last executing test programs: 2.907023856s ago: executing program 1 (id=1542): r0 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r1 = fcntl$dupfd(r0, 0x0, r0) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', '', [], 0xa, "59ed8dab5785641770e372dbf11a3ca29199f4139b319c3e670506b9ff64f8a61db584a3bf16f759730c043aaa42c968486cf5a19cf2c2f9a91d443600fcc304ed7c49ca60790000"}, 0x4c) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r2, &(0x7f0000000180)='p:s/p ./file0:0\f+', 0x11) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x34}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f00000002c0)=@assoc_id=r4, &(0x7f0000000300)=0x4) write(r3, &(0x7f0000000000)="e647bd04d13a7599f1401abb08a690b895abfc2e2f1d11d76b738426fea55b98ae6c9a05ad0b8644f569850cbdd66b12f38457feac551808b27d20202e36346dfb6210f6d1ebde7fef1e268dc3dae0bf6c4ea4bebbbe64a0fcf59e897d9f476911972d50acd2f0e794486e269a6da29a373ef3957726323ad1ea9a511c63f333ef9b235b528a84615bf9cc2c93d1d1d70911bd659498f4bf7bf7ede756cd2786f2c108572d0eb172bb3a513cfb03125f2e45b53d6a65a2898bcf666b4c458e13c13c5fc402ac930f731ddd67fc81e98c3a0f71400a", 0xd5) modify_ldt$read(0x1100, 0x0, 0xfffffffffffffe5e) accept$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000000)={0xfffffff8}, 0x10) write(r5, &(0x7f00000000c0)="240000001e005f0214fffffffffffff807000000b800000000000000080008000d000000", 0x24) write$binfmt_script(r1, &(0x7f0000001b00), 0xfffffd9d) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x20000348, &(0x7f0000000180)=[{0x6, 0x72, 0x9, 0x7fff0009}]}) r7 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r7, &(0x7f00000000c0), 0x10) sendto$l2tp(r7, &(0x7f0000000440)="e5786a0d000000000000003b", 0xc, 0x8000, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_int(r7, 0x0, 0x8, &(0x7f0000000040)=0xfffffffd, 0x4) recvmsg(r7, &(0x7f00000026c0)={0x0, 0x0, 0x0}, 0x120) close_range(r6, 0xffffffffffffffff, 0x0) 1.983232108s ago: executing program 1 (id=1563): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r0, &(0x7f0000000080)='transport=loop,nqn=nqn.2014-08.org.nvmexpress.discovery', 0x37) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000706010800000000000000000a002004"], 0x14}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x3dc}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xa, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x9d3}}}, 0x0) syz_ublk_setup_io_uring(0xbf8, &(0x7f0000000140)={0x0, 0xdc77, 0x4, 0x3, 0x3dd}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r6, 0xc0145b0e, &(0x7f0000000040)) 848.963329ms ago: executing program 0 (id=1581): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x3, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x61]}}, 0x0, 0x34}, 0x28) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000fddbdf254400000008000300", @ANYRES32=r4, @ANYBLOB="1c002380050007"], 0x38}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67", 0xa}], 0x3}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)=""/81, 0x51}, {&(0x7f00000000c0)=""/97, 0x61}], 0x2}, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$P9_RXATTRCREATE(r6, &(0x7f0000000240)={0x7, 0x21, 0x4}, 0x7) 652.11654ms ago: executing program 0 (id=1585): r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='127.0.0.1:6789:/\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x54}]}, &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94) r1 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f00000002c0)='mand\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GET_MAGIC(r2, 0x80046402, &(0x7f0000000140)=0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)="053c6c0200000004002e71eedaff070000204731008087a3261aec21798b0a", 0x1f) 588.16769ms ago: executing program 0 (id=1587): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000000)={'wg0\x00'}) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000280)=@multiplanar_userptr={0x0, 0xe, 0x4, 0x100, 0x9, {}, {0x1, 0xc, 0xe, 0x9, 0x4b, 0x8, "fd9eb516"}, 0xff, 0x2, {0x0}, 0x1}) 587.922123ms ago: executing program 0 (id=1589): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)) r1 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42400, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x42000, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TUNGETVNETLE(r2, 