last executing test programs: 3m29.561425476s ago: executing program 4 (id=926): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004802c"], 0x84}}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001900599c6d0eab070004000523"], 0xfe33) 3m29.425407196s ago: executing program 4 (id=928): mount(0x0, &(0x7f0000000000)='./cgroup\x00', 0x0, 0x208000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x8, 0xc1}) ioctl$VIDIOC_G_FREQUENCY(0xffffffffffffffff, 0xc02c5638, &(0x7f0000000140)={0x7, 0x5, 0xfc000000}) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) 3m29.271607785s ago: executing program 4 (id=929): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x6c, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x58, 0x1, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xffffffff, 0x10001, 0x20000000, 0x3c, 0x3}, 0x400000000a}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd0af4adf700102c00fe800000000000000000000000000000ff0200000000000000000000000000013c"], 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x24000050) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 3m29.021876269s ago: executing program 4 (id=934): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 3m28.896933907s ago: executing program 4 (id=936): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa140019800800010004000000080002"], 0x44}}, 0x0) 3m28.62939986s ago: executing program 4 (id=940): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10600002}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x2, 0x8, 0x8e2eb0c0066007c1, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf1bd6c502e349a27}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x40000, 0x100a8}}}}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x7}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x58}}, 0x40080) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c00000004060102000001000000000001000c090500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) ppoll(&(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) 3m28.501936065s ago: executing program 32 (id=940): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10600002}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x2, 0x8, 0x8e2eb0c0066007c1, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf1bd6c502e349a27}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x40000, 0x100a8}}}}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x7}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x58}}, 0x40080) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c00000004060102000001000000000001000c090500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) ppoll(&(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) 5.083928016s ago: executing program 2 (id=3567): r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 5.005335455s ago: executing program 2 (id=3569): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg$unix(r0, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/240, 0xf0}], 0x1}}], 0x1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002d40)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002f00)=""/130, 0x82}], 0x1}, 0xfffffffd}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000006c0)=""/118, 0x76}], 0x1}, 0xd335}], 0x2, 0x2120, 0x0) 4.028222131s ago: executing program 2 (id=3570): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000001380)}, {&(0x7f0000000300)="5091bfb0dea79e9c5e67a708ad439c2b839cb4eda890f8ced911e0a5251d133a246dab73a601be0a30d6b94e2bf39723297a03e9c7af4bb3918c7c3e4d4a92507e9ae87cb8911045e87e508d8696036b3e6a41c75a9659784dbd4e3a46b22454659db0e033e92f508efbe7a54538d4543fc984c78213c53bdeccd7b9822944f65c762c5051b708dc723888b77578bf776ba1bf13d01066181d02f793d4f7f979d3153acc8303c5f286ca2e57c510f04775c463f0aadff909a04249b1f725", 0xbe}, {&(0x7f00000007c0)="16e22a58bb9eec248fdaff277a23517edcabd6bdcc70a414044e857fa2881175e63546afb3e0addfcdca5e7edfd53742d37b28c6c45ac286fe018603f91e3e575798f18be91959f9e0e4cdb6d21e5e57de9ac11d254c5bd616f754b5b2c9ea7bd54ba016f7656f845901ba695ce0bd8babbb77e1353413530bd9b597669db9afa5762e1a566ae57626311458c2b59d0e3b84e5bc897fefc9c381601aacf90733ae1e632317874b19", 0xa8}], 0x3}}], 0x1, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) 3.871576386s ago: executing program 2 (id=3571): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f00000000c0)={0x7, 0x4, 0x11, 0xfffffffe, 0x0, "0da2c380dc02fd0d2ef747bbe47963e09145ce", 0x2, 0x6}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x20, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f00000000c0)=ANY=[]) 3.174038567s ago: executing program 2 (id=3579): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f0000000a80)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001c00)={0x34, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000980)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2.925398949s ago: executing program 5 (id=3582): r0 = memfd_create(&(0x7f0000000580)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc5\x1d\xe7jDf\x87@\x8fg\x15RJw\x82\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7g\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05', 0x0) ftruncate(r0, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x2, 0x12, r0, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00003fe000/0x4000)=nil, 0x4000}, 0x1}) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 2.922911645s ago: executing program 5 (id=3583): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) r1 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x34f}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) 2.641148976s ago: executing program 5 (id=3585): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c0001800800010003000100200001"], 0x44}}, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg$inet(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300010004000500eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2.536774325s ago: executing program 5 (id=3586): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x229, &(0x7f0000000380)={0x0, 0xbd2e, 0x10100, 0x0, 0xd1, 0x0, r1}, &(0x7f0000000080)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, {0x8230}, 0x3}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000180)={[0x8]}, 0x8) 1.621475105s ago: executing program 1 (id=3592): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffa7, 0x10008}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @broadcast}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}}, 0x0) 1.569335219s ago: executing program 5 (id=3593): r0 = epoll_create1(0x80000) r1 = socket$inet_sctp(0x2, 0x1, 0x84) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)={0x48000008}) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000000)={0x20000000}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)={0xa0000013}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f00000000c0)={0x40000002}) 1.449785174s ago: executing program 5 (id=3595): futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x2, 0x3, 0x801, 0x0, &(0x7f0000000040), 0xfffffffc) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x3) syz_io_uring_submit(0x0, 0x0, 0x0) 1.274057166s ago: executing program 3 (id=3597): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 1.23415987s ago: executing program 1 (id=3598): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f000067d000/0x2000)=nil, &(0x7f000053d000/0x1000)=nil, 0x2000}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 1.157504696s ago: executing program 3 (id=3599): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'rose0\x00', 0x112}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r3], 0x20}}, 0x0) 1.135108046s ago: executing program 1 (id=3600): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000014c0)=ANY=[@ANYBLOB="00000100000011"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 1.050539716s ago: executing program 3 (id=3601): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000280)='virtio_transport_alloc_pkt\x00', r0}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000940), 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) 974.74615ms ago: executing program 0 (id=3602): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000034000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x0, 0xe, 0x0, &(0x7f00000001c0)="348b0d151f8218e3c73697e40800", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r1}, 0x10) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000fe27008500000008000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b705000008000000850000007300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0xfe, &(0x7f0000000740)="000000000000c000ee6e3e20630c", 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 967.326821ms ago: executing program 3 (id=3603): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x80000001}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000000c0)="af3e64f08189ef001601ba6100ec0f2264ba4100b80600ef660f38351d0f212666b94006000066b80000010066ba000000000f300f211a2e0f013c", 0x3b}], 0x1, 0xe, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 704.404558ms ago: executing program 0 (id=3604): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = eventfd2(0x8, 0x80800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0xffff, 0x2, r3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 561.69053ms ago: executing program 1 (id=3605): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}, 0x1, 0x1}}, 0x2e) sendto(r2, 0x0, 0x0, 0x4008044, 0x0, 0x0) 519.75197ms ago: executing program 1 (id=3606): munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) 517.271713ms ago: executing program 3 (id=3607): openat(0xffffffffffffff9c, 0x0, 0x40042, 0x102) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x6}]}}}]}]}], {0x14}}, 0xb8}}, 0x4000040) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000000efffee94000040"]) 429.479691ms ago: executing program 0 (id=3608): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}}, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xd, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x1}]}}]}, 0x38}}, 0x0) 371.979825ms ago: executing program 1 (id=3609): unshare(0x6a040000) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, 0x0, 0x200000c4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/snmp\x00') r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) bind$inet(0xffffffffffffffff, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 355.556472ms ago: executing program 0 (id=3610): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x7) recvfrom$inet6(r0, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 253.407496ms ago: executing program 2 (id=3611): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) r1 = add_key$user(&(0x7f0000000180), 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r1, 0x7fffffffffff) preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000c7ce360863078120abd001e402010902120001000000000904000000ff"], 0x0) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vlan0\x00'}) 240.567489ms ago: executing program 3 (id=3612): openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0xdc) r0 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x80000) r1 = socket(0x2, 0x2, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DO_IT(r2, 0xab03) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x5) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000080)='udf\x00', 0x14, 0x0) 204.532875ms ago: executing program 0 (id=3613): sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e8000000000000000b210000ff3f7c081e0f315b91fcaec7bf495d5c618332756cbb1bb9ce6d12b9d976d1f33aca41e50a3342bcd67c311f7885a05c3fcf2ae21f1498ec481e7ca2c3ca4c7b3bf94448f62e111e5a79929b9182cc977ba6ae766ce37bdaac6da997fbc15f0c79f42155b99a280667b51fdc7902d7be5ef41f953fedb32aceeada13250626957eff13d5b12cc916541ccbeb0d4060a4dd89664eaba2f6b4ede0c9e3dc1c9446d9284ebe0e46eee7bc145ff0a2779c025553298812978ea53a8c60f254f23344a80a0aac7b141787bad6b0ba090000005f2f3158f0d200000000000070000000000000000701000040000000afbb30c2946e41ef3167d1f6ed47aa1f52bad114a89dbed741f74a23cd8d915e2dcc74a4932646b90f90a9d3956d5cadb642ac79fcb0aae3654482188263abd27e9d57cc28032453dc75f333e1f367ab38b7e7719805a454e79802d07ec60c00b0000000000000000100000001"], 0x208}, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x208}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003200)=[{{0x0, 0x0, &(0x7f0000001e00)=[{0x0}, {0x0}, {&(0x7f0000003480)=""/172, 0xac}], 0x3}}], 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/108, 0x6c}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)=""/99, 0x63}}, {{0x0, 0x0, &(0x7f0000001e40)=[{0x0}, {0x0}, {&(0x7f0000000340)=""/181, 0xb5}], 0x3, &(0x7f0000001e80)=""/4096, 0x1000}}], 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007600)=[{{0x0, 0x0, &(0x7f0000003440)=[{0x0}, {0x0}, {&(0x7f0000004540)=""/240, 0xf0}], 0x3}}], 0x1, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001dc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=""/188, 0xbc, 0xdf0e}}], 0x1800, 0x2002, 0x0) socket$unix(0x1, 0x5, 0x0) 0s ago: executing program 0 (id=3614): syz_open_dev$evdev(0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x4c, 0x9, 0x6, 0x401, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x4000080) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000000306050000000000000000000000000005000100dc"], 0x1c}}, 0x20000090) kernel console output (not intermixed with test programs): w USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.953296][ T5924] usb 3-1: Product: syz [ 226.966140][ T5924] usb 3-1: Manufacturer: syz [ 226.970803][ T5924] usb 3-1: SerialNumber: syz [ 226.979990][ T5924] usb 3-1: config 0 descriptor?? [ 227.134939][ T5995] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 227.277789][ T5911] usb 3-1: USB disconnect, device number 29 [ 227.314848][ T5995] usb 4-1: Using ep0 maxpacket: 32 [ 227.327887][ T5995] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 227.359571][ T5995] usb 4-1: config 0 has no interface number 0 [ 227.374101][ T5995] usb 4-1: config 0 interface 85 has no altsetting 0 [ 227.420236][ T5995] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 227.421169][T11039] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 227.486219][ T5995] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.513547][T11039] batman_adv: batadv0: Adding interface: ip6gretap1 [ 227.533681][T11039] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 227.554558][ T5995] usb 4-1: Product: syz [ 227.565007][ T5995] usb 4-1: Manufacturer: syz [ 227.569666][ T5995] usb 4-1: SerialNumber: syz [ 227.596856][T11039] batman_adv: batadv0: Interface activated: ip6gretap1 [ 227.722158][ T5995] usb 4-1: config 0 descriptor?? [ 227.816044][ T5995] appletouch 4-1:0.85: Could not find int-in endpoint [ 227.884695][ T5995] appletouch 4-1:0.85: probe with driver appletouch failed with error -5 [ 227.893889][ T5995] usbhid 4-1:0.85: couldn't find an input interrupt endpoint [ 228.063856][ T24] usb 4-1: USB disconnect, device number 35 [ 228.399497][T11059] comedi: valid board names for 8255 driver are: [ 228.407617][T11059] 8255 [ 228.410452][T11059] comedi: valid board names for vmk80xx driver are: [ 228.417599][T11059] vmk80xx [ 228.421245][T11059] comedi: valid board names for usbduxsigma driver are: [ 228.436159][T11059] usbduxsigma [ 228.439584][T11059] comedi: valid board names for usbduxfast driver are: [ 228.454851][T11059] usbduxfast [ 228.459942][T11059] comedi: valid board names for usbdux driver are: [ 228.466857][T11059] usbdux [ 228.470478][T11059] comedi: valid board names for ni6501 driver are: [ 228.480092][T11059] ni6501 [ 228.484148][T11059] comedi: valid board names for dt9812 driver are: [ 228.494784][T11059] dt9812 [ 228.497772][T11059] comedi: valid board names for ni_labpc_cs driver are: [ 228.504873][T11059] ni_labpc_cs [ 228.520281][T11059] comedi: valid board names for ni_daq_700 driver are: [ 228.527845][T11059] ni_daq_700 [ 228.531386][T11059] comedi: