0x580 [ 1119.242172][T17174] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1119.242217][T17174] ? find_held_lock+0x2b/0x80 [ 1119.242237][T17174] ? __fget_files+0x215/0x3d0 [ 1119.242253][T17174] ? hook_file_ioctl_common+0x146/0x410 [ 1119.242281][T17174] ? __fget_files+0x21f/0x3d0 [ 1119.242304][T17174] security_file_ioctl+0xd3/0x230 [ 1119.242330][T17174] __x64_sys_ioctl+0xb7/0x210 [ 1119.242359][T17174] do_syscall_64+0x106/0xf80 [ 1119.242382][T17174] ? clear_bhb_loop+0x40/0x90 [ 1119.242406][T17174] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1119.242425][T17174] RIP: 0033:0x7f585419c799 [ 1119.242440][T17174] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1119.242456][T17174] RSP: 002b:00007f5854fcf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1119.242474][T17174] RAX: ffffffffffffffda RBX: 00007f5854415fa0 RCX: 00007f585419c799 [ 1119.242485][T17174] RDX: 0000200000000d40 RSI: 00000000c0386105 RDI: 0000000000000003 [ 1119.242496][T17174] RBP: 00007f5854fcf090 R08: 0000000000000000 R09: 0000000000000000 [ 1119.242506][T17174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1119.242516][T17174] R13: 00007f5854416038 R14: 00007f5854415fa0 R15: 00007ffdf3731378 [ 1119.242541][T17174] [ 1119.244799][T17174] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1120.672823][T17185] nfs: Unknown parameter 'ac˙˙˙˙' [ 1121.921175][T17191] nfs: Unknown parameter 'ac˙˙˙˙' [ 1122.028665][ T29] kauditd_printk_skb: 23 callbacks suppressed [ 1122.077062][ T29] audit: type=1400 audit(2000000856.697:3264): avc: denied { ioctl } for pid=17181 comm="syz.1.2821" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1122.290122][ T29] audit: type=1400 audit(2000000856.706:3265): avc: denied { write } for pid=17181 comm="syz.1.2821" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1122.414888][ T29] audit: type=1400 audit(2000000857.024:3266): avc: denied { ioctl } for pid=17198 comm="syz.0.2828" path="socket:[51898]" dev="sockfs" ino=51898 ioctlcmd=0x42d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1122.781538][T17203] overlayfs: failed to resolve './file0': -2 [ 1125.235198][ T29] audit: type=1400 audit(2000000859.710:3267): avc: denied { create } for pid=17222 comm="syz.0.2835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1125.361219][ T29] audit: type=1400 audit(2000000859.738:3268): avc: denied { setopt } for pid=17222 comm="syz.0.2835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1125.397167][ T29] audit: type=1400 audit(2000000859.738:3269): avc: denied { write } for pid=17222 comm="syz.0.2835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1125.712180][ T29] audit: type=1400 audit(2000000860.140:3270): avc: denied { mount } for pid=17214 comm="syz.2.2834" name="/" dev="hugetlbfs" ino=52395 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 1126.165069][T17237] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.2830'. [ 1127.532413][T17248] overlayfs: cannot append lower layer [ 1128.355112][ T29] audit: type=1400 audit(2000000862.181:3271): avc: denied { read write } for pid=17249 comm="syz.3.2843" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1128.480110][ T29] audit: type=1400 audit(2000000862.181:3272): avc: denied { open } for pid=17249 comm="syz.3.2843" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1128.608024][T17258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.663052][ T29] audit: type=1400 audit(2000000862.181:3273): avc: denied { ioctl } for pid=17249 comm="syz.3.2843" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1128.692522][T17258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1128.808784][ T29] audit: type=1400 audit(2000000862.667:3274): avc: denied { create } for pid=17255 comm="syz.1.2844" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1128.860483][T17265] FAULT_INJECTION: forcing a failure. [ 1128.860483][T17265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1128.913772][ T29] audit: type=1400 audit(2000000862.667:3275): avc: denied { ioctl } for pid=17255 comm="syz.1.2844" path="socket:[52055]" dev="sockfs" ino=52055 ioctlcmd=0xf50e scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1129.235251][T17269] nfs: Unknown parameter 'ac˙˙˙˙' [ 1129.916226][ T29] audit: type=1400 audit(2000000862.826:3276): avc: denied { ioctl } for pid=17255 comm="syz.1.2844" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1129.941208][T17265] CPU: 1 UID: 0 PID: 17265 Comm: syz.1.2846 Tainted: G L syzkaller #0 PREEMPT(full) [ 1129.941238][T17265] Tainted: [L]=SOFTLOCKUP [ 1129.941245][T17265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1129.941254][T17265] Call Trace: [ 1129.941260][T17265] [ 1129.941267][T17265] dump_stack_lvl+0x100/0x190 [ 1129.941299][T17265] should_fail_ex.cold+0x5/0xa [ 1129.941321][T17265] _copy_from_iter+0x43a/0x1690 [ 1129.941345][T17265] ? __pfx__copy_from_iter+0x10/0x10 [ 1129.941361][T17265] ? avc_has_perm+0x135/0x1e0 [ 1129.941379][T17265] ? __pfx_avc_has_perm+0x10/0x10 [ 1129.941403][T17265] bcm_sendmsg+0x18f/0x4500 [ 1129.941429][T17265] ? sock_has_perm+0x258/0x2f0 [ 1129.941449][T17265] ? __pfx_sock_has_perm+0x10/0x10 [ 1129.941469][T17265] ? __pfx_bcm_sendmsg+0x10/0x10 [ 1129.941504][T17265] ____sys_sendmsg+0x9e1/0xb70 [ 1129.941528][T17265] ? __pfx_bcm_sendmsg+0x10/0x10 [ 1129.941551][T17265] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1129.941584][T17265] ___sys_sendmsg+0x190/0x1e0 [ 1129.941601][T17265] ? __pfx____sys_sendmsg+0x10/0x10 [ 1129.941642][T17265] __sys_sendmsg+0x170/0x220 [ 1129.941662][T17265] ? __pfx___sys_sendmsg+0x10/0x10 [ 1129.941694][T17265] do_syscall_64+0x106/0xf80 [ 1129.941715][T17265] ? clear_bhb_loop+0x40/0x90 [ 1129.941735][T17265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1129.941751][T17265] RIP: 0033:0x7f13efb9c799 [ 1129.941767][T17265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1129.941781][T17265] RSP: 002b:00007f13f0ae3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1129.941798][T17265] RAX: ffffffffffffffda RBX: 00007f13efe15fa0 RCX: 00007f13efb9c799 [ 1129.941808][T17265] RDX: 0000000000000000 RSI: 0000200000001940 RDI: 0000000000000004 [ 1129.941817][T17265] RBP: 00007f13f0ae3090 R08: 0000000000000000 R09: 0000000000000000 [ 1129.941827][T17265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1129.941836][T17265] R13: 00007f13efe16038 R14: 00007f13efe15fa0 R15: 00007ffc2653cf38 [ 1129.941857][T17265] [ 1130.287917][ T29] audit: type=1400 audit(2000000862.826:3277): avc: denied { read write } for pid=17255 comm="syz.1.2844" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1130.322304][ T29] audit: type=1400 audit(2000000862.826:3278): avc: denied { open } for pid=17255 comm="syz.1.2844" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1130.389245][T17275] lo speed is unknown, defaulting to 1000 [ 1130.395327][T17275] lo speed is unknown, defaulting to 1000 [ 1130.408279][T17275] lo speed is unknown, defaulting to 1000 [ 1130.474250][T17275] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1130.708966][T17275] lo speed is unknown, defaulting to 1000 [ 1130.715421][T17275] lo speed is unknown, defaulting to 1000 [ 1130.722019][T17275] lo speed is