0x80047441, &(0x7f0000000180)) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81801) move_mount(r4, &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x262) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x4}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r5, 0x0, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x42, &(0x7f0000000280)={@local, @remote, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x1, @link_local, @private1={0xfc, 0x1, '\x00', 0x1}, @multicast, @remote}}}}, 0x0) ioctl$VHOST_VDPA_SET_CONFIG(r4, 0x4008af74, &(0x7f0000000300)={0x5, 0x54, "ad471e885dc20cdf9e07c5fe48eff3a4a474b232667350a23f5975b07272d7f24d6dce37b54ccd000bbba7022b325a25af63db2ae1549f7b30fc385631a2e998b88e5bb584adb2ac0f757ee0c366473ecec649e5"}) 406.514812ms ago: executing program 3 (id=1592): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x70, 0x0, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f0000000080)=0x2) 406.213835ms ago: executing program 2 (id=1593): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0xa, 0xfffffffe) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32=r2, @ANYBLOB=' \x00', @ANYRES32=r4, @ANYBLOB="01000100ff"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) 405.71646ms ago: executing program 1 (id=1594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)={0x1, 0x0, @pic={0x2e, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x67, 0x58, 0xa0, 0x2, 0x6, 0x7e}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 401.624515ms ago: executing program 3 (id=1595): r0 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100), 0x0, &(0x7f0000000180)) syz_clone(0x4820000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 401.435016ms ago: executing program 2 (id=1596): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x300, 0x0) 331.315206ms ago: executing program 0 (id=1597): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) r1 = fanotify_init(0x8, 0x40000) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) fanotify_mark(r1, 0x2, 0x100018, r2, 0x0) write(r0, &(0x7f0000000100)='maxtcpc 0x5', 0xb) 330.911439ms ago: executing program 2 (id=1598): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x15fdd, 0x0, 0x0, 0x1050, 0xb}, 0x30, 0x3) landlock_restrict_self(r1, 0x5) setresuid(0xee00, 0x0, 0x0) syz_emit_ethernet(0x33, &(0x7f0000000040)={@multicast, @random='\x00\x00\x00 \x00', @void, {@ipv4={0x800, @igmp={{0x6, 0x4, 0x0, 0x3d, 0x25, 0x0, 0x0, 0x1, 0x2, 0x0, @private=0xa010101, @multicast1, {[@ra={0x94, 0x4}]}}, {0x11, 0x7c, 0x0, @multicast1, "73f3000062"}}}}}, 0x0) ioprio_set$uid(0x3, 0xee00, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000f80)='timerslack_ns\x00') write$cgroup_pid(r2, 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r2, &(0x7f0000000180)='./file0\x00', r3, &(0x7f00000002c0)='./dev\x00', 0x2) r4 = syz_open_dev$mouse(&(0x7f0000000000), 0x401, 0x10000) write$sndseq(r4, &(0x7f0000000080)=[{0x0, 0x9, 0xc2, 0xdd, @time={0x0, 0x8}, {0x6, 0xfb}, {0x7, 0x2}, @raw32={[0xbc, 0x8, 0x7ff]}}], 0x1c) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000004001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d93452a92954b4337000000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb0000000000", 0xd8}], 0x1}, 0x4000) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(r6, &(0x7f0000c00000/0x400000)=nil) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x8c01, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x840}, 0x40000) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$BSG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000300)) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=""/14, 0xe) syz_kvm_add_vcpu$x86(r7, &(0x7f0000000280)={0x0, 0x0}) 266.895432ms ago: executing program 2 (id=1599): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e22, 0x5, 0x1, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x87ff, &(0x7f0000000400)={&(0x7f0000000500)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in6=@empty, 0x4e23, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0x0, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x0) 266.524051ms ago: executing program 0 (id=1600): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8, 0x0, 0x0, 0x1}, @union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x0, 0x2, 