valid board names for labpc_pci driver are: [ 228.588806][T11059] labpc_pci [ 228.592316][T11059] comedi: valid board names for adl_pci9118 driver are: [ 228.599423][T11059] pci9118dg [ 228.628341][T11059] pci9118hg [ 228.633014][T11059] pci9118hr [ 228.638500][T11059] comedi: valid board names for 8255_pci driver are: [ 228.646208][T11059] 8255_pci [ 228.649438][T11059] comedi: valid board names for s526 driver are: [ 228.658224][T11059] s526 [ 228.661142][T11059] comedi: valid board names for multiq3 driver are: [ 228.668069][T11059] multiq3 [ 228.671178][T11059] comedi: valid board names for pcmuio driver are: [ 228.677887][T11059] pcmuio48 [ 228.682660][T11059] pcmuio96 [ 228.685933][T11059] comedi: valid board names for pcmmio driver are: [ 228.693821][T11059] pcmmio [ 228.696963][T11059] comedi: valid board names for pcmda12 driver are: [ 228.703614][T11059] pcmda12 [ 228.706805][T11059] comedi: valid board names for pcmad driver are: [ 228.713425][T11059] pcmad12 [ 228.717579][T11059] pcmad16 [ 228.720668][T11059] comedi: valid board names for ni_labpc driver are: [ 228.731929][T11059] lab-pc-1200 [ 228.737265][T11059] lab-pc-1200ai [ 228.744654][T11059] lab-pc+ [ 228.754252][T11059] comedi: valid board names for atmio16 driver are: [ 228.762569][T11059] atmio16 [ 228.771068][T11059] atmio16d [ 228.774240][T11059] comedi: valid board names for ni_at_ao driver are: [ 228.791338][T11059] at-ao-6 [ 228.827972][T11059] at-ao-10 [ 228.831169][T11059] comedi: valid board names for ni_at_a2150 driver are: [ 228.877426][T11059] ni_at_a2150 [ 228.882925][T11059] comedi: valid board names for adq12b driver are: [ 228.890711][T11059] adq12b [ 228.893845][T11059] comedi: valid board names for mpc624 driver are: [ 228.902613][T11059] mpc624 [ 228.910172][T11059] comedi: valid board names for c6xdigio driver are: [ 228.917092][T11059] c6xdigio [ 228.920274][T11059] comedi: valid board names for aio_iiro_16 driver are: [ 228.927538][T11059] aio_iiro_16 [ 228.931209][T11059] comedi: valid board names for aio_aio12_8 driver are: [ 228.938547][T11059] aio_aio12_8 [ 228.942472][T11059] aio_ai12_8 [ 228.946426][T11059] aio_ao12_4 [ 228.949789][T11059] comedi: valid board names for fl512 driver are: [ 228.956462][T11059] fl512 [ 228.959791][T11059] comedi: valid board names for dmm32at driver are: [ 228.966665][T11059] dmm32at [ 228.970476][T11059] comedi: valid board names for dt282x driver are: [ 228.977075][T11059] dt2821 [ 228.980165][T11059] dt2821-f [ 228.983351][T11059] dt2821-g [ 228.987053][T11059] dt2823 [ 228.990072][T11059] dt2824-pgh [ 228.993420][T11059] dt2824-pgl [ 228.997314][T11059] dt2825 [ 229.000305][T11059] dt2827 [ 229.003302][T11059] dt2828 [ 229.006689][T11059] dt2829 [ 229.009690][T11059] dt21-ez [ 229.068014][T11059] dt23-ez [ 229.072322][T11059] dt24-ez [ 229.075522][T11059] dt24-ez-pgl [ 229.078984][T11059] comedi: valid board names for dt2817 driver are: [ 229.085701][T11059] dt2817 [ 229.089226][T11059] comedi: valid board names for dt2815 driver are: [ 229.096958][T11059] dt2815 [ 229.100260][T11059] comedi: valid board names for dt2814 driver are: [ 229.109617][T11059] dt2814 [ 229.113314][T11059] comedi: valid board names for dt2811 driver are: [ 229.121141][T11059] dt2811-pgh [ 229.124500][T11059] dt2811-pgl [ 229.132727][T11059] comedi: valid board names for dt2801 driver are: [ 229.149643][T11059] dt2801 [ 229.157894][T11059] comedi: valid board names for das6402 driver are: [ 229.165505][T11059] das6402-12 [ 229.174212][T11059] das6402-16 [ 229.178706][T11059] comedi: valid board names for das1800 driver are: [ 229.185372][T11059] das-1701st [ 229.188677][T11059] das-1701st-da [ 229.196385][T11059] das-1702st [ 229.199722][T11059] das-1702st-da [ 229.208345][T11059] das-1702hr [ 229.212529][T11059] das-1702hr-da [ 229.218308][T11059] das-1701ao [ 229.226294][T11059] das-1702ao [ 229.229595][T11059] das-1801st [ 229.232879][T11059] das-1801st-da [ 229.238058][T11059] das-1802st [ 229.245909][T11059] das-1802st-da [ 229.253633][T11059] das-1802hr [ 229.260471][T11059] das-1802hr-da [ 229.264170][T11059] das-1801hc [ 229.268988][T11059] das-1802hc [ 229.272458][T11059] das-1801ao [ 229.283187][T11059] das-1802ao [ 229.288336][T11059] comedi: valid board names for das800 driver are: [ 229.313808][T11059] das-800 [ 229.318879][T11059] cio-das800 [ 229.322244][T11059] das-801 [ 229.325768][T11059] cio-das801 [ 229.338521][T11059] das-802 [ 229.341630][T11059] cio-das802 [ 229.349332][T11059] cio-das802/16 [ 229.354278][T11059] comedi: valid board names for isa-das08 driver are: [ 229.361529][T11059] isa-das08 [ 229.385960][T11059] das08-pgm [ 229.398180][T11059] das08-pgh [ 229.401502][T11059] das08-pgl [ 229.407246][T11059] das08-aoh [ 229.410579][T11059] das08-aol [ 229.417291][T11059] das08-aom [ 229.427300][T11059] das08/jr-ao [ 229.431817][T11059] das08jr-16-ao [ 229.435711][T11059] pc104-das08 [ 229.439159][T11059] das08jr/16 [ 229.442540][T11059] comedi: valid board names for das16m1 driver are: [ 229.449393][T11059] das16m1 [ 229.450594][T11088] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 229.494845][T11059] comedi: valid board names for dac02 driver are: [ 229.502616][T11059] dac02 [ 229.514393][T11059] comedi: valid board names for rti802 driver are: [ 229.521136][T11059] rti802 [ 229.524169][T11059] comedi: valid board names for rti800 driver are: [ 229.545391][T11059] rti800 [ 229.552258][T11059] rti815 [ 229.574083][T11059] comedi: valid board names for pcm3724 driver are: [ 229.583458][T11059] pcm3724 [ 229.590950][T11059] comedi: valid board names for pcl818 driver are: [ 229.611151][T11059] pcl818l [ 229.614280][T11059] pcl818h [ 229.617492][T11059] pcl818hd [ 229.640713][T11059] pcl818hg [ 229.650778][T11059] pcl818 [ 229.653813][T11059] pcl718 [ 229.658939][T11059] pcm3718 [ 229.662641][T11059] comedi: valid board names for pcl816 driver are: [ 229.670294][T11059] pcl816 [ 229.673340][T11059] pcl814b [ 229.684403][T11059] comedi: valid board names for pcl812 driver are: [ 229.693360][T11059] pcl812 [ 229.696938][T11059] pcl812pg [ 229.700121][T11059] acl8112pg [ 229.705226][T11059] acl8112dg [ 229.708478][T11059] acl8112hg [ 229.711780][T11059] a821pgl [ 229.727156][T11059] a821pglnda [ 229.742493][T11059] a821pgh [ 229.746568][T11059] a822pgl [ 229.749683][T11059] a822pgh [ 229.752764][T11059] a823pgl [ 229.757784][T11059] a823pgh [ 229.760846][T11059] pcl813 [ 229.773099][T11059] pcl813b [ 229.776698][T11059] acl8113 [ 229.781413][T11059] iso813 [ 229.800652][T11059] acl8216 [ 229.805993][T11059] a826pg [ 229.811011][T11059] comedi: valid board names for pcl730 driver are: [ 229.820561][T11059] pcl730 [ 229.823684][T11059] iso730 [ 229.828547][T11059] acl7130 [ 229.831650][T11059] pcm3730 [ 229.837764][T11059] pcl725 [ 229.840789][T11059] p8r8dio [ 229.843864][T11059] acl7225b [ 229.853561][T11059] p16r16dio [ 229.860798][T11059] pcl733 [ 229.866168][T11059] pcl734 [ 229.869292][T11059] opmm-1616-xt [ 229.872979][T11059] pearl-mm-p [ 229.879367][T11059] ir104-pbf [ 229.882845][T11059] comedi: valid board names for pcl726 driver are: [ 229.901401][T11059] pcl726 [ 229.905688][T11059] pcl727 [ 229.908723][T11059] pcl728 [ 229.912257][T11059] acl6126 [ 229.916007][T11059] acl6128 [ 229.921718][T11059] comedi: valid board names for pcl724 driver are: [ 229.929124][T11059] pcl724 [ 229.932241][T11059] pcl722 [ 229.935664][T11059] pcl731 [ 229.938751][T11059] acl7122 [ 229.941866][T11059] acl7124 [ 229.948931][T11059] pet48dio [ 229.952190][T11059] pcmio48 [ 229.962432][T11059] onyx-mm-dio [ 229.966115][T11059] comedi: valid board names for pcl711 driver are: [ 229.974021][T11059] pcl711 [ 229.979582][T11059] pcl711b [ 229.982942][T11059] acl8112hg [ 229.986738][T11059] acl8112dg [ 229.990194][T11059] comedi: valid board names for amplc_pc263 driver are: [ 229.997680][T11059] pc263 [ 230.000616][T11059] comedi: valid board names for amplc_pc236 driver are: [ 230.009119][T11059] pc36at [ 230.013090][T11059] comedi: valid board names for amplc_dio200 driver are: [ 230.023280][T11059] pc212e [ 230.026574][T11059] pc214e [ 230.029681][T11059] pc215e [ 230.032686][T11059] pc218e [ 230.036639][T11059] pc272e [ 230.040754][T11059] comedi: valid board names for comedi_parport driver are: [ 230.051733][T11059] comedi_parport [ 230.055540][T11059] comedi: valid board names for comedi_test driver are: [ 230.062828][T11059] comedi_test [ 230.082325][T11059] comedi: valid board names for comedi_bond driver are: [ 230.101228][T11059] comedi_bond [ 230.525666][T11115] 9pnet_fd: Insufficient options for proto=fd [ 230.694920][ T30] audit: type=1400 audit(1754320738.107:520): avc: denied { create } for pid=11116 comm="syz.3.2036" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 231.126030][ T30] audit: type=1400 audit(1754320738.537:521): avc: denied { listen } for pid=11131 comm="syz.5.2041" lport=49703 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 231.288320][ T5924] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 231.480870][ T5924] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 231.489520][ T5924] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 231.513803][ T5924] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 231.529377][ T5924] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 231.544399][ T5924] usb 3-1: Manufacturer: syz [ 231.562827][ T5924] usb 3-1: config 0 descriptor?? [ 231.695238][ T5924] rc_core: IR keymap rc-hauppauge not found [ 231.709394][ T5924] Registered IR keymap rc-empty [ 231.745489][ T5924] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 231.786120][ T5924] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input32 [ 231.840083][ C0] igorplugusb 3-1:0.0: Error: urb status = -32 [ 231.899710][ T24] usb 3-1: USB disconnect, device number 30 [ 231.901213][T11159] 9pnet: p9_errstr2errno: server reported unknown error pAʼn}dϲ#=M{t&ࡺ'<ףdgCQ, [ 232.242857][T11170] netlink: 'syz.3.2056': attribute type 1 has an invalid length. [ 232.402334][T11176] overlayfs: failed to clone upperpath [ 232.543016][T11180] input: syz0 as /devices/virtual/input/input33 [ 232.802878][T11191] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2064'. [ 233.295585][T11194] 9pnet: Could not find request transport: xen [ 233.495795][ T24] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 233.656392][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 233.684588][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.705348][ T24] usb 4-1: config 0 descriptor?? [ 233.733597][ T24] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 233.841045][T11052] Set syz1 is full, maxelem 65536 reached [ 233.849032][T11218] overlayfs: failed to clone upperpath [ 234.188991][ T30] audit: type=1400 audit(1754320741.597:522): avc: denied { connect } for pid=11235 comm="syz.1.2082" lport=59522 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 234.213452][ C1] vkms_vblank_simulate: vblank timer overrun [ 234.234121][ T5890] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 234.239951][ T30] audit: type=1400 audit(1754320741.597:523): avc: denied { name_connect } for pid=11235 comm="syz.1.2082" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 234.318237][ T3563] Bluetooth: hci5: Frame reassembly failed (-84) [ 234.403371][ T30] audit: type=1400 audit(1754320741.807:524): avc: denied { mount } for pid=11243 comm="syz.0.2086" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 234.424964][ T5890] usb 6-1: Using ep0 maxpacket: 8 [ 234.426667][ T5890] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.450056][T11249] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 234.456328][ T5890] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 234.484481][ T5890] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.505811][ T5890] usb 6-1: config 0 descriptor?? [ 234.520969][ T5890] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 234.746577][T11267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2097'. [ 234.758186][T11267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2097'. [ 234.928192][ T24] usb 4-1: USB disconnect, device number 36 [ 235.744188][ T5890] gspca_vc032x: reg_w err -71 [ 235.752088][ T5890] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 235.767298][ T5890] usb 6-1: USB disconnect, device number 12 [ 236.114008][T11306] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 236.184860][ T5995] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 236.314817][ T5846] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 236.334320][T11240] Bluetooth: hci0: Opcode 0x080f failed: -110 [ 236.343763][T11316] overlayfs: failed to clone upperpath [ 236.359771][ T5995] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 236.394914][ T5846] Bluetooth: hci0: command 0x0406 tx timeout [ 236.402658][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.411699][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.423598][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.434288][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.445799][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.456832][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.467505][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.494977][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.507032][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.515595][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.535549][ T30] audit: type=1400 audit(1754320743.937:525): avc: denied { create } for pid=11311 comm="syz.0.2117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 236.564920][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.584762][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.599784][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.629497][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.664655][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.682141][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.712469][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.754708][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.780402][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.802432][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.834167][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.844119][ T5995] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 236.888526][ T5995] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 236.930754][ T5995] usb 4-1: config 0 interface 0 has no altsetting 0 [ 236.978537][ T5995] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 237.001927][ T5995] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 237.033792][ T5995] usb 4-1: Product: syz [ 237.077594][ T5995] usb 4-1: Manufacturer: syz [ 237.115454][ T5995] usb 4-1: SerialNumber: syz [ 237.127047][ T5995] usb 4-1: config 0 descriptor?? [ 237.175175][ T5995] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 237.520809][ T5995] usb 4-1: USB disconnect, device number 37 [ 237.540173][ T5995] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 238.505581][ T5995] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 238.597737][T11379] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11379 comm=syz.3.2144 [ 238.627143][T11379] netlink: 'syz.3.2144': attribute type 1 has an invalid length. [ 238.711315][ T5995] usb 1-1: Using ep0 maxpacket: 16 [ 238.720584][ T5995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.762168][ T5995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.786169][T11386] bond1: (slave bridge0): making interface the new active one [ 238.794303][T11386] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 238.818345][ T5995] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 238.845977][ T5995] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 238.878935][ T5995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.921008][ T5995] usb 1-1: config 0 descriptor?? [ 239.324834][ T1538] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 