last executing test programs: 2.77238407s ago: executing program 0 (id=1): r0 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={&(0x7f0000001000), 0x1000}, &(0x7f0000000300)={&(0x7f0000002000), 0x1000, 0x1}}, 0x1) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r0, 0x24, &(0x7f0000000400), 0x0) 2.628893163s ago: executing program 1 (id=2): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766574683000"/56], 0x38}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}}, {0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}}, r2, 0x7}}, 0x48) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000200)={0x6, 0x118, 0xfa00, {{}, r2}}, 0x120) 2.521787151s ago: executing program 0 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x0, 0x0, 0x40, "0100"/64}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/lirc0\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)="0100000002000000", 0x8) 2.333426109s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='tcp 2049\n\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='1\n\x00', 0x2) (async) r3 = fsopen(&(0x7f0000000180)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000300)='clientaddr\x00', &(0x7f0000000340)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000380)='vers\x00', &(0x7f00000003c0)='4.2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000400)='addr\x00', &(0x7f0000000440)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) 1.957693857s ago: executing program 2 (id=3): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000000314050000000000000000000900020073797a300000000008004100727865000a0033007665746830000000"], 0x30}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4d2, @dev={0xac, 0x14, 0x14, 0xaa}}, 0x10) listen(r1, 0x1) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000200)={0x2, 0x4d2, @dev={0xac, 0x14, 0x14, 0xaa}}, 0x10) close(r2) close(r1) 1.72235686s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='2049\n\x00', 0x5) 1.661343631s ago: executing program 2 (id=7): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085"}}, 0x13f) read(r0, &(0x7f0000001000), 0x111c) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) 1.63450277s ago: executing program 1 (id=8): mkdirat(0xffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='zstd\x00', 0x4) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) read(r0, &(0x7f0000000000), 0x10000) r1 = eventfd(0x11111111) r2 = eventfd(0x22222222) read(r1, &(0x7f0000000008), 0x8) read(r2, &(0x7f0000000010), 0x8) madvise(&(0x7f0000000000/0x10000)=nil, 0x10000, 0x15) 1.503900879s ago: executing program 1 (id=9): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000000)={0x0, 0x2faf080}, 0x0) read(r0, &(0x7f0000000100)=""/1, 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000180), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000001c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0xfa}, 0x2) 733.07926ms ago: executing program 2 (id=10): openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/subsystems/testnqn/attr_qid_max\x00', 0x2, 0x0) 732.253024ms ago: executing program 2 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000040)='disk', 0x4) 535.993406ms ago: executing program 1 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='loop\x00', 0x4) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/testnqn\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/subsystems/testnqn/attr_qid_max\x00', 0x2, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) r3 = syz_io_uring_setup(0x10, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000700)=@IORING_OP_WRITEV={0x2, 0x10, 0x0, @fd=r2, 0x0, &(0x7f0000000800)=[{&(0x7f0000000940)='transport=loop,nqn=testnqn,nr_io_queues=128\x00', 0x2b}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000000b00)) write(r1, &(0x7f0000000c00)='1\x00', 0x1) 481.774266ms ago: executing program 3 (id=13): r0 = memfd_create(&(0x7f0000000100)='img\x00', 0x0) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='/dev/loop0,65536\x00', 0x11) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000600), 0x1, 0x2) ioctl$MEMERASE(r3, 0x40084d02, &(0x7f0000000640)={0x0, 0x1000000}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl(r4, 0x40186f40, &(0x7f00000001c0)="000000000100"/24) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/ubi0\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff) mount(&(0x7f0000000540)=@filename='ubi0_0\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000580)='ubifs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./mnt/test\x00', 0x42, 0x1ff) 389.857416ms ago: executing program 4 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000640)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='tcp 2049\n\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='1\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000540)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./export\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='mydomain /export 2147483647 8192 0 0 0\n\x00', 0x27) 265.027731ms ago: executing program 1 (id=15): r0 = timerfd_create(0x9, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{}, {0x2}}, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/power/state\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='mem\x00', 0x3) 135.991048ms ago: executing program 1 (id=16): r0 = syz_usb_connect(0x2, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000008109720770001000000010902350001010080fa0904000005ff00000007058102400000070501024000000705820240000007050202400000070583030200ff"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00000) openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x802, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000200)="01020304050607") 47.623816ms ago: executing program 3 (id=17): mount(&(0x7f0000000040)=@filename='\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) 0s ago: executing program 3 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) ftruncate(r1, 