0xa000000}]}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, 0x0, 0x52, 0x0, 0x1}, 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x6c, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @private=0xa010100}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e21, 0xfffffff6, @mcast2, 0xe}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e24, @multicast2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={r1, 0x200}, 0x8) shutdown(r0, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000000c0)={0x3, 0x6}, 0x8) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000080)=0x10) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000300)={&(0x7f0000000200)=[0x0], &(0x7f0000000240)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0], 0x1, 0x1, 0xa, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$cuse(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv(r3, &(0x7f0000000680)=[{&(0x7f0000000040)=""/106, 0x75}, {&(0x7f0000000b00)=""/161, 0xfef5}], 0x2) open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="640000001000030427bd70000300000000000000", @ANYRES32=0x0, @ANYBLOB="46040900000000003c00128009000100766c616e000000002c00028006000100010000000600050088a80000100004800c0001000500000001000000860c05008100000008000500", @ANYRES32=r8], 0x64}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 266.345556ms ago: executing program 2 (id=1601): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x8000, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) sendmsg$inet6(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="944cf7", 0x3}], 0x1}, 0x20000010) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) sendto(r0, &(0x7f00000007c0)="c602a48e194769372935cd3dcb48079980d8fe6ddcb1cd24df905b7e339a7d806f604bd4ecb414422d4ce29ebb69f4d7cddbe49705eb8d4afb8cd0aa782ebe195233ae4450b8880fdab7d97fd2e4bf19f08420111f056b30dab83fa262947b454c3007852ca1febc14ae3eda1ec8569f8afd39c42449fbecdba0432478ca4e22fde0ce2d0b8c09b294155182c8d7b828688a5d1ce5067eb234ef01e5a07676167f4aa0d227f53a0bf3214b41e3400d1c2e8214d5b430b9c3167e420964a21ba6d122d6e1c1a76770c4d2764acc9176c18600fc65a1c129ae7fd6380945691e402782c792c9651ec57bfe3969ac8f2fde4f135bc51ccfdebe73f2a3b4c8c46ebd8a9da4d61e5755d6d418c37a495038f5fb968cf3230034e59f18726be15074d79f339ef37deb7f37a926202b21f76013e171d5c09046f20bfbc250cdd8f394771ae67d6029879aa4078ed4399024723d18f13cc49ddd4c29949d18afddf16802508e73b1ac345f5794b8cc4b1ca1ba93c1efa2f97379a2f02fe356bf017ddbc16ba38d51259fed5ecedaf42f654891c4e920f100472fd36a7fc7672ce124f64ff6fa682dc098a3ba839750464293833a9fdd0639c2a0c1915bfb82475c2957d02619ed319eb2e76dcab9cf40c05138e4bc3e29acfd46718941c7723686c357eb0721334fbb44ea77c35adf8d04777ab972d740c6d4619be4ccea002fa10c78b9a1f61d46842bb31e87b8e79f3fd87a846c9c677d6d39c5d6fd165b8e8e61958367d6a97771163b6853bcae902886abe2008587e8ea30142dfd1a9ac9f408414373a1879a51ccc396c84921e5537e0d4cd09fa88d060f1d1aeaa4541f297fa33940bd7f550c0714755e62dae4f8e48ae8db4efc4f627a583fe7f036ffe69a2229f40cc38eae88bbd03c11811129f655a99d4f3b933cb2eae9ea9e846c5e2362e3f8986541b9d03fae2159463911a13de7d4160c87332bc97e73c23ab2dbbdd9cf6aa66233dac15cd53f99d5a010b3c9e1ce5fdd117a9a9fc20d0edd480b0e7436c48b6b353807f9059e934a3a0d3eecbf76643d18553af71e66c43f7f047a8df90313aa68bc0e6d8e06182be36fae29a63cb6cbd1773eefca9dc9c14b415a7f4ca7437e2824d4a989a87360272004231b83633c4a389ac5ba3e8cc5f4fa47c7d364c717514d08f5902c3783475824e79056cf67a369308a36886cfde9aac13b97e97576c7e55ce5f132ae1e9d6f61749fcfcdb0a35641ecb48ed1cebc356cbc2a1b79427a3be2b20266071c57f746ad039bc9cd54d4a094b6938cdf5a05be6d708f1aaf641bd756f277bfd81591d0617ad5355c021e06fad44b3a09232b79a48e7648c8b9bb92835d363f0e565495509bbf0c9fd6ac7db18cb99659d61eeb7434855cb102b168f86d9d013e43909cd35d57b58cb3640c7178cd06c02c5f048ee3bade92fdb1f8f47ab5b60b811387b52cd7094c6c087ea0c889885f870dc77f50c029e769845eabb9836d0a829c7a3f3b8ad0ef7b6e955eea511aaae7eb78f02a3db7b2f88f221288151d1aca6b740039aba58eecb2e8edc27a2c662453d0de89867416ebcf1d4e12ef6f0c3dc22546a83450f2e400ab32e2088e3cacfe04e4dc76784421ba91aa40703c61f643e04ebcafa3612caa500fb01c00d11160388a21a523631e2198365d00b47233d8130a3e1038a8b67438f14096ccde01953409a137548b690a337b5936261e0108b6617fdc72972a3314d16b4e6c3ff4f176bf44a8839b4e5f684dee9e3ba883cc74941283c1efedb49b51e30c216e9c66f380ccf5bcf74584a3ba92d21440d1cd9deb62fac666c5297b76683df069e63fec