239.386167][ T30] audit: type=1400 audit(1754320746.797:526): avc: denied { write } for pid=11401 comm="syz.5.2152" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 239.451145][ T30] audit: type=1400 audit(1754320746.797:527): avc: denied { open } for pid=11401 comm="syz.5.2152" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 239.490365][T11359] random: crng reseeded on system resumption [ 239.506159][ T1538] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.532409][ T1538] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 239.544705][ T30] audit: type=1400 audit(1754320746.897:528): avc: denied { read write } for pid=11358 comm="syz.0.2136" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 239.575832][ T1538] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 239.590286][ T5995] input: HID 0955:7214 Haptics as /devices/virtual/input/input34 [ 239.602346][ T1538] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.639589][ T30] audit: type=1400 audit(1754320746.897:529): avc: denied { ioctl open } for pid=11358 comm="syz.0.2136" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 239.692595][ T5995] shield 0003:0955:7214.0029: Registered Thunderstrike controller [ 239.701212][ T1538] usb 4-1: config 0 descriptor?? [ 239.715216][ T5995] shield 0003:0955:7214.0029: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.0-1/input0 [ 239.769906][ T30] audit: type=1326 audit(1754320747.177:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11358 comm="syz.0.2136" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x0 [ 239.959841][ T5897] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 239.962254][ T5890] usb 1-1: USB disconnect, device number 26 [ 239.984736][ T5897] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 240.040910][ T5897] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 240.066261][ T5897] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 240.150672][ T1538] hid-thrustmaster 0003:044F:B65D.002A: unknown main item tag 0x0 [ 240.160022][ T1538] hid-thrustmaster 0003:044F:B65D.002A: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.3-1/input0 [ 240.184491][ T1538] hid-thrustmaster 0003:044F:B65D.002A: Wrong number of endpoints? [ 240.417073][ C0] hid-thrustmaster 0003:044F:B65D.002A: URB to get model id failed with error -71 [ 240.431951][ T1538] usb 4-1: USB disconnect, device number 38 [ 240.470636][T11418] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 240.657505][ T30] audit: type=1400 audit(1754320748.067:531): avc: denied { mounton } for pid=11428 comm="syz.5.2163" path="/218/file0" dev="tmpfs" ino=1173 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 242.120585][T11453] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2172'. [ 242.592042][ T5995] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 242.607400][ T30] audit: type=1400 audit(1754320750.017:532): avc: denied { map } for pid=11465 comm="syz.3.2178" path="/dev/sg0" dev="devtmpfs" ino=765 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 242.757979][ T5995] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 242.767761][ T5995] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.808129][ T5995] usb 3-1: Product: syz [ 242.812328][ T5995] usb 3-1: Manufacturer: syz [ 242.835136][ T5995] usb 3-1: SerialNumber: syz [ 242.857246][ T5995] usb 3-1: config 0 descriptor?? [ 242.914915][ T5995] ch341 3-1:0.0: ch341-uart converter detected [ 242.986089][T11481] loop2: detected capacity change from 0 to 7 [ 243.005014][T11481] Dev loop2: unable to read RDB block 7 [ 243.037324][T11481] loop2: unable to read partition table [ 243.057721][T11481] loop2: partition table beyond EOD, truncated [ 243.073120][T11481] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 243.113566][ T5219] Dev loop2: unable to read RDB block 7 [ 243.128245][ T5219] loop2: unable to read partition table [ 243.144600][ T5219] loop2: partition table beyond EOD, truncated [ 243.768415][T11505] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2195'. [ 243.770897][ T30] audit: type=1400 audit(1754320751.177:533): avc: denied { write } for pid=11504 comm="syz.5.2195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 243.885902][T11510] cgroup: fork rejected by pids controller in /syz3 [ 244.044705][ T5890] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 244.079762][ T5995] usb 3-1: ch341-uart converter now attached to ttyUSB0 [ 244.206285][ T5890] usb 1-1: Using ep0 maxpacket: 32 [ 244.218643][ T5890] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 244.227357][ T5890] usb 1-1: config 0 has no interface number 0 [ 244.271202][ T5890] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 244.283237][ T5995] usb 3-1: USB disconnect, device number 31 [ 244.296160][ T5995] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 244.308611][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.331788][ T5995] ch341 3-1:0.0: device disconnected [ 244.341011][ T5890] usb 1-1: Product: syz [ 244.360214][ T5890] usb 1-1: Manufacturer: syz [ 244.377310][ T5890] usb 1-1: SerialNumber: syz [ 244.402887][ T5890] usb 1-1: config 0 descriptor?? [ 244.414814][ T5890] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 244.648262][ T5890] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 244.702371][ T5890] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 245.348833][ T30] audit: type=1400 audit(1754320752.757:534): avc: denied { read append } for pid=11552 comm="syz.5.2212" name="file0" dev="fuse" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 245.407299][ T30] audit: type=1400 audit(1754320752.757:535): avc: denied { open } for pid=11552 comm="syz.5.2212" path="/235/file0/file0" dev="fuse" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 245.907297][ T30] audit: type=1326 audit(1754320753.317:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11563 comm="syz.2.2215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc71318eb69 code=0x7ffc0000 [ 245.962942][ T30] audit: type=1326 audit(1754320753.317:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11563 comm="syz.2.2215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc71318eb69 code=0x7ffc0000 [ 246.043876][ T30] audit: type=1326 audit(1754320753.347:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11563 comm="syz.2.2215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fc71318eb69 code=0x7ffc0000 [ 246.097062][ T30] audit: type=1326 audit(1754320753.347:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11563 comm="syz.2.2215" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc71318eb69 code=0x0 [ 246.250501][T11572] 9pnet_fd: Insufficient options for proto=fd [ 246.335675][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 246.347547][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 246.357995][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 246.367439][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 246.380029][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 246.639077][T11575] chnl_net:caif_netlink_parms(): no params data found [ 246.790031][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 246.799407][ T5890] usb 1-1: USB disconnect, device number 27 [ 246.811227][ T5890] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 246.849605][ T5890] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 246.908850][ T5890] quatech2 1-1:0.51: device disconnected [ 247.016552][T11575] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.026361][T11575] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.033575][T11575] bridge_slave_0: entered allmulticast mode [ 247.047123][T11575] bridge_slave_0: entered promiscuous mode [ 247.060243][T11575] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.068419][T11575] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.075969][T11575] bridge_slave_1: entered allmulticast mode [ 247.083810][T11575] bridge_slave_1: entered promiscuous mode [ 247.130261][T11575] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 247.160193][T11575] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 247.337718][T11575] team0: Port device team_slave_0 added [ 247.358580][T11575] team0: Port device team_slave_1 added [ 247.578188][T11622] Invalid ELF header magic: != ELF [ 247.591099][T11575] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 247.624756][T11575] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.686298][T11575] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 247.708768][T11627] netlink: 'syz.0.2237': attribute type 4 has an invalid length. [ 247.717258][T11575] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 247.731326][T11575] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.765233][T11575] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 247.798368][T11631] netlink: 'syz.0.2237': attribute type 4 has an invalid length. [ 247.886017][T11575] hsr_slave_0: entered promiscuous mode [ 247.896189][T11575] hsr_slave_1: entered promiscuous mode [ 247.929423][T11635] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2239'. [ 248.044278][T11575] debugfs: 'hsr0' already exists in 'hsr' [ 248.057701][T11575] Cannot create hsr debugfs directory [ 248.431210][T11646] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 248.474657][ T51] Bluetooth: hci0: command tx timeout [ 248.548044][T11650] Bluetooth: (null): Too short H5 packet [ 248.579719][T11575] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 248.591915][T11575] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.639617][T11654] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2248'. [ 248.657249][T11654] netlink: 'syz.5.2248': attribute type 14 has an invalid length. [ 248.725628][T11575] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 248.739320][T11575] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.760051][T11654] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2248'. [ 248.772852][T11654] netlink: 'syz.5.2248': attribute type 14 has an invalid length. [ 248.779677][T11660] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2251'. [ 248.824090][T11575] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 248.878878][T11575] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.294493][T11660] team1: entered promiscuous mode [ 249.347860][T11660] team1: entered allmulticast mode [ 249.690898][T11575] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 249.737371][T11575] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.971060][T11575] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 250.000920][T11575] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 250.082325][T11575] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 250.167579][T11575] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 250.372324][T11575] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.418543][T11575] 8021q: adding VLAN 0 to HW filter on device team0 [ 250.435494][ T1538] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 250.454764][ T3534] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.461891][ T3534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 250.494237][ T3534] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.501419][ T3534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 250.556149][ T51] Bluetooth: hci0: command tx timeout [ 250.626060][ T1538] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 250.642382][ T1538] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 250.664841][ T1538] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.688748][ T1538] usb 6-1: config 0 descriptor?? [ 250.902026][ T1538] usbhid 6-1:0.0: can't add hid device: -71 [ 250.914782][ T1538] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 250.954865][ T1538] usb 6-1: USB disconnect, device number 13 [ 251.000827][T11720] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2273'. [ 251.191392][T11575] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 251.251563][T11575] veth0_vlan: entered promiscuous mode [ 251.275952][T11575] veth1_vlan: entered promiscuous mode [ 251.322950][T11575] veth0_macvtap: entered promiscuous mode [ 251.337776][T11575] veth1_macvtap: entered promiscuous mode [ 251.363942][T11575] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 251.383954][T11575] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 251.400553][ T3509] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.413439][ T3509] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.444698][ T1538] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 251.462790][ T3509] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.487309][ T3509] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.600342][ T3509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.614780][ T1538] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.646187][ T3509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.653668][ T1538] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 251.674610][ T1538] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.699146][ T1538] usb 6-1: config 0 descriptor?? [ 251.708150][ T3534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.725558][T11740] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3897524436 (7795048872 ns) > initial count (2759807172 ns). Using initial count to start timer. [ 251.743154][ T3534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.763396][ T30] audit: type=1400 audit(1754320759.167:540): avc: denied { mounton } for pid=11575 comm="syz-executor" path="/root/syzkaller.WA8Xlf/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=38537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 251.769166][T11740] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3996681224 (15986724896 ns) > initial count (3709615788 ns). Using initial count to start timer. [ 252.062005][ T30] audit: type=1400 audit(1754320759.217:541): avc: denied { mount } for pid=11575 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 252.454005][ T1538] keytouch 0003:0926:3333.002B: fixing up Keytouch IEC report descriptor [ 252.478464][ T1538] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.002B/input/input35 [ 252.635610][ T1538] keytouch 0003:0926:3333.002B: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 252.647731][ T51] Bluetooth: hci0: command tx timeout [ 252.654030][T11760] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2287'. [ 252.698708][T11758] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2285'. [ 252.773600][ T1538] usb 6-1: USB disconnect, device number 14 [ 252.854420][T11763] fido_id[11763]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 252.913962][T11768] overlayfs: failed to clone upperpath [ 253.004869][ T30] audit: type=1326 audit(1754320760.407:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.079955][ T30] audit: type=1326 audit(1754320760.407:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.111439][ T30] audit: type=1326 audit(1754320760.437:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.143010][ T30] audit: type=1326 audit(1754320760.457:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.169362][ T30] audit: type=1326 audit(1754320760.457:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.192982][ T30] audit: type=1326 audit(1754320760.467:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.243570][ T30] audit: type=1326 audit(1754320760.467:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.292625][ T30] audit: type=1326 audit(1754320760.467:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11772 comm="syz.0.2292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f417e38eb69 code=0x7ffc0000 [ 253.453388][T11792] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 254.129568][T11823] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2307'. [ 254.489528][T11843] Bluetooth: MGMT ver 1.23 [ 254.502256][T11843] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 254.530167][T11845] ALSA: seq fatal error: cannot create timer (-22) [ 254.714890][ T51] Bluetooth: hci0: command tx timeout [ 255.018778][T11872] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 255.224174][T11883] netlink: zone id is out of range [ 255.230374][T11883] netlink: del zone limit has 4 unknown bytes [ 255.285989][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.292388][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.873563][T11924] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2351'. [ 257.396023][T11946] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2358'. [ 258.007183][T11973] usb usb7: usbfs: process 11973 (syz.2.2370) did not claim interface 0 before use [ 258.154753][ T5951] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 258.174133][T11977] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 258.184316][ T919] IPVS: starting estimator thread 0... [ 258.212723][T11976] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 258.286514][T11980] IPVS: using max 48 ests per chain, 115200 per kthread [ 258.334590][ T5951] usb 1-1: Using ep0 maxpacket: 8 [ 258.341330][ T5951] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 258.354726][ T5951] usb 1-1: config 179 has no interface number 0 [ 258.369748][ T5951] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 258.402891][ T5951] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 258.455961][ T5951] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 258.471560][ T5951] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 258.487713][ T5951] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 258.501367][ T5951] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 258.522118][ T5951] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.552701][T11968] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 258.681418][T12002] kvm: MONITOR instruction emulated as NOP! [ 258.762306][T12005] kernel read not supported for file /!seih,iPlNnuxselinux (pid: 12005 comm: syz.2.2381) [ 258.799963][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 258.799982][ T30] audit: type=1800 audit(1754320766.207:562): pid=12005 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.2381" name=217365F769682C1769AC50E66C4E6E757873656C696E7578 dev="mqueue" ino=40198 res=0 errno=0 [ 258.830909][ C1] vkms_vblank_simulate: vblank timer overrun [ 258.880562][ T5951] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input36 [ 259.097989][T11968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.111364][T11968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.362882][ T5995] usb 1-1: USB disconnect, device number 28 [ 259.362969][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 259.377405][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 259.681793][ T30] audit: type=1800 audit(1754320767.087:563): pid=12026 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2389" name="nullb0" dev="tmpfs" ino=3114 res=0 errno=0 [ 260.351819][T12039] IPv4: Oversized IP packet from 172.20.20.24 [ 260.360384][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 260.366910][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 260.393863][ T5951] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 260.564646][ T5951] usb 1-1: Using ep0 maxpacket: 8 [ 260.571325][ T5951] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 260.678035][ T5951] usb 1-1: config 2 has no interface number 0 [ 260.684325][ T5951] usb 1-1: config 2 interface 31 has no altsetting 0 [ 260.707280][ T5951] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 260.717277][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.849893][T12045] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2397'. [ 260.854571][ T5951] usb 1-1: Product: syz [ 260.888920][ T5951] usb 1-1: Manufacturer: syz [ 260.909122][ T5951] usb 1-1: SerialNumber: syz [ 261.061595][ T30] audit: type=1400 audit(1754320768.467:564): avc: denied { setopt } for pid=12050 comm="syz.1.2400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 261.472397][ T5951] ch9200 1-1:2.31: probe with driver ch9200 failed with error -22 [ 261.493442][ T5951] usb 1-1: USB disconnect, device number 29 [ 262.036993][T12097] overlayfs: failed to clone upperpath [ 262.360932][ T30] audit: type=1400 audit(1754320769.757:565): avc: denied { mount } for pid=12113 comm="syz.1.2424" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 262.444665][ T5951] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 262.594600][ T5951] usb 4-1: Using ep0 maxpacket: 16 [ 262.610342][ T5951] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.641651][ T5951] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 262.664591][ T5951] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 262.700098][ T5951] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 262.724612][ T5951] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.749056][ T5951] usb 4-1: config 0 descriptor?? [ 263.191945][T12105] random: crng reseeded on system resumption [ 263.234330][ T5951] input: HID 0955:7214 Haptics as /devices/virtual/input/input37 [ 263.341933][ T5951] shield 0003:0955:7214.002C: Registered Thunderstrike controller [ 263.354744][ T919] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 263.382700][ T44] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65380 sclass=netlink_route_socket pid=44 comm=kworker/1:1 [ 263.405534][ T5951] shield 0003:0955:7214.002C: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.3-1/input0 [ 263.508716][ T44] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 263.529808][ T5951] usb 4-1: USB disconnect, device number 39 [ 263.544780][ T919] usb 1-1: Using ep0 maxpacket: 8 [ 263.551679][ T44] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 263.571679][ T44] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 263.594083][ T919] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 263.611457][ T919] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.630872][ T44] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 263.665326][ T919] pvrusb2: Hardware description: Terratec Grabster AV400 [ 263.672384][ T919] pvrusb2: ********** [ 263.699842][ T919] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 263.731647][ T919] pvrusb2: Important functionality might not be entirely working. [ 263.753600][ T919] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 263.767917][ T919] pvrusb2: ********** [ 263.817498][ T30] audit: type=1400 audit(1754320771.207:566): avc: denied { ioctl } for pid=12148 comm="syz.2.2436" path="socket:[40492]" dev="sockfs" ino=40492 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 263.869533][ T2336] pvrusb2: Invalid write control endpoint [ 264.041326][ T2336] pvrusb2: Invalid write control endpoint [ 264.085660][ T2336] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 264.114718][ T2336] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 264.139603][ T2336] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 264.150668][ T2336] pvrusb2: Device being rendered inoperable [ 264.166513][T12137] pvrusb2: Attempted to execute control transfer when device not ok [ 264.220371][ T2336] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 264.246245][ T919] usb 1-1: USB disconnect, device number 30 [ 264.248373][ T2336] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 264.310722][ T2336] pvrusb2: Attached sub-driver cx25840 [ 264.322833][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 264.337090][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 264.350875][T12171] loop6: detected capacity change from 0 to 63 [ 264.365426][ T6783] buffer_io_error: 138 callbacks suppressed [ 264.365450][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.391502][ T30] audit: type=1400 audit(1754320771.797:567): avc: denied { map } for pid=12170 comm="syz.5.2445" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.391624][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.443635][ T30] audit: type=1400 audit(1754320771.797:568): avc: denied { execute } for pid=12170 comm="syz.5.2445" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.443693][T12171] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.532402][T12175] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.559219][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.587756][T12171] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.597177][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.620193][T12171] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.629760][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.674825][T12171] Buffer I/O error on dev loop6, logical block 0, async page read [ 264.747204][ T30] audit: type=1400 audit(1754320772.157:569): avc: denied { read } for pid=12176 comm="syz.3.2447" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 264.821980][ T30] audit: type=1400 audit(1754320772.157:570): avc: denied { open } for pid=12176 comm="syz.3.2447" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 267.064048][ T30] audit: type=1400 audit(1754320774.467:571): avc: denied { firmware_load } for pid=12221 comm="syz.0.2467" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 267.292506][T12222] syz.0.2467 (12222) used greatest stack depth: 19752 bytes left [ 267.426761][T12238] overlayfs: failed to clone upperpath [ 267.710588][ T30] audit: type=1400 audit(1754320775.117:572): avc: denied { connect } for pid=12246 comm="syz.0.2478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 267.844165][ T30] audit: type=1400 audit(1754320775.237:573): avc: denied { read } for pid=12246 comm="syz.0.2478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 268.314199][T12275] syz_tun: entered promiscuous mode [ 268.338078][T12275] batadv_slave_0: entered promiscuous mode [ 269.244634][ T1538] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 269.315725][ T5951] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 269.394692][ T1538] usb 3-1: Using ep0 maxpacket: 16 [ 269.416172][ T1538] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 269.433214][ T1538] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 269.443636][ T1538] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 269.458051][ T1538] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 269.486406][ T5951] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 269.486531][T12301] infiniband syz0: set active [ 269.501939][T12301] infiniband syz0: added bond_slave_1 [ 269.503676][ T5951] usb 4-1: config 0 interface 0 has no altsetting 0 [ 269.517724][ T5951] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 269.530328][ T5951] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 269.538794][ T1538] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.543490][ T5951] usb 4-1: Product: syz [ 269.548326][ T1538] usb 3-1: Product: syz [ 269.561192][ T1538] usb 3-1: Manufacturer: syz [ 269.565869][ T1538] usb 3-1: SerialNumber: syz [ 269.587473][T12301] RDS/IB: syz0: added [ 269.598871][T12301] smc: adding ib device syz0 with port count 1 [ 269.601119][ T5951] usb 4-1: Manufacturer: syz [ 269.605144][T12301] smc: ib device syz0 port 1 has pnetid [ 269.617034][ T5951] usb 4-1: SerialNumber: syz [ 269.636358][ T5951] usb 4-1: config 0 descriptor?? [ 269.864610][ T5995] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 269.991140][ T1538] usb 3-1: 2:1 : format type 0 is detected, processed as PCM [ 270.026932][ T5995] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 270.047008][ T5995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.065787][ T5995] usb 1-1: config 0 descriptor?? [ 270.083016][ T5995] cp210x 1-1:0.0: cp210x converter detected [ 270.245382][ T30] audit: type=1326 audit(1754320777.657:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.274847][ T30] audit: type=1326 audit(1754320777.677:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=266 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.305658][ T30] audit: type=1326 audit(1754320777.677:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.340188][ T30] audit: type=1326 audit(1754320777.677:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.367261][ T30] audit: type=1326 audit(1754320777.677:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.399891][ T30] audit: type=1326 audit(1754320777.677:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.436284][ T30] audit: type=1326 audit(1754320777.677:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.478617][ T30] audit: type=1326 audit(1754320777.677:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=267 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.509071][ T30] audit: type=1326 audit(1754320777.677:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.540639][ T30] audit: type=1326 audit(1754320777.677:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12320 comm="syz.1.2506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x7ffc0000 [ 270.708111][ T5995] cp210x 1-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 270.716353][ T5995] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 270.736833][ T5995] usb 1-1: cp210x converter now attached to ttyUSB0 [ 270.777263][ T5995] usb 1-1: USB disconnect, device number 31 [ 270.842273][ T5995] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 270.865132][ T5995] cp210x 1-1:0.0: device disconnected [ 271.037105][ T5951] usb 4-1: selecting invalid altsetting 0 [ 271.048326][ T1538] usb 3-1: USB disconnect, device number 32 [ 271.194377][ T5951] usb 4-1: USB disconnect, device number 40 [ 271.361268][ T6147] udevd[6147]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 273.300626][T12402] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2538'. [ 273.581995][T12421] overlayfs: failed to clone upperpath [ 273.847816][T12435] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2552'. [ 275.354906][ T5951] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 275.514944][ T5951] usb 1-1: Using ep0 maxpacket: 16 [ 275.530073][ T5951] usb 1-1: config 0 has an invalid interface number: 48 but max is 0 [ 275.542064][ T5951] usb 1-1: config 0 has no interface number 0 [ 275.548655][ T5951] usb 1-1: config 0 interface 48 has no altsetting 0 [ 275.557731][ T5951] usb 1-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=a8.98 [ 275.567204][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.589242][ T5951] usb 1-1: Product: syz [ 275.593437][ T5951] usb 1-1: Manufacturer: syz [ 275.604627][ T5951] usb 1-1: SerialNumber: syz [ 275.629726][ T5951] usb 1-1: config 0 descriptor?? [ 275.921070][ T5951] usb 1-1: USB disconnect, device number 32 [ 276.186723][T12517] overlayfs: failed to clone upperpath [ 276.518305][T12533] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 276.527866][T12534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2590'. [ 276.556328][T12534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2590'. [ 276.662935][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 276.662950][ T30] audit: type=1400 audit(1754320784.067:589): avc: denied { compute_member } for pid=12537 comm="syz.3.2592" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 276.742703][ T30] audit: type=1400 audit(1754320784.137:590): avc: denied { write } for pid=12539 comm="syz.1.2593" path="socket:[42360]" dev="sockfs" ino=42360 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 276.777278][T12544] loop6: detected capacity change from 0 to 63 [ 276.824010][T12544] buffer_io_error: 1748 callbacks suppressed [ 276.824029][T12544] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.850803][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.875135][T12544] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.883618][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.892635][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.901873][T12550] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.911744][T12544] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.921460][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.930487][ T6783] Buffer I/O