0x1000000) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000480)='./backing_file\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000500)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r5, &(0x7f0000000680)='loop\x00', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write(r6, &(0x7f0000000780)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000840)='./sys\x00', &(0x7f0000000880)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/class/nvme/nvme0/nvme0n1/wwid\x00', 0x0, 0x0) read(r7, &(0x7f0000000900), 0x64) r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/nvme/nvme1/nvme1n1/wwid\x00', 0x0, 0x0) read(r8, &(0x7f0000000980), 0x64) kernel console output (not intermixed with test programs): [ 54.325023][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 54.325037][ T30] audit: type=1400 audit(1785856612.400:119): avc: denied { write } for pid=5514 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.368781][ T30] audit: type=1400 audit(1785856612.440:120): avc: denied { write } for pid=5525 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.540436][ T30] audit: type=1400 audit(1785856612.610:121): avc: denied { write } for pid=5528 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.591293][ T30] audit: type=1400 audit(1785856612.660:122): avc: denied { write } for pid=5539 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.759786][ T30] audit: type=1400 audit(1785856612.830:123): avc: denied { write } for pid=5542 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.801292][ T30] audit: type=1400 audit(1785856612.870:124): avc: denied { write } for pid=5553 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.968494][ T30] audit: type=1400 audit(1785856613.040:125): avc: denied { write } for pid=5556 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.020246][ T30] audit: type=1400 audit(1785856613.090:126): avc: denied { write } for pid=5567 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.191230][ T30] audit: type=1400 audit(1785856613.260:127): avc: denied { write } for pid=5571 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.237529][ T30] audit: type=1400 audit(1785856613.310:128): avc: denied { write } for pid=5582 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.8' (ED25519) to the list of known hosts. [ 60.429325][ T30] audit: type=1400 audit(1785856618.500:129): avc: denied { mounton } for pid=5593 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 60.453347][ T30] audit: type=1400 audit(1785856618.530:130): avc: denied { mount } for pid=5593 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 60.456112][ T5593] cgroup: Unknown subsys name 'net' [ 60.483795][ T30] audit: type=1400 audit(1785856618.560:131): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 60.634474][ T5593] cgroup: Unknown subsys name 'cpuset' [ 60.641944][ T5593] cgroup: Unknown subsys name 'rlimit' [ 60.750286][ T30] audit: type=1400 audit(1785856618.820:132): avc: denied { setattr } for pid=5593 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 60.784910][ T30] audit: type=1400 audit(1785856618.820:133): avc: denied { create } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.812666][ T30] audit: type=1400 audit(1785856618.820:134): avc: denied { write } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.833580][ T30] audit: type=1400 audit(1785856618.820:135): avc: denied { read } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.859464][ T30] audit: type=1400 audit(1785856618.820:136): avc: denied { mounton } for pid=5593 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 60.869438][ T5595] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 60.888357][ T30] audit: type=1400 audit(1785856618.820:137): avc: denied { mount } for pid=5593 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 60.916309][ T30] audit: type=1400 audit(1785856618.970:138): avc: denied { relabelto } for pid=5595 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 61.837957][ T5593] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.860886][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 63.869615][ T5616] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 63.877533][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 63.878068][ T5616] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 63.885820][ T5621] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 63.894628][ T5616] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 63.906016][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 63.914325][ T5623] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 63.914679][ T5616] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 63.922024][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 63.930531][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 63.936937][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 63.943212][ T5616] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 63.957418][ T5623] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 63.958066][ T5616] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 63.965960][ T5623] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 63.972812][ T5616] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 63.980350][ T5623] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.987359][ T5616] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 63.995688][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.002347][ T5616] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.006868][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 64.020489][ T5616] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.021491][ T5616] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.035677][ T5616] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.230243][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.237825][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.245031][ T5608] bridge_slave_0: entered allmulticast mode [ 65.251709][ T5608] bridge_slave_0: entered promiscuous mode [ 65.279033][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.286255][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.293446][ T5608] bridge_slave_1: entered allmulticast mode [ 65.300306][ T5608] bridge_slave_1: entered promiscuous mode [ 65.368528][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.377789][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.385488][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.392737][ T5605] bridge_slave_0: entered allmulticast mode [ 65.399364][ T5605] bridge_slave_0: entered promiscuous mode [ 65.422806][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.432098][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.439227][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.446552][ T5605] bridge_slave_1: entered allmulticast mode [ 65.453446][ T5605] bridge_slave_1: entered promiscuous mode [ 65.488450][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.495702][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.503046][ T5611] bridge_slave_0: entered allmulticast mode [ 65.509657][ T5611] bridge_slave_0: entered promiscuous mode [ 65.516562][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.524277][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.531407][ T5606] bridge_slave_0: entered allmulticast mode [ 65.538245][ T5606] bridge_slave_0: entered promiscuous mode [ 65.561389][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.568571][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.575943][ T5611] bridge_slave_1: entered allmulticast mode [ 65.582739][ T5611] bridge_slave_1: entered promiscuous mode [ 65.589334][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.596456][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.603600][ T5606] bridge_slave_1: entered allmulticast mode [ 65.610213][ T5606] bridge_slave_1: entered promiscuous mode [ 65.624167][ T5608] team0: Port device team_slave_0 added [ 65.632116][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.660973][ T5608] team0: Port device team_slave_1 added [ 65.668322][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.690574][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.697898][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.705114][ T5607] bridge_slave_0: entered allmulticast mode [ 65.711791][ T5607] bridge_slave_0: entered promiscuous mode [ 65.733060][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.744030][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.756061][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.765225][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.772988][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.780176][ T5607] bridge_slave_1: entered allmulticast mode [ 65.786965][ T5607] bridge_slave_1: entered promiscuous mode [ 65.806941][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.818363][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.826707][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.841118][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.848298][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.874418][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.887263][ T5605] team0: Port device team_slave_0 added [ 65.912664][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.919630][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.945686][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.961051][ T5605] team0: Port device team_slave_1 added [ 65.968106][ T5611] team0: Port device team_slave_0 added [ 65.975025][ T5606] team0: Port device team_slave_0 added [ 65.982651][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.003894][ T5611] team0: Port device team_slave_1 added [ 66.010860][ T5606] team0: Port device team_slave_1 added [ 66.023830][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.052844][ T50] Bluetooth: hci1: command tx timeout [ 66.052946][ T4925] Bluetooth: hci2: command tx timeout [ 66.064725][ T5616] Bluetooth: hci4: command tx timeout [ 66.076503][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.083519][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.109410][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.127229][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.134511][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.161200][ T5616] Bluetooth: hci0: command tx timeout [ 66.161213][ T4925] Bluetooth: hci3: command tx timeout [ 66.161386][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.183497][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.190449][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.219327][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.236578][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.243575][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.269492][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.281577][ T5607] team0: Port device team_slave_0 added [ 66.289222][ T5607] team0: Port device team_slave_1 added [ 66.295241][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.302181][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.328070][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.339943][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.347000][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.373005][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.412768][ T5608] hsr_slave_0: entered promiscuous mode [ 66.418855][ T5608] hsr_slave_1: entered promiscuous mode [ 66.434605][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.441560][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.468304][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.480432][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.487389][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.513796][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.606094][ T5606] hsr_slave_0: entered promiscuous mode [ 66.612771][ T5606] hsr_slave_1: entered promiscuous mode [ 66.618985][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 66.625021][ T5606] Cannot create hsr debugfs directory [ 66.644770][ T5605] hsr_slave_0: entered promiscuous mode [ 66.650787][ T5605] hsr_slave_1: entered promiscuous mode [ 66.657097][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 66.662862][ T5605] Cannot create hsr debugfs directory [ 66.672556][ T5611] hsr_slave_0: entered promiscuous mode [ 66.678642][ T5611] hsr_slave_1: entered promiscuous mode [ 66.684645][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 66.690364][ T5611] Cannot create hsr debugfs directory [ 66.700728][ T5607] hsr_slave_0: entered promiscuous mode [ 66.706897][ T5607] hsr_slave_1: entered promiscuous mode [ 66.712993][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 66.718696][ T5607] Cannot create hsr debugfs directory [ 67.045298][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.056096][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.065746][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.075222][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.082950][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.091312][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.099412][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.108080][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.156944][ T5606] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.165978][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.174234][ T5606] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.183771][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.194954][ T5606] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.204038][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.217496][ T5606] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.226588][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.286497][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 67.295245][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.304048][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 67.313593][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.325734][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 67.334973][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.352327][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 67.360890][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.429079][ T5611] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.438881][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.446456][ T5611] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.454900][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.462797][ T5611] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.471221][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.479063][ T5611] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 67.488109][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.499706][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.561632][ T5605] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 67.570678][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.579666][ T5605] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 67.588797][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.596712][ T5605] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 67.605112][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.622903][ T5605] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 67.631294][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.645248][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.660904][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.681291][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.688588][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.707598][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.726726][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.733808][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.744333][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.751414][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.781884][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.788949][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.836248][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.879062][ T5608] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.899289][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.909676][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.931415][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.938542][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.966351][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.973488][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.013975][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.024311][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.050890][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.058022][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.079432][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.086570][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.127140][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.134086][ T5616] Bluetooth: hci1: command tx timeout [ 68.144355][ T4925] Bluetooth: hci2: command tx timeout [ 68.149969][ T5616] Bluetooth: hci4: command tx timeout [ 68.168243][ T731] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.175375][ T731] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.214283][ T5616] Bluetooth: hci3: command tx timeout [ 68.214487][ T4925] Bluetooth: hci0: command tx timeout [ 68.238791][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.245923][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.580862][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.710374][ T5608] veth0_vlan: entered promiscuous mode [ 68.771361][ T5608] veth1_vlan: entered promiscuous mode [ 