571fd33a3d272d6554df625e296f3ad6a94eaf9e3b62032321b8c761b5159110b104c6f6052882679bfc7e9b55b825d738668f7acf08328641784d549d1e44f96e034c550d4bfa2077f3daa510d6d37c771a4052468d29bee7ecdcb1bb4e984171edecb27916b8a934da5669b65db12120683fb2c37cbc7f4ce8cc36305b3d0bb4b284c7f4af35a0e03ce7a047293548c8e1f10cc6cd4eabcebfc9fd9e1cf514abf4b386ff8e12592a24efb46a4d6309d3d86ee8f8e1abf6e70a2a04e3536dc5e07df81eecd30de61737726ac4373b9e7a5b0e75d86feef31fe17b7e95ae413ae4242c33250bc40b8dc9a2e437ff6cc86d550152bf164c7f7705cddb376b4b712b61abc27f2157acd9ada84c46be7b9087162c7311e9a5dff10d76bb34485baf0b2faa61a1eccafb91beba05a446b1656e08ba52aa6a34f4e069033ec7b5bcb4bbf244217881012701f72f58d6b1a5f926460d99c216c99ae8007c3a2d1d9e53cc374428bbcaebd5776a59e63458c8d77dfcbddb2ee7ac179486f50050a1d5a14c5d1ff2ab539fce086106e6009cd03e455f5812b4a79822625a684ec59bfa14d24f5507f896ea9dbebe2fd53b61413bbddf45a66aff39443c32b32b61685248e54951b309b272553758478cfb2734bc8290205a4b97231d963438447b256fc5c01f7e7194f90725501f95edb16ec14b79f45cd4ea9943b64c249681e6cc347669a4aa8cbbc949c8d8ae2cebdc4022adf008d343edb3362917271ae84038353bd52f9ac7c17051f2cd90491e3e01bcf0c18ef0994e56881cdf9ddf29a20b39313163c4b1982e0dee87b27d430f9553a716b5b9aae7a1fc788f3fe7993f169efd19f9804ac1f07b1e7a4b5fa5aa68f447a17cd67f8abfee0c8d3fcc0efcc5697adb44f2c304b14f481412214bb976790d07dbd8effbdedae04755b6a40545953e4192b5655dafc70f153c0078249818712f12a19b942254d1899a6fea23d3a2b329a992bebc23a86d1f939b6989138a72b025fc1430c632be3e038f77e73932e96f06581409803703597ed47f6db06e38a6b12c453ee3a5d6e5191d340aa6836c402c7b5b62fdf36ddb3bd900cf49d5084ed88ca26d67c031d203b30f3f4a05022ae927c016fa994e608a91df1f7cd7af96e3a57237af6371d4490edecc803ba114eec216a4136116e6818217290ed3a78732b684c7e5ad85f4548db4af5b067e08c27738cc3f4ed525388b2e57baa62613466c913366cf6d2bf00793ee0618ff774bde776b54ba7fca48457055ad2bd78295979c2d38a52fb11751e901752a34ff4cfd5071fd05dbd876ae8c56ab3ebb844e2c787b274ab00f92772e96c2ebe5a9733a5d667ff7cc3be281a343ecaa20afe785c0a6693a3df41594eb0b5eb5d7d0d018a868cf943a1f45ea9014b8777849c7180cbca1a3995ec2cc991b67c54087fcb925db2980639414ef58954ce2404b85d2e55a9c4230a08e663a692191bb52a08b9654dfbcf78a198faf36740687924a4372583918308298ce0c048e4297cf1455396c3fd5b4906937bf4d8eccb59671c3adb0e8caad3a7c0369e35d843d4b31be714d11ad863421406af5d108f787dc0565ec036866fd3f20cc668cf67b56ae0e2d0285599dfe740f4695abf6d98e67e52ccdf3719a1daa71e77c8fdf5c3b474730cb3b272ce12e5b617e541c41e9b9f7e5f16e75951bbf10eda3f4a858b40599ed68f745c4fb6e3821968a0a8d6280f2c51c558c850c08f17d69ac668664a1aa8972f5b14e5016604d62846bbcb3a8c0148642b0dc90d6e9f0d5a9f6b90bfe2d76bb84b1b8d65e3af03233d9f45329984d472ffa0afe04ff122b37000beade438f08030a61c33bf7f04ef39342e14fb5bc5c879efbfb199177e8695d758dea5f4df3903c71ae56183cbd73c6e949fb59931c1115baceae9d4166d1fa0ce112cc26aaa356a5e8137cd2b3b965d315d8d32cd90e43808ae83080b4fad433e0ae9d1b5f8651c9f08e1e3f483d3c8c5efb2045dd66f62de60c53dcc6d14d0bc8517e8a402f0a571c9fc19af64f36668ff1cb0f1579c11c816fe30bbc85d3250361f1c42440449bcea6ed67a8491abc9e2197cd54376571b503022627af8a81d840f75e1ad7d556cd5178472b9484e81cfb3ed8c217246366a1ff61c28cb96b09b0f832118c1d88523f633f9b14657b083776a99e0535c04b4e8cd1b31e1983678e86fecd3ffc36ed7fa842ffd657aff36f9ee9f94341fe765727034e03cb6413faf71d8bf1c1be40e6a9a52f60e2a63da6f61cef962a9a347af033a482b44ee5022035bd9d75aacfbd06328e48114691b4f727c2ecd3f6344f4ee5f34575b874a16f280c9506cd9a1a9767f4bb82667e2420f65478b6d461bf9a23ce8bd50ba1b4348c84b31a87971dcca16a9286e47c8bfe2e730bdc44d41f09a4f87a8c82974e631920c300f53dc1d9d8ddc57d5a0208c6dec78ca641daee7254f49ec5706aad4e9952add463e6c54998d11e8918e9be6dc5528b71f2003e38f4d60af0bf30642c0a13ea440692c1027eb6dfcda3240095eaa086223948632d0634436c1a80a124dfa0e4ca302f836f235cbeab7b035a53a25459c4083edffd11ee655dbc519df910dfaa919114d7a48987bac07e0cd40e7e5f3ccd52942ad67f4f2619eda56a1db2a0a04f00f96f6b23677d7607777d506864b7a873afced0326a8e53fc25d544ff2acc4e97322c3f9cd987875707295eccafab9101e72b917fd052310f51de72138691ea652b7afc579795741e06fa48519e9a6de935345f3272659e68f649b1a9d2c9b0c45750f1bc5d5d4ea25b6b7a3c2764438add6e418ed3b1f85e08a0232664195697cff92ebb91302b246b8af22c0049dbbb703aa10f691f2a516a6748aef45ce38d92c2d92e440c7180b0fb734183d506c67575cdbf048905d00416c4b92be421f0df36cad54f4eff0b3b176e79160655803332a997d2e64084bcfab86e7929b09259b62628a5734e7ab88f76bb28030ef733143867164126