unknown, defaulting to 1000 [ 1130.728822][T17275] lo speed is unknown, defaulting to 1000 [ 1130.735283][T17275] lo speed is unknown, defaulting to 1000 [ 1130.825322][ T29] audit: type=1400 audit(2000000862.854:3279): avc: denied { read write } for pid=5808 comm="syz-executor" name="loop0" dev="devtmpfs" ino=3148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1130.856671][ T29] audit: type=1400 audit(2000000862.854:3280): avc: denied { open } for pid=5808 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=3148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1132.675342][T17301] lo speed is unknown, defaulting to 1000 [ 1132.694502][T17301] lo speed is unknown, defaulting to 1000 [ 1133.712800][ T5818] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 1133.984391][ T29] kauditd_printk_skb: 62 callbacks suppressed [ 1133.984407][ T29] audit: type=1400 audit(2000000867.618:3343): avc: denied { write } for pid=17306 comm="syz.2.2858" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1134.134208][ T29] audit: type=1400 audit(2000000867.618:3344): avc: denied { allowed } for pid=17306 comm="syz.2.2858" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1134.280733][ T29] audit: type=1400 audit(2000000867.627:3345): avc: denied { read write } for pid=17306 comm="syz.2.2858" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1134.323510][ T29] audit: type=1400 audit(2000000867.627:3346): avc: denied { open } for pid=17306 comm="syz.2.2858" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1134.646535][ T29] audit: type=1400 audit(2000000867.627:3347): avc: denied { ioctl } for pid=17306 comm="syz.2.2858" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1134.672013][ T29] audit: type=1400 audit(2000000867.627:3348): avc: denied { execmem } for pid=17306 comm="syz.2.2858" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1134.746103][ T29] audit: type=1400 audit(2000000867.945:3349): avc: denied { sqpoll } for pid=17308 comm="syz.4.2859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1134.835519][ T29] audit: type=1400 audit(2000000867.945:3350): avc: denied { create } for pid=17308 comm="syz.4.2859" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1135.489180][ T29] audit: type=1400 audit(2000000867.945:3351): avc: denied { map } for pid=17308 comm="syz.4.2859" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=52129 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1135.644178][ T29] audit: type=1400 audit(2000000867.945:3352): avc: denied { read write } for pid=17308 comm="syz.4.2859" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=52129 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1137.100393][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 1137.109260][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1138.408676][T17346] overlayfs: empty lowerdir [ 1138.613146][T17364] fuse: Bad value for 'fd' [ 1138.679023][T17368] syzkaller0: entered promiscuous mode [ 1138.714984][T17368] syzkaller0: entered allmulticast mode [ 1138.765150][T17374] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1138.962514][T17377] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1139.522806][ T29] kauditd_printk_skb: 68 callbacks suppressed [ 1139.522841][ T29] audit: type=1400 audit(2000000872.895:3421): avc: denied { unlink } for pid=17372 comm="syz.2.2875" name="#23" dev="tmpfs" ino=3107 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1139.704555][ T29] audit: type=1400 audit(2000000872.905:3422): avc: denied { mount } for pid=17372 