error on dev loop6, logical block 0, async page read [ 276.938715][T12544] Buffer I/O error on dev loop6, logical block 0, async page read [ 277.214614][ T1538] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 277.578677][ T1538] usb 1-1: config 0 has no interfaces? [ 277.646247][T12556] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2599'. [ 277.655385][ T1538] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 277.716004][T12556] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2599'. [ 277.729587][ T1538] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 277.752373][ T1538] usb 1-1: Product: syz [ 277.786146][ T1538] usb 1-1: Manufacturer: syz [ 277.798047][ T1538] usb 1-1: SerialNumber: syz [ 277.807995][ T1538] usb 1-1: config 0 descriptor?? [ 278.607382][ T1538] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 278.618977][T12578] overlayfs: failed to clone upperpath [ 278.764910][ T1538] usb 4-1: Using ep0 maxpacket: 8 [ 278.776950][ T1538] usb 4-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 278.789379][ T1538] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 278.799910][ T1538] usb 4-1: Product: syz [ 278.804102][ T1538] usb 4-1: Manufacturer: syz [ 278.808903][ T1538] usb 4-1: SerialNumber: syz [ 278.817003][ T1538] usb 4-1: config 0 descriptor?? [ 278.947790][T12591] rdma_rxe: rxe_newlink: failed to add lo [ 278.968237][T12591] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 279.055072][T12593] KVM: debugfs: duplicate directory 12593-5 [ 279.300694][ T1538] usb 4-1: USB disconnect, device number 41 [ 279.346611][ T6783] udevd[6783]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 279.914964][ T5897] usb 1-1: USB disconnect, device number 33 [ 281.033016][ T30] audit: type=1400 audit(1754320788.437:591): avc: denied { shutdown } for pid=12657 comm="syz.1.2643" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 282.100497][T12683] overlayfs: failed to clone upperpath [ 284.030013][T12756] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 284.374617][ T1538] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 284.824597][ T1538] usb 1-1: Using ep0 maxpacket: 32 [ 284.852206][ T1538] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 284.886188][ T1538] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 284.927838][ T1538] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 284.978351][ T1538] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.036042][ T1538] usb 1-1: config 0 descriptor?? [ 285.051851][T12755] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 285.062437][ T1538] hub 1-1:0.0: USB hub found [ 285.284660][ T5995] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 285.303313][ T1538] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 285.464601][ T5995] usb 4-1: Using ep0 maxpacket: 8 [ 285.493254][ T5995] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 285.522064][ T5995] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 285.564567][ T5995] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 285.582662][ T1538] hid-generic 0003:046D:C31C.002D: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.0-1/input0 [ 285.600377][ T5995] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 285.623812][ T5995] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 285.701496][ T5995] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 285.728005][ T5995] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.935335][ T1538] usb 1-1: USB disconnect, device number 34 [ 286.017416][ T5995] usb 4-1: usb_control_msg returned -32 [ 286.023046][ T5995] usbtmc 4-1:16.0: can't read capabilities [ 286.421367][T12798] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2698'. [ 286.573092][ T30] audit: type=1400 audit(1754320793.977:592): avc: denied { watch_mount } for pid=12806 comm="syz.2.2702" path="/437/file1" dev="tmpfs" ino=2301 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 287.067820][ T5897] usb 4-1: USB disconnect, device number 42 [ 288.162885][ T30] audit: type=1400 audit(1754320794.567:593): avc: denied { kexec_image_load } for pid=12833 comm="syz.1.2710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 288.284842][ T1538] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 288.357571][T12842] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2856151591 (22849212728 ns) > initial count (5743301600 ns). Using initial count to start timer. [ 288.403402][T12842] kvm: Disabled LAPIC found during irq injection [ 288.444647][ T1538] usb 3-1: Using ep0 maxpacket: 32 [ 288.451558][ T1538] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 288.466118][ T1538] usb 3-1: config 0 has no interface number 0 [ 288.488369][ T1538] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 288.516577][ T1538] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.539265][ T1538] usb 3-1: Product: syz [ 288.545588][ T1538] usb 3-1: Manufacturer: syz [ 288.550284][ T1538] usb 3-1: SerialNumber: syz [ 288.569042][ T1538] usb 3-1: config 0 descriptor?? [ 288.583064][ T1538] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 288.602879][ T1538] usb 3-1: selecting invalid altsetting 1 [ 288.623082][ T1538] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 288.689858][ T1538] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 288.710790][ T1538] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 288.749391][ T1538] usb 3-1: media controller created [ 288.820710][T12832] usb 3-1: dvb_usb_ce6230: I2C read not implemented [ 288.854734][ T1538] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 288.955273][ T1538] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 288.973914][ T1538] zl10353_read_register: readreg error (reg=127, ret==-71) [ 288.985988][T12867] batadv_slave_1: entered allmulticast mode [ 288.999516][ T1538] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 289.021108][T12866] batadv_slave_1: left allmulticast mode [ 289.149669][ T1538] usb 3-1: USB disconnect, device number 33 [ 289.628765][ T30] audit: type=1800 audit(1754320797.027:594): pid=12875 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.0.2724" name="/" dev="tmpfs" ino=59 res=0 errno=0 [ 289.989372][T12895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2733'. [ 290.020027][T12895] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2733'. [ 290.029836][T12895] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2733'. [ 290.660678][T12905] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2736'. [ 290.682230][T12905] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 290.718177][T12905] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2736'. [ 290.755647][T12905] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 290.787403][ T30] audit: type=1400 audit(1754320798.197:595): avc: denied { cmd } for pid=12907 comm="syz.2.2738" path="socket:[44441]" dev="sockfs" ino=44441 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 291.904561][ T1538] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 292.088097][ T1538] usb 6-1: New USB device found, idVendor=04b4, idProduct=6830, bcdDevice=86.cf [ 292.101775][ T1538] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.138647][ T1538] ums-cypress 6-1:1.0: USB Mass Storage device detected [ 292.400459][ T1538] usb 6-1: USB disconnect, device number 15 [ 293.392457][T12961] syzkaller1: entered promiscuous mode [ 293.405795][T12961] syzkaller1: entered allmulticast mode [ 294.555672][T12995] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 294.754691][ T44] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 294.782406][T13003] syzkaller0: tun_chr_ioctl cmd 1074025672 [ 294.789480][T13003] syzkaller0: ignored: set checksum disabled [ 294.920945][T13005] netlink: 'syz.5.2776': attribute type 1 has an invalid length. [ 294.933889][T13005] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2776'. [ 294.936047][ T44] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.946455][T13005] netlink: 'syz.5.2776': attribute type 2 has an invalid length. [ 294.963552][T13005] netlink: 'syz.5.2776': attribute type 1 has an invalid length. [ 294.978288][T13005] netlink: 2 bytes leftover after parsing attributes in process `syz.5.2776'. [ 295.044619][ T44] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 295.053711][ T44] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.066933][ T44] usb 3-1: config 0 descriptor?? [ 295.080223][ T44] pwc: Askey VC010 type 2 USB webcam detected. [ 295.479748][ T44] pwc: recv_control_msg error -32 req 02 val 2b00 [ 295.522049][ T44] pwc: recv_control_msg error -32 req 02 val 2700 [ 295.535259][ T44] pwc: recv_control_msg error -32 req 02 val 2c00 [ 295.946434][ T44] pwc: recv_control_msg error -71 req 04 val 1400 [ 295.963293][ T44] pwc: recv_control_msg error -71 req 02 val 2000 [ 295.972032][ T44] pwc: recv_control_msg error -71 req 02 val 2100 [ 296.034902][ T44] pwc: recv_control_msg error -71 req 04 val 1500 [ 296.041833][ T44] pwc: recv_control_msg error -71 req 02 val 2500 [ 296.054189][ T44] pwc: recv_control_msg error -71 req 02 val 2400 [ 296.064737][ T44] pwc: recv_control_msg error -71 req 02 val 2600 [ 296.071607][ T44] pwc: recv_control_msg error -71 req 02 val 2900 [ 296.079987][ T44] pwc: recv_control_msg error -71 req 02 val 2800 [ 296.092918][ T44] pwc: recv_control_msg error -71 req 04 val 1100 [ 296.101070][ T44] pwc: recv_control_msg error -71 req 04 val 1200 [ 296.149306][ T44] pwc: Registered as video103. [ 296.163902][ T44] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input38 [ 296.203795][ T44] usb 3-1: USB disconnect, device number 34 [ 296.901302][T13035] netlink: 'syz.2.2788': attribute type 1 has an invalid length. [ 296.911886][T13035] netlink: 'syz.2.2788': attribute type 4 has an invalid length. [ 296.921047][T13035] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.2788'. [ 297.381714][T13048] syz_tun: entered promiscuous mode [ 297.389026][T13048] team0: Device macvlan2 is up. Set it down before adding it as a team port [ 297.417695][T13048] syz_tun: left promiscuous mode [ 297.739906][ T30] audit: type=1400 audit(1754320805.147:596): avc: denied { mounton } for pid=13060 comm="syz.0.2797" path="/513/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 297.881230][ T30] audit: type=1400 audit(1754320805.287:597): avc: denied { unmount } for pid=5844 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 297.901063][ C0] vkms_vblank_simulate: vblank timer overrun [ 297.926761][T13066] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 298.311891][T13081] loop2: detected capacity change from 0 to 7 [ 298.322619][T13081] Dev loop2: unable to read RDB block 7 [ 298.331657][T13081] loop2: unable to read partition table [ 298.337644][T13081] loop2: partition table beyond EOD, truncated [ 298.343872][T13081] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 298.802947][T13098] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2813'. [ 300.135828][ T30] audit: type=1400 audit(1754320807.537:598): avc: denied { append } for pid=13128 comm="syz.5.2826" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 300.221108][ T30] audit: type=1400 audit(1754320807.567:599): avc: denied { map } for pid=13128 comm="syz.5.2826" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 300.248663][ T30] audit: type=1400 audit(1754320807.567:600): avc: denied { write execute } for pid=13128 comm="syz.5.2826" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 300.396484][T13140] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2828'. [ 300.412937][T13140] gretap0: entered promiscuous mode [ 300.436339][T13140] netlink: 5 bytes leftover after parsing attributes in process `syz.5.2828'. [ 300.449172][T13140] 0{X: renamed from gretap0 [ 300.464250][T13140] 0{X: left promiscuous mode [ 300.476072][T13140] 0{X: entered allmulticast mode [ 300.492113][T13140] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 300.498027][ T30] audit: type=1400 audit(1754320807.897:601): avc: denied { read write } for pid=13142 comm="syz.2.2829" name="file1" dev="tmpfs" ino=2424 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 300.540604][ T30] audit: type=1400 audit(1754320807.897:602): avc: denied { open } for pid=13142 comm="syz.2.2829" path="/461/file1" dev="tmpfs" ino=2424 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 300.742824][T13154] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2831'. [ 300.802144][T13158] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 300.920132][T13165] Invalid ELF header magic: != ELF [ 301.410105][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 301.419994][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 301.420024][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 301.420037][ T51] Workqueue: hci2 hci_rx_work [ 301.420067][ T51] Call Trace: [ 301.420073][ T51] [ 301.420080][ T51] dump_stack_lvl+0x16c/0x1f0 [ 301.420116][ T51] sysfs_warn_dup+0x7f/0xa0 [ 301.420142][ T51] sysfs_create_dir_ns+0x24b/0x2b0 [ 301.420167][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 301.420189][ T51] ? find_held_lock+0x2b/0x80 [ 301.420216][ T51] ? do_raw_spin_unlock+0x172/0x230 [ 301.420238][ T51] kobject_add_internal+0x2c4/0x9b0 [ 301.420261][ T51] kobject_add+0x16e/0x240 [ 301.420279][ T51] ? __pfx_kobject_add+0x10/0x10 [ 301.420298][ T51] ? do_raw_spin_unlock+0x172/0x230 [ 301.420319][ T51] ? kobject_put+0xab/0x5a0 [ 301.420355][ T51] device_add+0x288/0x1aa0 [ 301.420377][ T51] ? __pfx_dev_set_name+0x10/0x10 [ 301.420400][ T51] ? __pfx_device_add+0x10/0x10 [ 301.420420][ T51] ? mgmt_send_event_skb+0x2fb/0x460 [ 301.420451][ T51] hci_conn_add_sysfs+0x17e/0x230 [ 301.420479][ T51] le_conn_complete_evt+0x1075/0x1d70 [ 301.420502][ T51] ? preempt_count_sub+0xa0/0x160 [ 301.420529][ T51] ? find_held_lock+0x2b/0x80 [ 301.420550][ T51] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 301.420572][ T51] ? hci_event_packet+0x459/0x11c0 [ 301.420598][ T51] ? __mutex_unlock_slowpath+0x163/0x800 [ 301.420631][ T51] hci_le_conn_complete_evt+0x23c/0x370 [ 301.420660][ T51] hci_le_meta_evt+0x354/0x5e0 [ 301.420684][ T51] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 301.420710][ T51] hci_event_packet+0x682/0x11c0 [ 301.420734][ T51] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 301.420759][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 301.420785][ T51] ? kcov_remote_start+0x3c9/0x6d0 [ 301.420807][ T51] ? lockdep_hardirqs_on+0x7c/0x110 [ 301.420837][ T51] hci_rx_work+0x2c5/0x16b0 [ 301.420863][ T51] ? rcu_is_watching+0x12/0xc0 [ 301.420890][ T51] process_one_work+0x9cf/0x1b70 [ 301.420922][ T51] ? __pfx_process_one_work+0x10/0x10 [ 301.420951][ T51] ? assign_work+0x1a0/0x250 [ 301.420972][ T51] worker_thread+0x6c8/0xf10 [ 301.421009][ T51] ? __pfx_worker_thread+0x10/0x10 [ 301.421028][ T51] kthread+0x3c2/0x780 [ 301.421047][ T51] ? __pfx_kthread+0x10/0x10 [ 301.421067][ T51] ? rcu_is_watching+0x12/0xc0 [ 301.421096][ T51] ? __pfx_kthread+0x10/0x10 [ 301.421117][ T51] ret_from_fork+0x5d7/0x6f0 [ 301.421134][ T51] ? __pfx_kthread+0x10/0x10 [ 301.421153][ T51] ret_from_fork_asm+0x1a/0x30 [ 301.421190][ T51] [ 301.421242][ T51] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 301.698521][ T51] Bluetooth: hci2: failed to register connection device [ 301.862430][T13197] XFS (nullb0): Invalid superblock magic number [ 302.616260][T13232] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2859'. [ 302.638806][T13232] unsupported nlmsg_type 40 [ 302.943644][T13251] overlayfs: failed to clone upperpath [ 303.089109][T13260] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2870'. [ 303.246559][T13268] overlayfs: failed to clone upperpath [ 303.314422][ T30] audit: type=1400 audit(1754320810.717:603): avc: denied { ioctl } for pid=13274 comm="syz.0.2877" path="socket:[45778]" dev="sockfs" ino=45778 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 304.049317][T13315] sctp: [Deprecated]: syz.2.2893 (pid 13315) Use of struct sctp_assoc_value in delayed_ack