ca2e0506200a7dc52092f76a7293b4a221241c13bbb7d5619a4f86401f418000de95fe7c1da861ed96f35711cf09c23e466bc3bf3d436ccac4ee5a2f8da0a4eb9b51ff46e9bd7169d1e891d1c1e0b2f96eb647fa62aab02c1edf1bada0da4be35921273005ef13453da63c67ee7a84ac301ded707396a5c0e414a636e501d316c244ca9387d22e31dda474d53649551776822997789e1bedb7576a1dfc46663bccd8a01777df1bd172d83cdb0ca1f003a6dc6896bcb9d0a0b7ac9c66d1a9d18f09ce1415940583ca44874f4eaa8481e308d9cbf58c46d126fcdf528abf7414bf69b88ab1c126eb6a3c457dca7bb65bff2a422ac00afaeb1cb0d092abfd3396327edee49a89a56d0aa0b93593ef47e3e44bcac4f0a7a72db60d83bffd9eb500ce22c249fbb49f8206911dbfaa9cdeecfc0438e9a0d0776c692b75f0680035667f8fe464d49ee8d4fdde9b93e4b7486022f870607da6268bc4fefcbe1020e8f99f9fd8d3f99a03f9b1258d4b3f151e51525bd6719094bc9887f40c776ed27dce80d10661ed9b3fe43df3115343106c892a1deca2964332632f180936f4a6897a656954f53d1e098980193153c2b491ba8542c720f2b5124d0406a6386e4e724058f9ef8d1268856a95f8089e58c42ff874ea7449503df8490ea8b2c9de225b7ddfeca9fcf259a69c68f6f60d0d1cf0a0382af4abb6b10b01a6da76e78c349ae0ad69918bd8b467dd78af73aac1f00aa516e37a51261d5eac337f1686f497784cb4e9628f7e1b8cc81e95444e954dedb50c093a31c212baf5023ac3c7567d831e71b9fef1571afa27ffc3e29c190e7384e0371f5a20fda2f6cc30f3d4fafaf86e2b51fd76818823ebac56f56630a4d48a1ac4bbec8eb170649300accd6b80961e30e85952", 0x1000, 0x4004000, &(0x7f00000017c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x1, 0x3, {0xa, 0x4e21, 0x3, @mcast1, 0x798}}}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r5, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x0, 0x0, [0x100, 0x6, 0x2, 0x9, 0x7f, 0x7], 0x1, 0x0, 0x0, [{}]}, 0x88) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, 0x0) write(0xffffffffffffffff, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00', 0x7) 265.972036ms ago: executing program 3 (id=1602): r0 = userfaultfd(0x80800) ioctl$FS_IOC_GETFSSYSFSPATH(0xffffffffffffffff, 0x80811501, &(0x7f0000000040)={0x80}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x238}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, &(0x7f0000000140)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) 181.598373ms ago: executing program 2 (id=1603): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r0, &(0x7f0000000080)='transport=loop,nqn=nqn.2014-08.org.nvmexpress.discovery', 0x37) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000706010800000000000000000a002004"], 0x14}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x3dc}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xa, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x9d3}}}, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r6, 0xc0145b0e, &(0x7f0000000040)) 180.774768ms ago: executing program 1 (id=1604): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x70, 0x0, 0x0) r0 = syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f0000000080)=0x2) 176.446228ms ago: executing program 3 (id=1605): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)={0x30, r2, 0x1, 0x70bd2c, 0x25dddbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x1000}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000800) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 96.679802ms ago: executing program 1 (id=1606): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r0, &(0x7f0000000680)="903233", 0x3) (fail_nth: 4) 96.485113ms ago: executing program 3 (id=1607): r0 = timerfd_create(0x0, 0x80000) timerfd_settime(r0, 0x3, &(0x7f00000000c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timerfd_settime(r0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_io_uring_setup(0xefc, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x310}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x8, &(0x7f0000000000)=0x7, 0x4) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @empty=0xe0000001}, {0x0, 0x4e20, 0x8}}}}}, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaafad1e048716e08004500005c0000000000119078000000000000000000004e200048907803000000e00000003ce7b9286b574dc2720ef6057772f09df9d3421eee34e003047b90670593e17881953d1e429031066797feb6632a4cea988cc9256fe11df4"], 0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_FUTEX_WAITV={0x35, 0x41, 0x0, 0x0, 0x0, &(0x7f0000000e80)=[{0x1, 0x0, 0x2}], 0x1}) io_uring_enter(r3, 0x855, 0xfffffffd, 0x21, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="2504000000000000000008"], 