comm="syz.2.2875" name="/" dev="overlay" ino=3101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1139.977051][ T29] audit: type=1800 audit(2000000872.924:3423): pid=17385 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.2875" name="file0" dev="overlay" ino=3109 res=0 errno=0 [ 1140.196842][ T29] audit: type=1400 audit(2000000873.691:3424): avc: denied { unmount } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1140.299317][ T29] audit: type=1400 audit(2000000873.803:3425): avc: denied { setopt } for pid=17387 comm="syz.2.2879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1140.325622][T17389] block nbd2: NBD_DISCONNECT [ 1140.367088][ T29] audit: type=1400 audit(2000000873.803:3426): avc: denied { bind } for pid=17387 comm="syz.2.2879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1140.408210][ T29] audit: type=1400 audit(2000000873.803:3427): avc: denied { name_bind } for pid=17387 comm="syz.2.2879" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1140.494966][ T29] audit: type=1400 audit(2000000873.803:3428): avc: denied { node_bind } for pid=17387 comm="syz.2.2879" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1140.537937][T13630] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 1140.598241][ T29] audit: type=1400 audit(2000000873.831:3429): avc: denied { ioctl } for pid=17387 comm="syz.2.2879" path="ipc:[4026532822]" dev="nsfs" ino=4026532822 ioctlcmd=0xb702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1140.721078][T13630] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1140.796429][T13630] usb 1-1: config 0 has no interface number 0 [ 1140.840400][T13630] usb 1-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 1140.865902][ T29] audit: type=1400 audit(2000000874.121:3430): avc: denied { map_read map_write } for pid=17393 comm="syz.2.2881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1140.891050][T13630] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 14385, setting to 64 [ 1140.907940][T13630] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1140.919325][T13630] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1140.933312][T13630] usb 1-1: Product: syz [ 1140.937557][T13630] usb 1-1: SerialNumber: syz [ 1141.272664][T13630] usb 1-1: config 0 descriptor?? [ 1141.296070][T13630] cm109 1-1:0.8: invalid payload size 64, expected 4 [ 1141.421200][T13630] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input62 [ 1141.466119][T13630] ------------[ cut here ]------------ [ 1141.467063][T13630] URB ffff888037b4cb00 submitted while active [ 1141.467079][T13630] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x15fa/0x1910, CPU#1: kworker/1:3/13630 [ 1141.467116][T13630] Modules linked in: [ 1141.467179][T13630] CPU: 1 UID: 0 PID: 13630 Comm: kworker/1:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 1141.467230][T13630] Tainted: [L]=SOFTLOCKUP [ 1141.467237][T13630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1141.467252][T13630] Workqueue: usb_hub_wq hub_event [ 1141.467280][T13630] RIP: 0010:usb_submit_urb+0x15fd/0x1910 [ 1141.467301][T13630] Code: 00 48 8b 04 24 48 8b 90 b0 00 00 00 e9 73 ff ff ff bb ed ff ff ff e9 be f2 ff ff e8 ad bb b7 fa 48 8d 3d 66 46 95 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 a0 f2 ff ff c7 44 24 30 00 00 00 [ 1141.467318][T13630] RSP: 0018:ffffc900067aee50 EFLAGS: 00010287 [ 1141.467335][T13630] RAX: 0000000000059356 RBX: ffff888037b4cb00 RCX: ffffc9001b3a9000 [ 1141.467349][T13630] RDX: 0000000000100000 RSI: ffff888037b4cb00 RDI: ffffffff90e65ac0 [ 1141.467363][T13630] RBP: ffff888033f599c0 R08: 0000000000000000 R09: fffffbfff21b3402 [ 1141.467375][T13630] R10: ffffc900067aeed8 R11: 000000000000760b R12: ffff88805b3a10a0 [ 1141.467389][T13630] R13: ffff88805b3a1010 R14: ffff88805b3a109f R15: ffff88805b3a1050 [ 1141.467402][T13630] FS: 0000000000000000(0000) GS:ffff888124442000(0000) knlGS:0000000000000000 [ 1141.467422][T13630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1141.467436][T13630] CR2: 0000200000025000 CR3: 0000000039f27000 CR4: 00000000003526f0 [ 1141.467449][T13630] Call Trace: [ 1141.467456][T13630] [ 1141.467467][T13630] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1141.467492][T13630] ? __pm_runtime_resume+0xc3/0x170 [ 1141.467600][T13630] cm109_input_open+0x27a/0x450 [ 1141.467630][T13630] ? __pfx_cm109_input_open+0x10/0x10 [ 1141.467656][T13630] input_open_device+0x24c/0x3d0 [ 1141.467680][T13630] kbd_connect+0x124/0x180 [ 1141.467703][T13630] input_attach_handler.isra.0+0x177/0x1e0 [ 1141.467724][T13630] input_register_device.cold+0x139/0x375 [ 1141.467743][T13630] cm109_usb_probe+0x128d/0x17f0 [ 1141.467764][T13630] usb_probe_interface+0x303/0x8f0 [ 1141.467790][T13630] ? __pfx_usb_probe_interface+0x10/0x10 [ 1141.467818][T13630] really_probe+0x241/0xa60 [ 1141.467839][T13630] __driver_probe_device+0x1de/0x400 [ 1141.467858][T13630] driver_probe_device+0x4c/0x1b0 [ 1141.467876][T13630] __device_attach_driver+0x1df/0x340 [ 1141.467895][T13630] ? __pfx___device_attach_driver+0x10/0x10 [ 1141.467912][T13630] bus_for_each_drv+0x159/0x1e0 [ 1141.467932][T13630] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1141.467956][T13630] ? lockdep_hardirqs_on+0x78/0x100 [ 1141.467980][T13630] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1141.468006][T13630] __device_attach+0x1e4/0x4d0 [ 1141.468030][T13630] ? __pfx___device_attach+0x10/0x10 [ 1141.468048][T13630] ? do_raw_spin_unlock+0x145/0x1e0 [ 1141.468065][T13630] device_initial_probe+0xaf/0xd0 [ 1141.468087][T13630] bus_probe_device+0x64/0x160 [ 1141.468115][T13630] device_add+0x11d9/0x1950 [ 1141.468137][T13630] ? __pfx_device_add+0x10/0x10 [ 1141.468164][T13630] usb_set_configuration+0xd97/0x1c60 [ 1141.468189][T13630] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 1141.468203][T13630] usb_generic_driver_probe+0xa1/0xe0 [ 1141.468219][T13630] usb_probe_device+0xef/0x400 [ 1141.468242][T13630] ? __pfx_usb_probe_device+0x10/0x10 [ 1141.468270][T13630] really_probe+0x241/0xa60 [ 1141.468299][T13630] __driver_probe_device+0x1de/0x400 [ 1141.468317][T13630] ? usb_driver_applicable+0x1c7/0x220 [ 1141.468335][T13630] driver_probe_device+0x4c/0x1b0 [ 1141.468353][T13630] __device_attach_driver+0x1df/0x340 [ 1141.468374][T13630] ? __pfx___device_attach_driver+0x10/0x10 [ 1141.468400][T13630] bus_for_each_drv+0x159/0x1e0 [ 1141.468423][T13630] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1141.468449][T13630] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1141.468467][T13630] __device_attach+0x1e4/0x4d0 [ 1141.468485][T13630] ? __pfx___device_attach+0x10/0x10 [ 1141.468502][T13630] ? do_raw_spin_unlock+0x145/0x1e0 [ 1141.468524][T13630] device_initial_probe+0xaf/0xd0 [ 1141.468556][T13630] bus_probe_device+0x64/0x160 [ 1141.468578][T13630] ? kobject_uevent_env+0x2e7/0x18b0 [ 1141.468597][T13630] device_add+0x11d9/0x1950 [ 1141.468611][T13630] ? __pfx_device_add+0x10/0x10 [ 1141.468623][T13630] ? add_device_randomness+0xb7/0xf0 [ 1141.468645][T13630] usb_new_device.cold+0x685/0x115c [ 1141.468669][T13630] ? do_raw_spin_lock+0x128/0x260 [ 1141.468690][T13630] ? __pfx_usb_new_device+0x10/0x10 [ 1141.468715][T13630] ? mark_held_locks+0x40/0x70 [ 1141.468743][T13630] hub_event+0x314d/0x4af0 [ 