socket option. [ 304.049317][T13315] Use struct sctp_sack_info instead [ 304.209667][ T30] audit: type=1400 audit(1754320811.547:604): avc: denied { create } for pid=13316 comm="syz.2.2894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 304.489625][T13325] team0 (unregistering): Port device team_slave_0 removed [ 304.523535][T13325] team0 (unregistering): Port device team_slave_1 removed [ 305.888144][ T30] audit: type=1400 audit(1754320813.287:605): avc: denied { mounton } for pid=13374 comm="syz.2.2919" path="/481/file0" dev="tmpfs" ino=2529 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 305.991413][ T30] audit: type=1400 audit(1754320813.337:606): avc: denied { remount } for pid=13374 comm="syz.2.2919" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 306.524408][T13401] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2929'. [ 306.662614][T13407] kvm: kvm [13406]: vcpu2, guest rIP: 0x911d Unhandled WRMSR(0xc1) = 0xffff [ 306.672208][T13407] kvm: kvm [13406]: vcpu2, guest rIP: 0x911d Unhandled WRMSR(0xc2) = 0xffff [ 306.765499][T13410] kvm: kvm [13403]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0xa000005 [ 307.089798][T13416] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2935'. [ 307.185520][T13416] 8021q: adding VLAN 0 to HW filter on device bond1 [ 307.768470][T13449] trusted_key: encrypted_key: insufficient parameters specified [ 307.796074][T13452] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=259 sclass=netlink_route_socket pid=13452 comm=syz.0.2945 [ 308.413863][T13484] input: syz0 as /devices/virtual/input/input39 [ 308.466532][ T5897] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 308.557922][ T5846] Bluetooth: hci4: command 0x0406 tx timeout [ 308.626592][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 308.659740][ T5897] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 308.676176][ T5897] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 308.688524][ T5897] usb 3-1: config 0 has no interface number 0 [ 308.699251][ T5897] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 308.711698][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.721161][ T5897] usb 3-1: Product: syz [ 308.727354][ T5897] usb 3-1: Manufacturer: syz [ 308.731936][ T5897] usb 3-1: SerialNumber: syz [ 308.738549][ T5897] usb 3-1: config 0 descriptor?? [ 308.747498][ T5897] usb 3-1: Found UVC 0.00 device syz (046d:08f3) [ 308.753923][ T5897] usb 3-1: No valid video chain found. [ 308.835266][ T5995] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 308.904674][ T24] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 308.976500][ T5897] usb 3-1: USB disconnect, device number 35 [ 308.995293][ T5995] usb 1-1: Using ep0 maxpacket: 16 [ 309.004110][ T5995] usb 1-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 309.013954][ T5995] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.028519][ T5995] usb 1-1: Product: syz [ 309.032738][ T5995] usb 1-1: Manufacturer: syz [ 309.043365][ T5995] usb 1-1: SerialNumber: syz [ 309.060287][ T5995] usb 1-1: config 0 descriptor?? [ 309.073114][ T5995] ssu100 1-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 309.084786][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 309.093684][ T24] usb 4-1: config 0 has an invalid interface number: 51 but max is 5 [ 309.102844][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 6 [ 309.132511][ T24] usb 4-1: config 0 has no interface number 0 [ 309.152205][ T24] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 309.169000][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.178351][ T24] usb 4-1: Product: syz [ 309.182559][ T24] usb 4-1: Manufacturer: syz [ 309.192132][ T24] usb 4-1: SerialNumber: syz [ 309.208999][ T24] usb 4-1: config 0 descriptor?? [ 309.221335][ T24] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 309.379245][T13512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2974'. [ 309.440843][ T24] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 309.470180][ T24] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 309.633697][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - status message too short [ 309.834231][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 309.849225][ T44] usb 4-1: USB disconnect, device number 43 [ 309.868480][ T44] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 309.899288][ T44] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 309.930791][ T44] quatech2 4-1:0.51: device disconnected [ 310.035415][T13542] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2984'. [ 310.092747][T13542] syz_tun (unregistering): left promiscuous mode [ 310.284159][ T5995] ssu100 1-1:0.0: probe with driver ssu100 failed with error -71 [ 310.304161][ T5995] usb 1-1: USB disconnect, device number 35 [ 310.470169][T13558] input: syz1 as /devices/virtual/input/input40 [ 311.130014][T13588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3002'. [ 311.183434][T13590] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 311.191135][T13590] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 311.212649][T13590] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 311.241156][T13590] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 311.296290][T13597] netlink: 'syz.1.3007': attribute type 10 has an invalid length. [ 311.346806][T13597] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3007'. [ 311.373012][T13597] dummy0: entered promiscuous mode [ 311.384378][T13597] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 311.535433][ T5995] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 311.560647][ T30] audit: type=1400 audit(1754320818.967:607): avc: denied { getopt } for pid=13605 comm="syz.2.3011" lport=45128 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 311.651752][T13610] syzkaller0: entered promiscuous mode [ 311.668200][T13610] syzkaller0: entered allmulticast mode [ 311.705125][T13616] deleting an unspecified loop device is not supported. [ 311.713050][ T30] audit: type=1400 audit(1754320819.107:608): avc: denied { read } for pid=13613 comm="syz.2.3015" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 311.739530][ T30] audit: type=1400 audit(1754320819.107:609): avc: denied { open } for pid=13613 comm="syz.2.3015" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 311.779327][ T5995] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 311.797823][ T5995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.824785][ T30] audit: type=1400 audit(1754320819.117:610): avc: denied { ioctl } for pid=13613 comm="syz.2.3015" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 311.873556][ T5995] usb 1-1: config 0 descriptor?? [ 311.899278][ T5995] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 312.300083][ T5995] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 312.313328][ T5995] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 312.341558][T13638] kvm: Disabled LAPIC found during irq injection [ 312.844638][ T5951] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 313.006755][ T5951] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 313.021598][ T5951] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 313.033592][ T5951] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 313.046833][ T5951] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.059497][T13653] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 313.071787][ T5951] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 313.215261][ T1538] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 313.309953][ T44] usb 3-1: USB disconnect, device number 36 [ 313.376479][ T1538] usb 4-1: Using ep0 maxpacket: 32 [ 313.389307][ T1538] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 313.429589][ T1538] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 313.457504][ T1538] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 313.475856][ T1538] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.488920][ T1538] usb 4-1: Product: syz [ 313.494091][ T1538] usb 4-1: Manufacturer: syz [ 313.502275][ T1538] usb 4-1: SerialNumber: syz [ 313.614265][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.623588][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.633276][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.656632][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.666087][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.677656][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.688426][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.699510][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.710917][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.722812][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3050'. [ 313.731562][T13666] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 314.096947][T13723] syzkaller0: entered promiscuous mode [ 314.102584][T13723] syzkaller0: entered allmulticast mode [ 314.112315][T13723] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 314.322702][ T44] usb 1-1: USB disconnect, device number 36 [ 314.365124][T13666] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 314.451723][T13734] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=13734 comm=syz.0.3061 [ 314.580668][ T1538] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 314.587631][ T1538] cdc_ncm 4-1:1.0: dwNtbInMaxSize=8 is too small. Using 2048 [ 314.595842][ T1538] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 314.648884][ T30] audit: type=1400 audit(1754320822.057:611): avc: denied { create } for pid=13736 comm="syz.1.3063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 314.673336][ T30] audit: type=1400 audit(1754320822.057:612): avc: denied { write } for pid=13736 comm="syz.1.3063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 314.697946][ T30] audit: type=1400 audit(1754320822.057:613): avc: denied { bind } for pid=13736 comm="syz.1.3063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 314.782422][ T1538] cdc_ncm 4-1:1.0: setting tx_max = 184 [ 314.793694][ T1538] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 315.009003][ T44] usb 4-1: USB disconnect, device number 44 [ 315.026071][ T44] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 315.111228][T13751] team0: Port device team_slave_0 removed [ 315.373297][ T30] audit: type=1400 audit(1754320822.777:614): avc: denied { bind } for pid=13761 comm="syz.2.3075" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 315.378171][T13762] SELinux: failed to load policy [ 315.621927][T13774] team0: No ports can be present during mode change [ 315.641003][ T30] audit: type=1400 audit(1754320823.047:615): avc: denied { mounton } for pid=13775 comm="syz.3.3081" path="/proc/320/task/321/pagemap" dev="proc" ino=47844 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 315.688452][ T30] audit: type=1400 audit(1754320823.047:616): avc: denied { mounton } for pid=13775 comm="syz.3.3081" path="/proc/320/task/321/ns/pid" dev="proc" ino=47842 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lnk_file permissive=1 [ 316.563520][T13804] overlayfs: failed to clone lowerpath [ 316.726539][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.733839][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.619506][T13832] ceph: No mds server is up or the cluster is laggy [ 318.696502][T13900] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 318.866362][T13906] overlayfs: failed to clone upperpath [ 319.331209][T13927] input: syz1 as /devices/virtual/input/input41 [ 319.528043][ T30] audit: type=1400 audit(1754320826.927:617): avc: denied { setattr } for pid=13929 comm="syz.0.3141" name="/" dev="9p" ino=17889801302421081418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 319.551285][ C0] vkms_vblank_simulate: vblank timer overrun [ 319.801421][T13937] syz_tun: entered allmulticast mode [ 319.844808][T13936] syz_tun: left allmulticast mode [ 319.896169][ T30] audit: type=1400 audit(1754320827.297:618): avc: denied { unmount } for pid=13940 comm="syz.1.3146" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 319.915885][ C0] vkms_vblank_simulate: vblank timer overrun [ 320.661429][T13980] __nla_validate_parse: 38 callbacks suppressed [ 320.661448][T13980] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3162'. [ 321.420213][T13996] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3168'. [ 321.576965][T14000] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3169'. [ 321.835139][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.925626][ T30] audit: type=1326 audit(1754320829.337:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.3172" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc71318eb69 code=0x7fc00000 [ 321.949007][ C0] vkms_vblank_simulate: vblank timer overrun [ 322.560777][ T30] audit: type=1326 audit(1754320829.967:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.3172" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc71312ad69 code=0x7fc00000 [ 322.584087][ C0] vkms_vblank_simulate: vblank timer overrun [ 322.670683][ T30] audit: type=1326 audit(1754320829.967:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.3172" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7fc71312ae2f code=0x7fc00000 [ 322.762670][ T30] audit: type=1326 audit(1754320829.967:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.3172" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fc71318eb69 code=0x7fc00000 [ 322.786064][ C0] vkms_vblank_simulate: vblank timer overrun [ 323.232965][ T30] audit: type=1400 audit(1754320830.637:623): avc: denied { read } for pid=14041 comm="syz.0.3186" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 323.292943][ T30] audit: type=1400 audit(1754320830.637:624): avc: denied { open } for pid=14041 comm="syz.0.3186" path="/567/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 323.355293][ T30] audit: type=1400 audit(1754320830.637:625): avc: denied { ioctl } for pid=14041 comm="syz.0.3186" path="/567/file0/file0" dev="fuse" ino=0 ioctlcmd=0x2282 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 323.492563][ T30] audit: type=1400 audit(1754320830.897:626): avc: denied { write } for pid=14050 comm="syz.0.3187" dev="9p" ino=8539867125209007497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 323.561965][T14054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3190'. [ 323.660297][T14056] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3191'. [ 323.731047][T14056] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3191'. [ 323.778553][T14056] netlink: 'syz.2.3191': attribute type 6 has an invalid length. [ 323.794597][T14056] netlink: 'syz.2.3191': attribute type 5 has an invalid length. [ 323.804587][T14056] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3191'. [ 324.055260][ T5951] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 324.224696][ T5951] usb 4-1: Using ep0 maxpacket: 16 [ 324.249010][ T5951] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 324.289284][ T5951] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 324.349317][ T5951] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 324.365811][ T5951] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.387877][ T5951] usb 4-1: Product: syz [ 324.394154][ T5951] usb 4-1: Manufacturer: syz [ 324.408182][ T5951] usb 4-1: SerialNumber: syz [ 324.421991][ T5951] usb 4-1: config 0 descriptor?? [ 324.438094][ T5951] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 324.450561][ T5951] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 324.670839][T14097] overlayfs: failed to clone upperpath [ 324.838110][T14107] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 324.850304][T14105] IPVS: stopping master sync thread 14107 ... [ 325.015245][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 325.015261][ T30] audit: type=1400 audit(1754320832.427:631): avc: denied { name_connect } for pid=14117 comm="syz.5.3220" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 325.048496][ T5951] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 