68.799559][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.880644][ T5608] veth0_macvtap: entered promiscuous mode [ 68.910714][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.932332][ T5608] veth1_macvtap: entered promiscuous mode [ 69.005438][ T5606] veth0_vlan: entered promiscuous mode [ 69.017240][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.042379][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.071010][ T5606] veth1_vlan: entered promiscuous mode [ 69.104740][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.116722][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.147243][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.161848][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.177778][ T5607] veth0_vlan: entered promiscuous mode [ 69.200879][ T5606] veth0_macvtap: entered promiscuous mode [ 69.219750][ T5606] veth1_macvtap: entered promiscuous mode [ 69.230365][ T5607] veth1_vlan: entered promiscuous mode [ 69.243868][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.305184][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.347976][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.401433][ T5611] veth0_vlan: entered promiscuous mode [ 69.411436][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.423297][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.453554][ T5607] veth0_macvtap: entered promiscuous mode [ 69.480226][ T5607] veth1_macvtap: entered promiscuous mode [ 69.493500][ T3297] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.503167][ T5611] veth1_vlan: entered promiscuous mode [ 69.510253][ T3297] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.545238][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 69.545254][ T30] audit: type=1400 audit(1785856627.620:152): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.NPT6Q7/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 69.550571][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.562143][ T30] audit: type=1400 audit(1785856627.630:153): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 69.606148][ T5605] veth0_vlan: entered promiscuous mode [ 69.607429][ T30] audit: type=1400 audit(1785856627.630:154): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.NPT6Q7/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 69.619149][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.637896][ T30] audit: type=1400 audit(1785856627.630:155): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 69.668221][ T30] audit: type=1400 audit(1785856627.630:156): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.NPT6Q7/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 69.676826][ T731] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.695547][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.718329][ T30] audit: type=1400 audit(1785856627.630:157): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.NPT6Q7/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 69.748575][ T5605] veth1_vlan: entered promiscuous mode [ 69.760407][ T5608] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 69.767237][ T5611] veth0_macvtap: entered promiscuous mode [ 69.777984][ T731] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.789559][ T30] audit: type=1400 audit(1785856627.660:158): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 69.809280][ T30] audit: type=1400 audit(1785856627.730:159): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 69.833738][ T57] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.842907][ T30] audit: type=1400 audit(1785856627.730:160): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="gadgetfs" ino=7671 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 69.866909][ T3297] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.868209][ T30] audit: type=1400 audit(1785856627.730:161): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 69.877783][ T3297] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.923343][ T5611] veth1_macvtap: entered promiscuous mode [ 69.975820][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.025179][ T5605] veth0_macvtap: entered promiscuous mode [ 70.048196][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.064088][ T5605] veth1_macvtap: entered promiscuous mode [ 70.079042][ T731] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.088047][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.105323][ T731] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.122203][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.189829][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.201538][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.213161][ T4925] Bluetooth: hci4: command tx timeout [ 70.214152][ T5616] Bluetooth: hci1: command tx timeout [ 70.218952][ T4925] Bluetooth: hci2: command tx timeout [ 70.237868][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.263697][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.285995][ T5794] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 70.301218][ T4925] Bluetooth: hci0: command tx timeout [ 70.302879][ T4925] Bluetooth: hci3: command tx timeout [ 70.309019][ T5794] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 70.341161][ T5794] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 70.381231][ T5794] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 70.402290][ T5794] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 70.440929][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.469937][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.482578][ T57] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.522346][ T5790] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 70.581197][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.596774][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.623347][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.644239][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.651890][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.670266][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.703079][ T5790] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 70.724663][ T5790] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 70.745098][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.749490][ T5790] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 70.765017][ T731] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.777456][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.787431][ T5790] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 70.790045][ T731] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.799041][ T5790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.829565][ T5790] usb 1-1: Product: syz [ 70.834389][ T5790] usb 1-1: Manufacturer: syz [ 70.839362][ T5790] usb 1-1: SerialNumber: syz [ 70.854387][ T731] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.867686][ T731] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.871730][ T5796] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.879067][ T731] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.885261][ T5796] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.895464][ T731] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.905303][ T5796] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.920125][ T731] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.930000][ T731] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.931455][ T5807] rdma_rxe: rxe_newlink: failed to add veth0 [ 70.947946][ T731] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.957470][ T731] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.114699][ T5614] logitech-hidpp-device 0005:046D:B012.0001: item fetching failed at offset 38/39 [ 71.134348][ T5614] logitech-hidpp-device 0005:046D:B012.0001: hidpp_probe:parse failed [ 71.150166][ T5614] logitech-hidpp-device 0005:046D:B012.0001: probe with driver logitech-hidpp-device failed with error -22 [ 71.822240][ T5803] NFSD: Unable to initialize client recovery tracking! (-110) [ 71.831866][ T5803] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 71.841213][ T5803] NFSD: starting 90-second grace period (net f00005dc) [ 72.003414][ T5825] PM: hibernation: hibernation entry [ 72.141640][ T5790] redrat3 1-1:1.0: Firmware rev: [ 72.221201][ T48] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:08cee30d-6497-4593-933b-7c71d018aaf5 for subsystem testnqn not allowed [ 72.258915][ T5828] nvme nvme0: Connect for subsystem testnqn is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:08cee30d-6497-4593-933b-7c71d018aaf5 [ 72.294355][ T4925] Bluetooth: hci2: command tx timeout [ 72.303943][ T4925] Bluetooth: hci4: command tx timeout [ 72.344961][ T5790] redrat3 1-1:1.0: Failed to read timeout from hardware [ 72.364226][ T5832] loop0: detected capacity change from 0 to 32768 [ 72.373168][ T4925] Bluetooth: hci3: command tx timeout [ 72.373433][ T50] Bluetooth: hci0: command tx timeout [ 72.424586][ T5790] rc_core: IR keymap rc-hauppauge not found [ 72.456882][ T5790] Registered IR keymap rc-empty [ 72.484766][ T5837] PM: suspend entry (deep) [ 72.501447][ T5837] PM: suspend exit [ 72.552780][ T5790] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 72.573459][ T5790] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input9 [ 72.630389][ T5832] UBIFS error (pid: 5832): cannot open "ubi0_0", error -19 [ 72.731147][ T5845] nvmet: adding nsid 1 to subsystem testnqn [ 72.758218][ T5845] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 72.796615][ T13] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:08cee30d-6497-4593-933b-7c71d018aaf5. [ 72.802059][ T5614] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 72.817030][ T5845] nvme nvme0: creating 1 I/O queues. [ 72.827203][ T5845] nvme nvme0: new ctrl: "testnqn" [ 72.833249][ T5825] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 72.842078][ T5825] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 72.858852][ T5825] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 72.869999][ T5825] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 72.878735][ T5825] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 72.887414][ T5825] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 72.900530][ T5825] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 72.914140][ T5825] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 72.927447][ T5825] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 72.938219][ T5825] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 72.946588][ T5825] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 72.958828][ T5790] redrat3 1-1:1.0: redrat3_enable_detector: detector status: 0, should be 1 [ 72.977381][ T5790] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 72.986874][ T5825] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 73.005776][ T5825] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 73.006831][ T5598] ================================================================== [ 73.011826][ T5825] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 73.019761][ T5598] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 73.019785][ T5598] Read of size 1 at addr ffff8880536c6758 by task udevd/5598 [ 73.019798][ T5598] [ 73.019806][ T5598] CPU: 0 UID: 0 PID: 5598 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 73.019824][ T5598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 73.019833][ T5598] Call Trace: [ 73.019838][ T5598] [ 73.019844][ T5598] dump_stack_lvl+0x100/0x190 [ 73.019866][ T5598] print_report+0x13d/0x4b0 [ 73.019889][ T5598] ? __virt_addr_valid+0x239/0x430 [ 73.019910][ T5598] ? string+0x471/0x4d0 [ 73.019925][ T5598] kasan_report+0xdf/0x1c0 [ 73.019947][ T5598] ? string+0x471/0x4d0 [ 73.019965][ T5598] string+0x471/0x4d0 [ 73.019981][ T5598] ? __pfx_string+0x10/0x10 [ 73.019998][ T5598] ? __lock_acquire+0x49f/0x1a40 [ 73.020018][ T5598] ? kasan_save_stack+0x3f/0x50 [ 73.020038][ T5598] vsnprintf+0x422/0x1300 [ 73.020059][ T5598] ? __pfx_vsnprintf+0x10/0x10 [ 73.020086][ T5598] vscnprintf+0x40/0x90 [ 73.020103][ T5598] sysfs_emit+0x165/0x180 [ 73.020125][ T5598] ? __pfx_sysfs_emit+0x10/0x10 [ 73.020149][ T5598] ? find_held_lock+0x2b/0x80 [ 73.020162][ T5598] ? sysfs_file_kobj+0xe4/0x290 [ 73.020185][ T5598] ? __pfx_input_dev_show_name+0x10/0x10 [ 73.020207][ T5598] input_dev_show_name+0x5b/0x70 [ 73.020228][ T5598] dev_attr_show+0x52/0xa0 [ 73.020253][ T5598] ? __pfx_dev_attr_show+0x10/0x10 [ 73.020277][ T5598] sysfs_kf_seq_show+0x217/0x3f0 [ 73.020304][ T5598] seq_read_iter+0x32f/0x1270 [ 73.020324][ T5598] kernfs_fop_read_iter+0x46c/0x610 [ 73.020342][ T5598] ? rw_verify_area+0xce/0x6d0 [ 73.020360][ T5598] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 73.020383][ T5598] vfs_read+0x82e/0xb40 [ 73.020408][ T5598] ? __pfx_vfs_read+0x10/0x10 [ 73.020433][ T5598] ? __pfx_do_sys_openat2+0x10/0x10 [ 73.020457][ T5598] ksys_read+0x12a/0x250 [ 73.020479][ T5598] ? __pfx_ksys_read+0x10/0x10 [ 73.020506][ T5598] do_syscall_64+0x115/0x870 [ 73.020525][ T5598] ? clear_bhb_loop+0x40/0x90 [ 73.020542][ T5598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.020557][ T5598] RIP: 0033:0x7f089c8a7407 [ 73.020570][ T5598] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 73.020585][ T5598] RSP: 002b:00007ffd9456a1f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 73.020600][ T5598] RAX: ffffffffffffffda RBX: 00007f089cf6f880 RCX: 00007f089c8a7407 [ 73.020610][ T5598] RDX: 0000000000001000 RSI: 00007ffd9456a6d0 RDI: 0000000000000008 [ 73.020620][ T5598] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 73.020628][ T5598] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a6229445d0 [ 73.020637][ T5598] R13: 00007ffd9456a2d0 R14: 00007ffd9456a6d0 R15: 000055a5eb392bcc [ 73.020651][ T5598] [ 73.020656][ T5598] [ 73.304926][ T5598] Allocated by task 5790: [ 73.309230][ T5598] kasan_save_stack+0x30/0x50 [ 73.313903][ T5598] kasan_save_track+0x14/0x30 [ 73.318577][ T5598] __kasan_kmalloc+0xaa/0xb0 [ 73.323155][ T5598] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 73.328520][ T5598] redrat3_dev_probe+0x326/0x2b50 [ 73.333538][ T5598] usb_probe_interface+0x303/0x8f0 [ 73.338643][ T5598] really_probe+0x241/0xa60 [ 73.343132][ T5598] __driver_probe_device+0x20e/0x450 [ 73.348418][ T5598] driver_probe_device+0x4a/0x140 [ 73.353430][ T5598] __device_attach_driver+0x1df/0x320 [ 73.358783][ T5598] bus_for_each_drv+0x159/0x1e0 [ 73.363609][ T5598] __device_attach+0x1e4/0x4d0 [ 73.368354][ T5598] device_initial_probe+0xaf/0xd0 [ 73.373363][ T5598] bus_probe_device+0x64/0x160 [ 73.378105][ T5598] device_add+0x121d/0x1970 [ 73.382588][ T5598] usb_set_configuration+0xd97/0x1c60 [ 73.387942][ T5598] usb_generic_driver_probe+0xa1/0xe0 [ 73.393290][ T5598] usb_probe_device+0xef/0x400 [ 73.398049][ T5598] really_probe+0x241/0xa60 [ 73.402535][ T5598] __driver_probe_device+0x20e/0x450 [ 73.407817][ T5598] driver_probe_device+0x4a/0x140 [ 73.412824][ T5598] __device_attach_driver+0x1df/0x320 [ 73.418180][ T5598] bus_for_each_drv+0x159/0x1e0 [ 73.423008][ T5598] __device_attach+0x1e4/0x4d0 [ 73.427758][ T5598] device_initial_probe+0xaf/0xd0 [ 73.432776][ T5598] bus_probe_device+0x64/0x160 [ 73.437528][ T5598] device_add+0x121d/0x1970 [ 73.442028][ T5598] usb_new_device.cold+0x685/0x115c [ 73.447211][ T5598] hub_event+0x30a3/0x4a60 [ 73.451607][ T5598] process_one_work+0xa23/0x1940 [ 73.456532][ T5598] worker_thread+0x5ef/0xe50 [ 73.461124][ T5598] kthread+0x370/0x450 [ 73.465185][ T5598] ret_from_fork+0x72b/0xd50 [ 73.469775][ T5598] ret_from_fork_asm+0x1a/0x30 [ 73.474531][ T5598] [ 73.476837][ T5598] Freed by task 5790: [ 73.480790][ T5598] kasan_save_stack+0x30/0x50 [ 73.485455][ T5598] kasan_save_track+0x14/0x30 [ 73.490117][ T5598] kasan_save_free_info+0x3b/0x70 [ 73.495125][ T5598] __kasan_slab_free+0x5f/0x80 [ 73.499872][ T5598] kfree+0x22b/0x6c0 [ 73.503754][ T5598] redrat3_dev_probe+0x107a/0x2b50 [ 73.508853][ T5598] usb_probe_interface+0x303/0x8f0 [ 73.513947][ T5598] really_probe+0x241/0xa60 [ 73.518430][ T5598] __driver_probe_device+0x20e/0x450 [ 73.523697][ T5598] driver_probe_device+0x4a/0x140 [ 73.528705][ T5598] __device_attach_driver+0x1df/0x320 [ 73.534061][ T5598] bus_for_each_drv+0x159/0x1e0 [ 73.538893][ T5598] __device_attach+0x1e4/0x4d0 [ 73.543648][ T5598] device_initial_probe+0xaf/0xd0 [ 73.548664][ T5598] bus_probe_device+0x64/0x160 [ 73.553407][ T5598] device_add+0x121d/0x1970 [ 73.557898][ T5598] usb_set_configuration+0xd97/0x1c60 [ 73.563259][ T5598] usb_generic_driver_probe+0xa1/0xe0 [ 73.568616][ T5598] usb_probe_device+0xef/0x400 [ 73.573363][ T5598] really_probe+0x241/0xa60 [ 73.577851][ T5598] __driver_probe_device+0x20e/0x450 [ 73.583119][ T5598] driver_probe_device+0x4a/0x140 [ 73.588132][ T5598] __device_attach_driver+0x1df/0x320 [ 73.593495][ T5598] bus_for_each_drv+0x159/0x1e0 [ 73.598331][ T5598] __device_attach+0x1e4/0x4d0 [ 73.603079][ T5598] device_initial_probe+0xaf/0xd0 [ 73.608094][ T5598] bus_probe_device+0x64/0x160 [ 73.612846][ T5598] device_add+0x121d/0x1970 [ 73.617339][ T5598] usb_new_device.cold+0x685/0x115c [ 73.622519][ T5598] hub_event+0x30a3/0x4a60 [ 73.626928][ T5598] process_one_work+0xa23/0x1940 [ 73.631842][ T5598] worker_thread+0x5ef/0xe50 [ 73.636411][ T5598] kthread+0x370/0x450 [ 73.640456][ T5598] ret_from_fork+0x72b/0xd50 [ 73.645029][ T5598] ret_from_fork_asm+0x1a/0x30 [ 73.649795][ T5598] [ 73.652099][ T5598] The buggy address belongs to the object at ffff8880536c6000 [ 73.652099][ T5598] which belongs to the cache kmalloc-2k of size 2048 [ 73.666135][ T5598] The buggy address is located 1880 bytes inside of [ 73.666135][ T5598] freed 2048-byte region [ffff8880536c6000, ffff8880536c6800) [ 73.680100][ T5598] [ 73.682407][ T5598] The buggy address belongs to the physical page: [ 73.688795][ T5598] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x536c0 [ 73.697545][ T5598] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 73.706027][ T5598] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 73.713550][ T5598] page_type: f5(slab) [ 73.717528][ T5598] raw: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 73.726097][ T5598] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 73.734660][ T5598] head: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 73.743326][ T5598] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 73.751998][ T5598] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 73.760645][ T5598] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 73.769286][ T5598] page dumped because: kasan: bad access detected [ 73.775689][ T5598] page_owner tracks the page as allocated [ 73.781378][ T5598] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5732, tgid 5732 (kworker/1:5), ts 70854234735, free_ts 20231271912 [ 73.802635][ T5598] post_alloc_hook+0xfd/0x120 [ 73.807313][ T5598] get_page_from_freelist+0xf48/0x3530 [ 73.812752][ T5598] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 73.818622][ T5598] new_slab+0xa2/0x640 [ 73.822671][ T5598] refill_objects+0xe3/0x410 [ 73.827237][ T5598] __pcs_replace_empty_main+0x376/0x680 [ 73.832765][ T5598] __kmalloc_node_track_caller_noprof+0x679/0x830 [ 73.839160][ T5598] kmalloc_reserve+0xe8/0x350 [ 73.843823][ T5598] __alloc_skb+0x185/0x710 [ 73.848232][ T5598] mld_newpack.isra.0+0x18e/0xa20 [ 73.853239][ T5598] add_grhead+0x299/0x340 [ 73.857549][ T5598] add_grec+0x1389/0x1930 [ 73.861865][ T5598] mld_send_initial_cr+0x156/0x320 [ 73.866958][ T5598] mld_dad_work+0x32/0x1f0 [ 73.871358][ T5598] process_one_work+0xa23/0x1940 [ 73.876285][ T5598] worker_thread+0x5ef/0xe50 [ 73.880854][ T5598] page last free pid 1 tgid 1 stack trace: [ 73.886632][ T5598] free_pages_prepare+0x586/0xd80 [ 73.891642][ T5598] __free_contig_range_common+0x14f/0x250 [ 73.897357][ T5598] destroy_args+0xa8/0x7a0 [ 73.901760][ T5598] debug_vm_pgtable+0x1d69/0x3490 [ 73.906770][ T5598] do_one_initcall+0x11d/0x700 [ 73.911527][ T5598] kernel_init_freeable+0x6ea/0x7b0 [ 73.916711][ T5598] kernel_init+0x1f/0x1e0 [ 73.921025][ T5598] ret_from_fork+0x72b/0xd50 [ 73.925600][ T5598] ret_from_fork_asm+0x1a/0x30 [ 73.930347][ T5598] [ 73.932651][ T5598] Memory state around the buggy address: [ 73.938277][ T5598] ffff8880536c6600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.946315][ T5598] ffff8880536c6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.954365][ T5598] >ffff8880536c6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.962414][ T5598] ^ [ 73.969333][ T5598] ffff8880536c6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.977375][ T5598] ffff8880536c6800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.985413][ T5598] ================================================================== [ 74.024315][ T5598] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 74.031571][ T5598] CPU: 0 UID: 0 PID: 5598 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 74.040429][ T5598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 74.050483][ T5598] Call Trace: [ 74.053742][ T5598] [ 74.056654][ T5598] dump_stack_lvl+0x100/0x190 [ 74.061315][ T5598] vpanic+0x552/0x970 [ 74.065276][ T5598] ? __pfx_vpanic+0x10/0x10 [ 74.069758][ T5598] ? mark_held_locks+0x40/0x70 [ 74.074505][ T5598] ? string+0x471/0x4d0 [ 74.078640][ T5598] panic+0xd1/0xe0 [ 74.082342][ T5598] ? __pfx_panic+0x10/0x10 [ 74.086760][ T5598] ? string+0x471/0x4d0 [ 74.090895][ T5598] ? preempt_schedule_common+0x42/0xc0 [ 74.096336][ T5598] ? check_panic_on_warn+0x1f/0x90 [ 74.101426][ T5598] check_panic_on_warn.cold+0x19/0x34 [ 74.106779][ T5598] end_report.part.0+0x3a/0x90 [ 74.111528][ T5598] kasan_report.cold+0xe/0x18 [ 74.116192][ T5598] ? string+0x471/0x4d0 [ 74.120329][ T5598] string+0x471/0x4d0 [ 74.124288][ T5598] ? __pfx_string+0x10/0x10 [ 74.128770][ T5598] ? __lock_acquire+0x49f/0x1a40 [ 74.133690][ T5598] ? kasan_save_stack+0x3f/0x50 [ 74.138523][ T5598] vsnprintf+0x422/0x1300 [ 74.142854][ T5598] ? __pfx_vsnprintf+0x10/0x10 [ 74.147604][ T5598] vscnprintf+0x40/0x90 [ 74.151742][ T5598] sysfs_emit+0x165/0x180 [ 74.156075][ T5598] ? __pfx_sysfs_emit+0x10/0x10 [ 74.160912][ T5598] ? find_held_lock+0x2b/0x80 [ 74.165566][ T5598] ? sysfs_file_kobj+0xe4/0x290 [ 74.170404][ T5598] ? __pfx_input_dev_show_name+0x10/0x10 [ 74.176019][ T5598] input_dev_show_name+0x5b/0x70 [ 74.180939][ T5598] dev_attr_show+0x52/0xa0 [ 74.185344][ T5598] ? __pfx_dev_attr_show+0x10/0x10 [ 74.190453][ T5598] sysfs_kf_seq_show+0x217/0x3f0 [ 74.195377][ T5598] seq_read_iter+0x32f/0x1270 [ 74.200037][ T5598] kernfs_fop_read_iter+0x46c/0x610 [ 74.205221][ T5598] ? rw_verify_area+0xce/0x6d0 [ 74.209984][ T5598] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 74.215706][ T5598] vfs_read+0x82e/0xb40 [ 74.219865][ T5598] ? __pfx_vfs_read+0x10/0x10 [ 74.224544][ T5598] ? __pfx_do_sys_openat2+0x10/0x10 [ 74.229732][ T5598] ksys_read+0x12a/0x250 [ 74.233961][ T5598] ? __pfx_ksys_read+0x10/0x10 [ 74.238711][ T5598] do_syscall_64+0x115/0x870 [ 74.243285][ T5598] ? clear_bhb_loop+0x40/0x90 [ 74.247944][ T5598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.253818][ T5598] RIP: 0033:0x7f089c8a7407 [ 74.258222][ T5598] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 74.277810][ T5598] RSP: 002b:00007ffd9456a1f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 74.286216][ T5598] RAX: ffffffffffffffda RBX: 00007f089cf6f880 RCX: 00007f089c8a7407 [ 74.294189][ T5598] RDX: 0000000000001000 RSI: 00007ffd9456a6d0 RDI: 0000000000000008 [ 74.302145][ T5598] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 74.310102][ T5598] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a6229445d0 [ 74.318054][ T5598] R13: 00007ffd9456a2d0 R14: 00007ffd9456a6d0 R15: 000055a5eb392bcc [ 74.326009][ T5598] [ 74.329212][ T5598] Kernel Offset: disabled [ 74.333516][ T5598] Rebooting in 86400 seconds..