1141.468772][T13630] ? __pfx_hub_event+0x10/0x10 [ 1141.468787][T13630] ? debug_object_deactivate+0x2e4/0x3b0 [ 1141.468819][T13630] ? rcu_is_watching+0x12/0xc0 [ 1141.468846][T13630] process_one_work+0xa23/0x19a0 [ 1141.468878][T13630] ? __pfx_process_one_work+0x10/0x10 [ 1141.468897][T13630] ? __pfx_hub_event+0x10/0x10 [ 1141.468915][T13630] worker_thread+0x5ef/0xe50 [ 1141.468934][T13630] ? __pfx_worker_thread+0x10/0x10 [ 1141.468952][T13630] ? kthread+0x13a/0x450 [ 1141.468971][T13630] ? __pfx_worker_thread+0x10/0x10 [ 1141.468990][T13630] kthread+0x370/0x450 [ 1141.469006][T13630] ? __pfx_kthread+0x10/0x10 [ 1141.469025][T13630] ret_from_fork+0x754/0xd80 [ 1141.469040][T13630] ? __pfx_ret_from_fork+0x10/0x10 [ 1141.469053][T13630] ? rcu_is_watching+0x12/0xc0 [ 1141.469067][T13630] ? __switch_to+0x7b4/0x1120 [ 1141.469098][T13630] ? __pfx_kthread+0x10/0x10 [ 1141.469118][T13630] ret_from_fork_asm+0x1a/0x30 [ 1141.469160][T13630] [ 1141.469170][T13630] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1141.469181][T13630] CPU: 1 UID: 0 PID: 13630 Comm: kworker/1:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 1141.469199][T13630] Tainted: [L]=SOFTLOCKUP [ 1141.469204][T13630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1141.469212][T13630] Workqueue: usb_hub_wq hub_event [ 1141.469229][T13630] Call Trace: [ 1141.469234][T13630] [ 1141.469241][T13630] dump_stack_lvl+0x100/0x190 [ 1141.469272][T13630] vpanic+0x552/0x970 [ 1141.469290][T13630] ? __pfx_vpanic+0x10/0x10 [ 1141.469315][T13630] panic+0xd1/0xe0 [ 1141.469326][T13630] ? __pfx_panic+0x10/0x10 [ 1141.469344][T13630] check_panic_on_warn.cold+0x19/0x34 [ 1141.469357][T13630] ? usb_submit_urb+0x15fa/0x1910 [ 1141.469369][T13630] __warn.cold+0x191/0x348 [ 1141.469387][T13630] __report_bug+0x296/0x3d0 [ 1141.469409][T13630] ? usb_submit_urb+0x15fa/0x1910 [ 1141.469430][T13630] ? __pfx___report_bug+0x10/0x10 [ 1141.469457][T13630] ? preempt_schedule_common+0x42/0xc0 [ 1141.469475][T13630] ? preempt_schedule_thunk+0x16/0x30 [ 1141.469494][T13630] report_bug_entry+0xe1/0x290 [ 1141.469508][T13630] ? usb_submit_urb+0x15fd/0x1910 [ 1141.469521][T13630] handle_bug+0x1cd/0x2a0 [ 1141.469545][T13630] exc_invalid_op+0x17/0x50 [ 1141.469572][T13630] asm_exc_invalid_op+0x1a/0x20 [ 1141.469589][T13630] RIP: 0010:usb_submit_urb+0x15fd/0x1910 [ 1141.469608][T13630] Code: 00 48 8b 04 24 48 8b 90 b0 00 00 00 e9 73 ff ff ff bb ed ff ff ff e9 be f2 ff ff e8 ad bb b7 fa 48 8d 3d 66 46 95 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 a0 f2 ff ff c7 44 24 30 00 00 00 [ 1141.469619][T13630] RSP: 0018:ffffc900067aee50 EFLAGS: 00010287 [ 1141.469629][T13630] RAX: 0000000000059356 RBX: ffff888037b4cb00 RCX: ffffc9001b3a9000 [ 1141.469637][T13630] RDX: 0000000000100000 RSI: ffff888037b4cb00 RDI: ffffffff90e65ac0 [ 1141.469645][T13630] RBP: ffff888033f599c0 R08: 0000000000000000 R09: fffffbfff21b3402 [ 1141.469652][T13630] R10: ffffc900067aeed8 R11: 000000000000760b R12: ffff88805b3a10a0 [ 1141.469660][T13630] R13: ffff88805b3a1010 R14: ffff88805b3a109f R15: ffff88805b3a1050 [ 1141.469680][T13630] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1141.469704][T13630] ? __pm_runtime_resume+0xc3/0x170 [ 1141.469735][T13630] cm109_input_open+0x27a/0x450 [ 1141.469758][T13630] ? __pfx_cm109_input_open+0x10/0x10 [ 1141.469773][T13630] input_open_device+0x24c/0x3d0 [ 1141.469787][T13630] kbd_connect+0x124/0x180 [ 1141.469802][T13630] input_attach_handler.isra.0+0x177/0x1e0 [ 1141.469823][T13630] input_register_device.cold+0x139/0x375 [ 1141.469851][T13630] cm109_usb_probe+0x128d/0x17f0 [ 