325.057764][ T5951] em28xx 4-1:0.0: Config register raw data: 0xa6 [ 325.063394][T14121] overlayfs: failed to clone upperpath [ 325.064114][ T5951] em28xx 4-1:0.0: I2S Audio (1 sample rate(s)) [ 325.064132][ T5951] em28xx 4-1:0.0: No AC97 audio processor [ 325.236317][ T24] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 325.395244][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 325.402109][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 325.416513][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 325.428386][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 325.439719][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 325.454134][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 325.472702][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 325.482303][ T24] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 325.494129][ T24] usb 3-1: Manufacturer: syz [ 325.502742][ T24] usb 3-1: config 0 descriptor?? [ 325.621240][T14145] overlayfs: failed to clone upperpath [ 325.825056][ T24] rc_core: IR keymap rc-hauppauge not found [ 325.835451][ T24] Registered IR keymap rc-empty [ 325.841234][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.875155][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.878980][ T5897] usb 4-1: USB disconnect, device number 45 [ 325.906379][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 325.921765][T14161] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 325.933722][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input42 [ 325.935889][T14161] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 325.955008][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.997125][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.015122][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.054644][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.084925][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.124742][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.147068][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.165338][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.208670][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.241748][T14180] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3247'. [ 326.245051][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.298847][ T24] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 326.317521][ T24] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 326.353682][ T24] usb 3-1: USB disconnect, device number 37 [ 326.424124][ T30] audit: type=1400 audit(1754320833.827:632): avc: denied { map } for pid=14185 comm="syz.0.3249" path="socket:[49846]" dev="sockfs" ino=49846 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 326.488367][ T30] audit: type=1400 audit(1754320833.827:633): avc: denied { read } for pid=14185 comm="syz.0.3249" path="socket:[49846]" dev="sockfs" ino=49846 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 327.209865][T14212] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3260'. [ 327.244305][T14212] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3260'. [ 327.329135][T14215] overlayfs: failed to clone upperpath [ 328.554546][ T30] audit: type=1400 audit(1754320835.947:634): avc: denied { read } for pid=14231 comm="syz.2.3268" path="socket:[49884]" dev="sockfs" ino=49884 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 328.742390][T14246] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3272'. [ 329.075087][ T30] audit: type=1400 audit(1754320836.467:635): avc: denied { setopt } for pid=14252 comm="syz.2.3275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 329.392624][ T30] audit: type=1400 audit(1754320836.797:636): avc: denied { execute } for pid=14261 comm="syz.1.3278" path="/bus" dev="ramfs" ino=50364 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 329.787866][T14270] netlink: 'syz.1.3281': attribute type 1 has an invalid length. [ 330.352109][T14270] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 330.384218][T14270] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 330.436328][T14270] bond1: (slave vti0): making interface the new active one [ 330.498808][T14270] bond1: (slave vti0): Enslaving as an active interface with an up link [ 330.758643][T14281] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3285'. [ 330.797101][T14281] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3285'. [ 331.315148][ T5924] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 331.526411][ T5924] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.557018][ T5924] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.577674][ T5924] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 331.611516][ T5924] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.651225][ T5924] usb 3-1: config 0 descriptor?? [ 332.004100][T14309] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3298'. [ 332.298739][ T5924] usbhid 3-1:0.0: can't add hid device: -71 [ 332.322847][ T5924] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 332.356505][ T5924] usb 3-1: USB disconnect, device number 38 [ 333.087840][T14351] overlayfs: failed to clone upperpath [ 333.155496][ T30] audit: type=1400 audit(1754320840.557:637): avc: denied { node_bind } for pid=14352 comm="syz.1.3317" src=52768 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 333.483451][T14363] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 333.666096][T14369] netlink: 'syz.0.3322': attribute type 1 has an invalid length. [ 333.694672][T14369] netlink: 'syz.0.3322': attribute type 2 has an invalid length. [ 333.712174][T14369] netlink: 'syz.0.3322': attribute type 1 has an invalid length. [ 333.720479][T14369] netlink: 'syz.0.3322': attribute type 2 has an invalid length. [ 334.945127][ T5924] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 334.988673][T14416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3341'. [ 335.004715][T14416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3341'. [ 335.116578][ T5924] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 335.144382][ T5924] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 335.167291][ T5924] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 335.177197][ T5924] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 335.188490][ T5924] usb 4-1: SerialNumber: syz [ 335.390784][T14424] netlink: zone id is out of range [ 335.396611][T14424] netlink: zone id is out of range [ 335.404908][T14424] netlink: zone id is out of range [ 335.418021][T14424] netlink: zone id is out of range [ 335.447887][T14424] netlink: zone id is out of range [ 335.455570][T14424] netlink: zone id is out of range [ 335.470164][T14424] netlink: zone id is out of range [ 335.484003][T14424] netlink: zone id is out of range [ 335.498366][T14424] netlink: zone id is out of range [ 335.512302][T14424] netlink: zone id is out of range [ 335.545116][ T30] audit: type=1400 audit(1754320842.957:638): avc: denied { setopt } for pid=14425 comm="syz.0.3344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 335.597186][ T5924] usb 4-1: 0:2 : does not exist [ 335.602116][ T5924] usb 4-1: unit 255 not found! [ 335.820610][ T5924] usb 4-1: USB disconnect, device number 46 [ 336.325068][ T5897] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 336.610447][ T5897] usb 1-1: Using ep0 maxpacket: 16 [ 336.649837][ T5897] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 336.665869][ T5897] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x33, changing to 0x3 [ 336.699371][ T5897] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 336.734416][ T5897] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 57408, setting to 1024 [ 336.881005][ T5897] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 336.905467][ T5897] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 336.944204][ T5897] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 336.965112][ T5995] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 336.983710][ T5897] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 337.003667][ T5897] usb 1-1: Manufacturer: syz [ 337.013694][ T5897] usb 1-1: config 0 descriptor?? [ 337.041466][ T30] audit: type=1400 audit(1754320844.447:639): avc: denied { mounton } for pid=14449 comm="syz.2.3354" path="/563/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 337.127133][ T5995] usb 4-1: Using ep0 maxpacket: 8 [ 337.166975][ T5995] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 337.187764][ T5995] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 337.242036][ T5995] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 337.269028][ T5995] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 337.282530][ T5924] usb 1-1: USB disconnect, device number 37 [ 337.312821][ T5995] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 337.326871][ T5995] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 337.336910][ T5995] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.476532][ T30] audit: type=1400 audit(1754320844.877:640): avc: denied { write } for pid=14465 comm="syz.2.3360" path="socket:[51311]" dev="sockfs" ino=51311 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 337.595224][ T5995] usb 4-1: GET_CAPABILITIES returned 0 [ 337.602079][ T5995] usbtmc 4-1:16.0: can't read capabilities [ 337.967409][T14447] usbtmc 4-1:16.0: usb_control_msg returned -71 [ 337.968350][ T44] usb 4-1: USB disconnect, device number 47 [ 338.217410][ T30] audit: type=1400 audit(1754320845.607:641): avc: denied { watch watch_reads } for pid=14477 comm="syz.0.3362" path="/dev/pts/0" dev="devpts" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_devpts_t tclass=chr_file permissive=1 [ 338.548660][T14486] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3363'. [ 338.564286][ T12] bond1 (unregistering): (slave bridge0): Releasing active interface [ 338.661898][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 338.688906][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 338.712114][ T12] bond0 (unregistering): (slave team0): Releasing backup interface [ 338.808398][ T12] bond0 (unregistering): Released all slaves [ 338.848068][ T5995] libceph: connect (1)[c::]:6789 error -101 [ 338.866829][T14492] ceph: No mds server is up or the cluster is laggy [ 338.879698][ T5995] libceph: mon0 (1)[c::]:6789 connect error [ 338.927540][ T12] bond1 (unregistering): Released all slaves [ 339.664362][ T12] hsr_slave_0: left promiscuous mode [ 339.674710][ T12] hsr_slave_1: left promiscuous mode [ 339.682403][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.691032][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.707214][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.718397][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.725554][ T5951] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 339.745001][T14534] binder: 14533:14534 ioctl c0306201 200000000280 returned -14 [ 339.767752][ T12] veth1_macvtap: left promiscuous mode [ 339.773335][ T12] veth0_macvtap: left promiscuous mode [ 339.780666][ T5995] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 339.893600][ T5951] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 339.907825][ T5951] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 339.922020][ T5951] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 339.934767][ T5951] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 339.935006][ T5995] usb 4-1: Using ep0 maxpacket: 16 [ 339.954162][ T5951] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 339.971800][ T5951] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.974713][ T5995] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 340.000140][ T5951] usb 3-1: config 0 descriptor?? [ 340.003393][ T5995] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 340.020119][ T5995] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 340.041138][ T5995] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 340.074124][ T5995] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 340.101195][ T5995] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 340.111248][ T5995] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 340.147845][ T5995] usb 4-1: Manufacturer: syz [ 340.177730][ T5995] usb 4-1: config 0 descriptor?? [ 340.332319][ T12] team0 (unregistering): Port device team_slave_1 removed [ 340.448227][ T12] team0 (unregistering): Port device team_slave_0 removed [ 340.470977][ T30] audit: type=1400 audit(1754320847.867:642): avc: denied { getopt } for pid=14546 comm="syz.1.3385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 340.490395][ T5995] rc_core: IR keymap rc-hauppauge not found [ 340.490412][ T5995] Registered IR keymap rc-empty [ 340.490524][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.508898][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.533031][ T5951] plantronics 0003:047F:FFFF.002E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 340.545438][ T5995] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 340.546787][ T5995] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input43 [ 340.602697][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.637384][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.669433][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.695243][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.716984][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.737445][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.769097][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.796422][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.815495][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.835187][ T5995] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.859297][ T5995] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 340.869880][ T5995] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 341.136691][T14540] batadv0: entered promiscuous mode [ 341.143745][T14540] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 341.412341][ T5951] usb 3-1: USB disconnect, device number 39 [ 341.901120][T14569] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3390'. [ 341.910314][T14569] netem: change failed [ 342.459523][ T5924] usb 4-1: USB disconnect, device number 48 [ 342.828275][T14585] netlink: 'syz.5.3396': attribute type 5 has an invalid length. [ 343.367583][T14608] team0: Port device team_slave_0 removed [ 343.415847][T14608] net_ratelimit: 16 callbacks suppressed [ 343.415862][T14608] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 343.669045][T14621] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 343.730937][T14621] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 344.253023][ T30] audit: type=1400 audit(1754320851.657:643): avc: denied { ioctl } for pid=14644 comm="syz.1.3421" path="socket:[51718]" dev="sockfs" ino=51718 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 344.284678][T14645] netlink: 'syz.1.3421': attribute type 2 has an invalid length. [ 345.165156][ T5951] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 345.338830][ T5951] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.350336][ T5951] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.373295][ T5951] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 345.392616][ T5951] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.409588][ T5951] usb 4-1: config 0 descriptor?? [ 345.765430][ T30] audit: type=1400 audit(1754320853.177:644): avc: denied { remount } for pid=14696 comm="syz.1.3442" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 346.024443][ T5951] usb 4-1: language id specifier not provided by device, defaulting to English [ 346.645818][ T5951] input: HID 256c:006d as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.002F/input/input45 [ 346.774388][ T5951] uclogic 0003:256C:006D.002F: input,hidraw0: USB HID v0.00 Device [HID 256c:006d] on usb-dummy_hcd.3-1/input0 [ 346.848080][ T5897] usb 4-1: USB disconnect, device number 49 [ 346.955306][ T5995] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 346.974229][T14730] fido_id[14730]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 347.115589][ T5995] usb 1-1: Using ep0 maxpacket: 8 [ 347.122167][ T5995] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 347.131358][ T5995] usb 1-1: config 0 has no interface number 0 [ 347.137967][ T5995] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 347.149373][ T5995] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 347.161481][ T5995] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 347.175120][ T5995] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 347.188735][ T5995] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 347.198843][ T5995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.215703][ T5995] usb 1-1: config 0 descriptor?? [ 347.234089][ T5995] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 347.434909][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 347.502796][ T5924] usb 1-1: USB disconnect, device number 38 [ 347.523916][ T5924] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 347.540371][T14754] comedi comedi3: s526: I/O port conflict (0x40404f26,64) [ 347.670771][T14760] evm: overlay not supported [ 348.180574][T14777] ref_ctr_offset mismatch. inode: 0xcc8 offset: 0x0 ref_ctr_offset(old): 0x200000000180 ref_ctr_offset(new): 0x0 [ 348.343939][T14787] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3478'. [ 348.546873][T14794] overlayfs: failed to clone upperpath [ 348.690993][T14804] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3486'. [ 349.916966][T14836] overlayfs: failed to clone upperpath [ 350.430921][T14854] gtp0: entered promiscuous mode [ 351.405029][T14873] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3511'. [ 352.069240][ T30] audit: type=1400 audit(1754320859.477:645): avc: denied { map } for pid=14896 comm="syz.2.3519" path="socket:[52476]" dev="sockfs" ino=52476 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 352.135846][T14905] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3522'. [ 352.217778][T14906] sch_tbf: burst 88 is lower than device veth1 mtu (1514) ! [ 352.395846][T14919] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3528'. [ 352.663529][T14934] netlink: 'syz.2.3533': attribute type 1 has an invalid length. [ 352.717938][T14934] 8021q: adding VLAN 0 to HW filter on device bond1 [ 352.752875][T14936] bond1: (slave veth5): Enslaving as an active interface with a down link [ 352.931935][T14946] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3540'. [ 352.939958][T14934] bond1: (slave dummy0): making interface the new active one [ 352.963735][T14934] dummy0: entered promiscuous mode [ 352.987120][T14934] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 353.556848][T14978] netlink: 'syz.5.3552': attribute type 1 has an invalid length. [ 353.622011][T14976] syzkaller0: entered promiscuous mode [ 353.633754][T14976] syzkaller0: entered allmulticast mode [ 353.718643][T14978] 8021q: adding VLAN 0 to HW filter on device bond1 [ 353.767292][T14982] bond1: (slave veth3): Enslaving as an active interface with a down link [ 353.779960][ T30] audit: type=1400 audit(1754320861.187:646): avc: denied { remount } for pid=14986 comm="syz.0.3554" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 353.849514][T14985] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 353.857305][T14985] bond1: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 354.319241][T14996] overlayfs: failed to clone upperpath [ 354.818864][T15018] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3564'. [ 356.355084][T15033] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.373172][T15033] bridge_slave_1: left allmulticast mode [ 356.382427][T15033] bridge_slave_1: left promiscuous mode [ 356.391094][T15033] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.426695][T15033] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 357.429087][ T5890] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 357.429087][ T5995] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 357.602035][ T5890] usb 3-1: Using ep0 maxpacket: 32 [ 357.616653][ T5995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 357.628171][ T5995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 357.631143][ T5890] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 357.662863][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.682766][ T5995] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 357.683447][ T5890] usb 3-1: config 0 descriptor?? [ 357.708803][ T5995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.713733][ T5890] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 357.763087][ T5995] usb 1-1: config 0 descriptor?? [ 358.180191][ T5995] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 358.192004][ T5995] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 358.200305][ T5995] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 358.208644][ T5995] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 358.216724][ T5995] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 358.228433][ T5995] playstation 0003:054C:0DF2.0030: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 358.503666][T15093] overlayfs: failed to clone upperpath [ 358.552247][T15095] netlink: 'syz.1.3592': attribute type 1 has an invalid length. [ 358.596289][ T5995] playstation 0003:054C:0DF2.0030: Failed to retrieve feature with reportID 32: -71 [ 358.641302][ T5995] playstation 0003:054C:0DF2.0030: Failed to retrieve DualSense firmware info: -71 [ 358.658191][T15095] 8021q: adding VLAN 0 to HW filter on device bond2 [ 358.701839][ T5995] playstation 0003:054C:0DF2.0030: Failed to get firmware info from DualSense [ 358.729493][ T5995] playstation 0003:054C:0DF2.0030: Failed to create dualsense. [ 358.749347][ T5995] playstation 0003:054C:0DF2.0030: probe with driver playstation failed with error -71 [ 358.763291][T15097] 8021q: adding VLAN 0 to HW filter on device bond2 [ 358.771631][T15097] bond2: (slave vti1): The slave device specified does not support setting the MAC address [ 358.780856][ T5995] usb 1-1: USB disconnect, device number 39 [ 358.783276][T15097] bond2: (slave vti1): Error -95 calling set_mac_address [ 359.328622][ T5890] gspca_nw80x: reg_w err -71 [ 359.353671][ T5890] nw80x 3-1:0.0: probe with driver nw80x failed with error -71 [ 359.374092][ T5890] usb 3-1: USB disconnect, device number 40 [ 359.960428][ T30] audit: type=1400 audit(1754320867.357:647): avc: denied { view } for pid=15143 comm="syz.2.3611" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 360.198117][T15152] syz.3.3612: attempt to access beyond end of device [ 360.198117][T15152] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 360.235662][ T5995] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 360.252951][T15152] syz.3.3612: attempt to access beyond end of device [ 360.252951][T15152] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 360.279205][ T30] audit: type=1326 audit(1754320867.687:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15139 comm="syz.1.3609" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f073ef8eb69 code=0x0 [ 360.280840][T15152] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 360.316096][T15152] ------------[ cut here ]------------ [ 360.321593][T15152] WARNING: CPU: 1 PID: 15152 at fs/buffer.c:1125 __getblk_slow+0x4cc/0x560 [ 360.331213][T15152] Modules linked in: [ 360.336147][T15152] CPU: 1 UID: 0 PID: 15152 Comm: syz.3.3612 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 360.348136][T15152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 360.358289][T15152] RIP: 0010:__getblk_slow+0x4cc/0x560 [ 360.363685][T15152] Code: c0 8b 48 89 df e8 f4 e3 bb ff 90 0f 0b e8 6c 39 73 ff 48 c7 c6 e0 5d c0 8b 48 89 df e8 dd e3 bb ff 90 0f 0b e8 55 39 73 ff 90 <0f> 0b 90 8b 74 24 0c 89 ea 48 c7 c7 40 5f c0 8b 31 db e8 9d e4 51 [ 360.383386][T15152] RSP: 0018:ffffc900054577f0 EFLAGS: 00010246 [ 360.389507][T15152] RAX: 0000000000080000 RBX: 0000000000000200 RCX: ffffc90013dd9000 [ 360.397554][T15152] RDX: 0000000000080000 RSI: ffffffff8248591b RDI: 0000000000000005 [ 360.398487][ T5995] usb 3-1: Using ep0 maxpacket: 8 [ 360.405570][T15152] RBP: 0000000000000400 R08: 0000000000000005 R09: 0000000000000000 [ 360.405589][T15152] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888024235c00 [ 360.405601][T15152] R13: 0000000000000200 R14: 0000000000000200 R15: ffff888024235c00 [ 360.405613][T15152] FS: 00007f0314bef6c0(0000) GS:ffff8881247c6000(0000) knlGS:0000000000000000 [ 360.405632][T15152] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 360.405644][T15152] CR2: 00007f417e325d70 CR3: 00000000589fc000 CR4: 00000000003526f0 [ 360.405656][T15152] DR0: 0000000000000002 DR1: 0000000000000002 DR2: 0000000000000008 [ 360.405667][T15152] DR3: 1000000100000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 360.405680][T15152] Call Trace: [ 360.405689][T15152] [ 360.405699][T15152] ? __pfx___might_resched+0x10/0x10 [ 360.405734][T15152] bdev_getblk+0xd4/0xe0 [ 360.405764][T15152] __bread_gfp+0x86/0x3c0 [ 360.405792][T15152] udf_read_tagged+0xae/0x740 [ 360.405822][T15152] udf_check_anchor_block+0x89/0x4b0 [ 360.405845][T15152] ? udf_get_last_block+0x1ce/0x2a0 [ 360.405873][T15152] ? __pfx_udf_check_anchor_block+0x10/0x10 [ 360.405904][T15152] udf_load_vrs+0x682/0x1070 [ 360.405934][T15152] ? __pfx_udf_load_vrs+0x10/0x10 [ 360.405957][T15152] ? __pfx_udf_get_last_session+0x10/0x10 [ 360.405986][T15152] ? lockdep_init_map_type+0x5c/0x280 [ 360.406008][T15152] udf_fill_super+0x791/0x1df0 [ 360.406033][T15152] ? __pfx_udf_fill_super+0x10/0x10 [ 360.406053][T15152] ? do_raw_spin_lock+0x12c/0x2b0 [ 360.406073][T15152] ? find_held_lock+0x2b/0x80 [ 360.406101][T15152] ? sb_set_blocksize+0x176/0x1d0 [ 360.406125][T15152] ? setup_bdev_super+0x369/0x730 [ 360.406156][T15152] get_tree_bdev_flags+0x389/0x620 [ 360.406174][T15152] ? __pfx_udf_fill_super+0x10/0x10 [ 360.406194][T15152] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 360.406218][T15152] ? bpf_lsm_capable+0x9/0x10 [ 360.406243][T15152] ? security_capable+0x7e/0x260 [ 360.406263][T15152] vfs_get_tree+0x8e/0x340 [ 360.406289][T15152] path_mount+0x1482/0x1fd0 [ 360.406322][T15152] ? __pfx_path_mount+0x10/0x10 [ 360.406348][T15152] ? kmem_cache_free+0x2d1/0x4d0 [ 360.406366][T15152] ? putname+0x154/0x1a0 [ 360.435714][ T5995] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 360.436704][T15152] ? putname+0x154/0x1a0 [ 360.450100][ T5995] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 360.451786][T15152] ? __x64_sys_mount+0x28d/0x310 [ 360.505264][ T5995] usb 3-1: Product: syz [ 360.505937][T15152] __x64_sys_mount+0x28d/0x310 [ 360.530769][ T5995] usb 3-1: Manufacturer: syz [ 360.532949][T15152] ? __pfx___x64_sys_mount+0x10/0x10 [ 360.532991][T15152] do_syscall_64+0xcd/0x4c0 [ 360.562346][ T5995] usb 3-1: SerialNumber: syz [ 360.563802][T15152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.563830][T15152] RIP: 0033:0x7f0313d8eb69 [ 360.683439][T15152] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 360.703128][T15152] RSP: 002b:00007f0314bef038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 360.711644][T15152] RAX: ffffffffffffffda RBX: 00007f0313fb6160 RCX: 00007f0313d8eb69 [ 360.720008][T15152] RDX: 0000200000000080 RSI: 0000200000004a00 RDI: 0000200000000000 [ 360.728061][T15152] RBP: 00007f0313e11df1 R08: 0000000000000000 R09: 0000000000000000 [ 360.736692][T15152] R10: 0000000000000014 R11: 0000000000000246 R12: 0000000000000000 [ 360.745237][T15152] R13: 0000000000000001 R14: 00007f0313fb6160 R15: 00007ffccd9d0cf8 [ 360.753267][T15152] [ 360.756380][T15152] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 360.763657][T15152] CPU: 1 UID: 0 PID: 15152 Comm: syz.3.3612 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 360.775355][T15152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 360.785397][T15152] Call Trace: [ 360.788659][T15152] [ 360.791569][T15152] dump_stack_lvl+0x3d/0x1f0 [ 360.796164][T15152] vpanic+0x6e8/0x7a0 [ 360.800150][T15152] ? __pfx_vpanic+0x10/0x10 [ 360.804663][T15152] ? __getblk_slow+0x4cc/0x560 [ 360.809437][T15152] panic+0xca/0xd0 [ 360.813164][T15152] ? __pfx_panic+0x10/0x10 [ 360.817581][T15152] check_panic_on_warn+0xab/0xb0 [ 360.822512][T15152] __warn+0xf6/0x3c0 [ 360.826386][T15152] ? __getblk_slow+0x4cc/0x560 [ 360.831150][T15152] report_bug+0x3c3/0x580 [ 360.835467][T15152] ? __getblk_slow+0x4cc/0x560 [ 360.840233][T15152] handle_bug+0x184/0x210 [ 360.844546][T15152] exc_invalid_op+0x17/0x50 [ 360.849033][T15152] asm_exc_invalid_op+0x1a/0x20 [ 360.853862][T15152] RIP: 0010:__getblk_slow+0x4cc/0x560 [ 360.859225][T15152] Code: c0 8b 48 89 df e8 f4 e3 bb ff 90 0f 0b e8 6c 39 73 ff 48 c7 c6 e0 5d c0 8b 48 89 df e8 dd e3 bb ff 90 0f 0b e8 55 39 73 ff 90 <0f> 0b 90 8b 74 24 0c 89 ea 48 c7 c7 40 5f c0 8b 31 db e8 9d e4 51 [ 360.878814][T15152] RSP: 0018:ffffc900054577f0 EFLAGS: 00010246 [ 360.884873][T15152] RAX: 0000000000080000 RBX: 0000000000000200 RCX: ffffc90013dd9000 [ 360.892827][T15152] RDX: 0000000000080000 RSI: ffffffff8248591b RDI: 0000000000000005 [ 360.900776][T15152] RBP: 0000000000000400 R08: 0000000000000005 R09: 0000000000000000 [ 360.908725][T15152] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888024235c00 [ 360.916674][T15152] R13: 0000000000000200 R14: 0000000000000200 R15: ffff888024235c00 [ 360.924644][T15152] ? __getblk_slow+0x4cb/0x560 [ 360.929446][T15152] ? __pfx___might_resched+0x10/0x10 [ 360.934735][T15152] bdev_getblk+0xd4/0xe0 [ 360.938978][T15152] __bread_gfp+0x86/0x3c0 [ 360.943298][T15152] udf_read_tagged+0xae/0x740 [ 360.947964][T15152] udf_check_anchor_block+0x89/0x4b0 [ 360.953245][T15152] ? udf_get_last_block+0x1ce/0x2a0 [ 360.958449][T15152] ? __pfx_udf_check_anchor_block+0x10/0x10 [ 360.964346][T15152] udf_load_vrs+0x682/0x1070 [ 360.968949][T15152] ? __pfx_udf_load_vrs+0x10/0x10 [ 360.973963][T15152] ? __pfx_udf_get_last_session+0x10/0x10 [ 360.979671][T15152] ? lockdep_init_map_type+0x5c/0x280 [ 360.985053][T15152] udf_fill_super+0x791/0x1df0 [ 360.989833][T15152] ? __pfx_udf_fill_super+0x10/0x10 [ 360.995025][T15152] ? do_raw_spin_lock+0x12c/0x2b0 [ 361.000049][T15152] ? find_held_lock+0x2b/0x80 [ 361.004726][T15152] ? sb_set_blocksize+0x176/0x1d0 [ 361.009744][T15152] ? setup_bdev_super+0x369/0x730 [ 361.014760][T15152] get_tree_bdev_flags+0x389/0x620 [ 361.019856][T15152] ? __pfx_udf_fill_super+0x10/0x10 [ 361.025051][T15152] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 361.030674][T15152] ? bpf_lsm_capable+0x9/0x10 [ 361.035340][T15152] ? security_capable+0x7e/0x260 [ 361.040267][T15152] vfs_get_tree+0x8e/0x340 [ 361.044678][T15152] path_mount+0x1482/0x1fd0 [ 361.049178][T15152] ? __pfx_path_mount+0x10/0x10 [ 361.054033][T15152] ? kmem_cache_free+0x2d1/0x4d0 [ 361.058953][T15152] ? putname+0x154/0x1a0 [ 361.063183][T15152] ? putname+0x154/0x1a0 [ 361.067414][T15152] ? __x64_sys_mount+0x28d/0x310 [ 361.072333][T15152] __x64_sys_mount+0x28d/0x310 [ 361.077107][T15152] ? __pfx___x64_sys_mount+0x10/0x10 [ 361.082385][T15152] do_syscall_64+0xcd/0x4c0 [ 361.086879][T15152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 361.092755][T15152] RIP: 0033:0x7f0313d8eb69 [ 361.097151][T15152] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 361.116742][T15152] RSP: 002b:00007f0314bef038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 361.125145][T15152] RAX: ffffffffffffffda RBX: 00007f0313fb6160 RCX: 00007f0313d8eb69 [ 361.133096][T15152] RDX: 0000200000000080 RSI: 0000200000004a00 RDI: 0000200000000000 [ 361.141068][T15152] RBP: 00007f0313e11df1 R08: 0000000000000000 R09: 0000000000000000 [ 361.149024][T15152] R10: 0000000000000014 R11: 0000000000000246 R12: 0000000000000000 [ 361.156973][T15152] R13: 0000000000000001 R14: 00007f0313fb6160 R15: 00007ffccd9d0cf8 [ 361.164937][T15152] [ 361.168151][T15152] Kernel Offset: disabled [ 361.172463][T15152] Rebooting in 86400 seconds..