1141.469884][T13630] usb_probe_interface+0x303/0x8f0 [ 1141.469908][T13630] ? __pfx_usb_probe_interface+0x10/0x10 [ 1141.469925][T13630] really_probe+0x241/0xa60 [ 1141.469943][T13630] __driver_probe_device+0x1de/0x400 [ 1141.469963][T13630] driver_probe_device+0x4c/0x1b0 [ 1141.469991][T13630] __device_attach_driver+0x1df/0x340 [ 1141.470019][T13630] ? __pfx___device_attach_driver+0x10/0x10 [ 1141.470042][T13630] bus_for_each_drv+0x159/0x1e0 [ 1141.470058][T13630] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1141.470072][T13630] ? lockdep_hardirqs_on+0x78/0x100 [ 1141.470087][T13630] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1141.470103][T13630] __device_attach+0x1e4/0x4d0 [ 1141.470129][T13630] ? __pfx___device_attach+0x10/0x10 [ 1141.470162][T13630] ? do_raw_spin_unlock+0x145/0x1e0 [ 1141.470187][T13630] device_initial_probe+0xaf/0xd0 [ 1141.470206][T13630] bus_probe_device+0x64/0x160 [ 1141.470224][T13630] device_add+0x11d9/0x1950 [ 1141.470239][T13630] ? __pfx_device_add+0x10/0x10 [ 1141.470263][T13630] usb_set_configuration+0xd97/0x1c60 [ 1141.470303][T13630] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 1141.470323][T13630] usb_generic_driver_probe+0xa1/0xe0 [ 1141.470339][T13630] usb_probe_device+0xef/0x400 [ 1141.470354][T13630] ? __pfx_usb_probe_device+0x10/0x10 [ 1141.470370][T13630] really_probe+0x241/0xa60 [ 1141.470387][T13630] __driver_probe_device+0x1de/0x400 [ 1141.470411][T13630] ? usb_driver_applicable+0x1c7/0x220 [ 1141.470439][T13630] driver_probe_device+0x4c/0x1b0 [ 1141.470465][T13630] __device_attach_driver+0x1df/0x340 [ 1141.470486][T13630] ? __pfx___device_attach_driver+0x10/0x10 [ 1141.470503][T13630] bus_for_each_drv+0x159/0x1e0 [ 1141.470517][T13630] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1141.470533][T13630] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1141.470557][T13630] __device_attach+0x1e4/0x4d0 [ 1141.470584][T13630] ? __pfx___device_attach+0x10/0x10 [ 1141.470610][T13630] ? do_raw_spin_unlock+0x145/0x1e0 [ 1141.470628][T13630] device_initial_probe+0xaf/0xd0 [ 1141.470646][T13630] bus_probe_device+0x64/0x160 [ 1141.470660][T13630] ? kobject_uevent_env+0x2e7/0x18b0 [ 1141.470674][T13630] device_add+0x11d9/0x1950 [ 1141.470691][T13630] ? __pfx_device_add+0x10/0x10 [ 1141.470710][T13630] ? add_device_randomness+0xb7/0xf0 [ 1141.470744][T13630] usb_new_device.cold+0x685/0x115c [ 1141.470767][T13630] ? do_raw_spin_lock+0x128/0x260 [ 1141.470780][T13630] ? __pfx_usb_new_device+0x10/0x10 [ 1141.470796][T13630] ? mark_held_locks+0x40/0x70 [ 1141.470816][T13630] hub_event+0x314d/0x4af0 [ 1141.470858][T13630] ? __pfx_hub_event+0x10/0x10 [ 1141.470881][T13630] ? debug_object_deactivate+0x2e4/0x3b0 [ 1141.470912][T13630] ? rcu_is_watching+0x12/0xc0 [ 1141.470929][T13630] process_one_work+0xa23/0x19a0 [ 1141.470948][T13630] ? __pfx_process_one_work+0x10/0x10 [ 1141.470964][T13630] ? __pfx_hub_event+0x10/0x10 [ 1141.470987][T13630] worker_thread+0x5ef/0xe50 [ 1141.471013][T13630] ? __pfx_worker_thread+0x10/0x10 [ 1141.471033][T13630] ? kthread+0x13a/0x450 [ 1141.471048][T13630] ? __pfx_worker_thread+0x10/0x10 [ 1141.471061][T13630] kthread+0x370/0x450 [ 1141.471071][T13630] ? __pfx_kthread+0x10/0x10 [ 1141.471083][T13630] ret_from_fork+0x754/0xd80 [ 1141.471096][T13630] ? __pfx_ret_from_fork+0x10/0x10 [ 1141.471108][T13630] ? rcu_is_watching+0x12/0xc0 [ 1141.471125][T13630] ? __switch_to+0x7b4/0x1120 [ 1141.471154][T13630] ? __pfx_kthread+0x10/0x10 [ 1141.471172][T13630] ret_from_fork_asm+0x1a/0x30 [ 1141.471202][T13630] [ 1141.471505][T13630] Kernel Offset: disabled