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001400000001414000000110001"], 0xdc}}, 0x0) 91.592775ms ago: executing program 1 (id=1608): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008"], 0x54}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010060000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 0s ago: executing program 3 (id=1609): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000000c0)={'xfrm0\x00', @local}) sendmsg$802154_raw(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)="e9", 0x2f}, 0x1, 0x0, 0x0, 0x810}, 0x24004014) r2 = syz_open_dev$media(&(0x7f0000000100), 0x8000000000000067, 0x82400) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000002f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000019340)=[{}, {}, {}, {}], 0x0, 0x0, 0x0}) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000000c0)={'xfrm0\x00', @local}) (async) sendmsg$802154_raw(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)="e9", 0x2f}, 0x1, 0x0, 0x0, 0x810}, 0x24004014) (async) syz_open_dev$media(&(0x7f0000000100), 0x8000000000000067, 0x82400) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000002f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000019340)=[{}, {}, {}, {}], 0x0, 0x0, 0x0}) (async) kernel console output (not intermixed with test programs): ID: 8809 Comm: syz.0.1040 Tainted: G L syzkaller #0 PREEMPT(full) [ 111.551456][ T8809] Tainted: [L]=SOFTLOCKUP [ 111.551460][ T8809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.551467][ T8809] Call Trace: [ 111.551470][ T8809] [ 111.551475][ T8809] dump_stack_lvl+0x100/0x190 [ 111.551496][ T8809] should_fail_ex.cold+0x5/0xa [ 111.551511][ T8809] ? __netlink_lookup+0x652/0x900 [ 111.551550][ T8809] should_failslab+0xc2/0x120 [ 111.551565][ T8809] kmem_cache_alloc_noprof+0x92/0x6a0 [ 111.551579][ T8809] ? skb_clone+0x190/0x400 [ 111.551595][ T8809] skb_clone+0x190/0x400 [ 111.551609][ T8809] netlink_deliver_tap+0xaed/0xcc0 [ 111.551625][ T8809] netlink_unicast+0x62b/0x850 [ 111.551645][ T8809] ? __pfx_netlink_unicast+0x10/0x10 [ 111.551663][ T8809] netlink_sendmsg+0x8b0/0xda0 [ 111.551677][ T8809] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.551692][ T8809] ? selinux_socket_sendmsg+0x198/0x2f0 [ 111.551707][ T8809] ____sys_sendmsg+0xa4d/0xbe0 [ 111.551723][ T8809] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.551737][ T8809] ? __pfx_____sys_sendmsg+0x10/0x10 [ 111.551757][ T8809] ? lock_acquire+0x1d1/0x380 [ 111.551768][ T8809] ? get_pid_task+0x2a/0x250 [ 111.551798][ T8809] ___sys_sendmsg+0x190/0x1e0 [ 111.551810][ T8809] ? __pfx____sys_sendmsg+0x10/0x10 [ 111.551820][ T8809] ? get_pid_task+0x106/0x250 [ 111.551841][ T8809] ? find_held_lock+0x2b/0x80 [ 111.551865][ T8809] __sys_sendmsg+0x160/0x210 [ 111.551880][ T8809] ? __pfx___sys_sendmsg+0x10/0x10 [ 111.551902][ T8809] do_syscall_64+0x123/0x790 [ 111.551920][ T8809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.551932][ T8809] RIP: 0033:0x7faa7279e159 [ 111.551941][ T8809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.551952][ T8809] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.551963][ T8809] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 111.551970][ T8809] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 111.551976][ T8809] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 111.551983][ T8809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.551989][ T8809] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 111.552003][ T8809] [ 111.612996][ T8813] xt_hashlimit: size too large, truncated to 1048576 [ 111.702278][ T8822] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 111.803571][ T8830] FAULT_INJECTION: forcing a failure. [ 111.803571][ T8830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 111.803593][ T8830] CPU: 0 UID: 0 PID: 8830 Comm: syz.0.1048 Tainted: G L syzkaller #0 PREEMPT(full) [ 111.803609][ T8830] Tainted: [L]=SOFTLOCKUP [ 111.803613][ T8830] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.803619][ T8830] Call Trace: [ 111.803624][ T8830] [ 111.803628][ T8830] dump_stack_lvl+0x100/0x190 [ 111.803649][ T8830] should_fail_ex.cold+0x5/0xa [ 111.803665][ T8830] _copy_to_user+0x32/0xd0 [ 111.803679][ T8830] ctl_ioctl+0x17b/0xcc0 [ 111.803697][ T8830] ? __pfx_ctl_ioctl+0x10/0x10 [ 111.803728][ T8830] ? selinux_file_ioctl+0x13b/0x290 [ 111.803741][ T8830] ? selinux_file_ioctl+0xb6/0x290 [ 111.803755][ T8830] dm_ctl_ioctl+0x22/0x30 [ 111.803771][ T8830] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 111.803787][ T8830] __x64_sys_ioctl+0x18e/0x210 [ 111.803800][ T8830] do_syscall_64+0x123/0x790 [ 111.803818][ T8830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.803829][ T8830] RIP: 0033:0x7faa7279e159 [ 111.803838][ T8830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.803849][ T8830] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 111.803861][ T8830] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 111.803881][ T8830] RDX: 0000200000000300 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 111.803888][ T8830] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 111.803894][ T8830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.803900][ T8830] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 111.803915][ T8830] [ 111.939497][ T8845] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 111.945505][ T8847] xt_hashlimit: size too large, truncated to 1048576 [ 111.964320][ T8850] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 111.993822][ T8851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 112.055299][ T65] block nbd3: Receive control failed (result -107) [ 112.056169][ T8854] xt_hashlimit: size too large, truncated to 1048576 [ 112.117778][ T8845] nbd3: detected capacity change from 0 to 8589934592 [ 112.119210][ T5099] block nbd3: Dead connection, failed to find a fallback [ 112.119231][ T5099] block nbd3: shutting down sockets [ 112.119288][ T5099] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.119313][ T5099] buffer_io_error: 11 callbacks suppressed [ 112.119323][ T5099] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.119635][ T5099] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.119666][ T5099] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.120017][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.120039][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121139][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121156][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121213][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121226][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121287][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121300][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121358][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121370][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121420][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121433][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121450][ T6998] ldm_validate_partition_table(): Disk read failed. [ 112.121490][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121502][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121608][ T26] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 112.121621][ T26] Buffer I/O error on dev nbd3, logical block 0, async page read [ 112.121728][ T6998] Dev nbd3: unable to read RDB block 0 [ 112.121961][ T6998] nbd3: unable to read partition table [ 112.129338][ T6998] ldm_validate_partition_table(): Disk read failed. [ 112.129508][ T6998] Dev nbd3: unable to read RDB block 0 [ 112.129712][ T6998] nbd3: unable to read partition table [ 112.129745][ T8860] gadgetfs: bound to dummy_udc driver [ 112.152065][ T8845] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 112.239629][ T8868] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 112.447885][ T8876] FAULT_INJECTION: forcing a failure. [ 112.447885][ T8876] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 112.447915][ T8876] CPU: 1 UID: 0 PID: 8876 Comm: syz.1.1065 Tainted: G L syzkaller #0 PREEMPT(full) [ 112.447936][ T8876] Tainted: [L]=SOFTLOCKUP [ 112.447940][ T8876] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.447946][ T8876] Call Trace: [ 112.447951][ T8876] [ 112.447955][ T8876] dump_stack_lvl+0x100/0x190 [ 112.447976][ T8876] should_fail_ex.cold+0x5/0xa [ 112.447999][ T8876] _copy_from_iter+0x1f4/0x1690 [ 112.448016][ T8876] ? __asan_memset+0x23/0x50 [ 112.448030][ T8876] ? __pfx__copy_from_iter+0x10/0x10 [ 112.448042][ T8876] ? __pfx___alloc_skb+0x10/0x10 [ 112.448061][ T8876] netlink_sendmsg+0x808/0xda0 [ 112.448077][ T8876] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.448091][ T8876] ? selinux_socket_sendmsg+0x198/0x2f0 [ 112.448105][ T8876] ____sys_sendmsg+0xa4d/0xbe0 [ 112.448121][ T8876] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.448135][ T8876] ? __pfx_____sys_sendmsg+0x10/0x10 [ 112.448155][ T8876] ? lock_acquire+0x1d1/0x380 [ 112.448166][ T8876] ? get_pid_task+0x2a/0x250 [ 112.448183][ T8876] ___sys_sendmsg+0x190/0x1e0 [ 112.448194][ T8876] ? __pfx____sys_sendmsg+0x10/0x10 [ 112.448204][ T8876] ? get_pid_task+0x106/0x250 [ 112.448224][ T8876] ? find_held_lock+0x2b/0x80 [ 112.448248][ T8876] __sys_sendmsg+0x160/0x210 [ 112.448268][ T8876] ? __pfx___sys_sendmsg+0x10/0x10 [ 112.448290][ T8876] do_syscall_64+0x123/0x790 [ 112.448308][ T8876] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.448319][ T8876] RIP: 0033:0x7f4ccd59e159 [ 112.448329][ T8876] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.448339][ T8876] RSP: 002b:00007f4cce488028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 112.448351][ T8876] RAX: ffffffffffffffda RBX: 00007f4ccd825fa0 RCX: 00007f4ccd59e159 [ 112.448358][ T8876] RDX: 0000000020048840 RSI: 00002000000004c0 RDI: 0000000000000003 [ 112.448364][ T8876] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 112.448371][ T8876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.448377][ T8876] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 112.448391][ T8876] [ 112.548587][ T8880] FAULT_INJECTION: forcing a failure. [ 112.548587][ T8880] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 112.548620][ T8880] CPU: 2 UID: 0 PID: 8880 Comm: syz.0.1067 Tainted: G L syzkaller #0 PREEMPT(full) [ 112.548645][ T8880] Tainted: [L]=SOFTLOCKUP [ 112.548652][ T8880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.548663][ T8880] Call Trace: [ 112.548669][ T8880] [ 112.548676][ T8880] dump_stack_lvl+0x100/0x190 [ 112.548707][ T8880] should_fail_ex.cold+0x5/0xa [ 112.548733][ T8880] _copy_from_iter+0x1f4/0x1690 [ 112.548756][ T8880] ? __asan_memset+0x23/0x50 [ 112.548774][ T8880] ? __pfx__copy_from_iter+0x10/0x10 [ 112.548794][ T8880] ? __pfx___alloc_skb+0x10/0x10 [ 112.548826][ T8880] netlink_sendmsg+0x808/0xda0 [ 112.548851][ T8880] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.548874][ T8880] ? selinux_socket_sendmsg+0x198/0x2f0 [ 112.548898][ T8880] ____sys_sendmsg+0xa4d/0xbe0 [ 112.548924][ T8880] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.548947][ T8880] ? __pfx_____sys_sendmsg+0x10/0x10 [ 112.548980][ T8880] ? lock_acquire+0x1d1/0x380 [ 112.548999][ T8880] ? get_pid_task+0x2a/0x250 [ 112.549025][ T8880] ___sys_sendmsg+0x190/0x1e0 [ 112.549044][ T8880] ? __pfx____sys_sendmsg+0x10/0x10 [ 112.549061][ T8880] ? get_pid_task+0x106/0x250 [ 112.549095][ T8880] ? find_held_lock+0x2b/0x80 [ 112.549136][ T8880] __sys_sendmsg+0x160/0x210 [ 112.549160][ T8880] ? __pfx___sys_sendmsg+0x10/0x10 [ 112.549197][ T8880] do_syscall_64+0x123/0x790 [ 112.549227][ T8880] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.549246][ T8880] RIP: 0033:0x7faa7279e159 [ 112.549261][ T8880] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.549278][ T8880] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 112.549297][ T8880] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 112.549309][ T8880] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 112.549321][ T8880] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 112.549331][ T8880] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.549342][ T8880] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 112.549367][ T8880] [ 112.594487][ T8882] xt_hashlimit: size too large, truncated to 1048576 [ 112.740791][ T8893] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 112.797805][ T8900] binder: 8898:8900 ioctl 8933 2000000001c0 returned -22 [ 112.843317][ T8899] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1073'. [ 113.009316][ T8917] xt_hashlimit: size too large, truncated to 1048576 [ 113.162846][ T8925] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 113.409975][ T5835] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 113.549462][ T8941] FAULT_INJECTION: forcing a failure. [ 113.549462][ T8941] name failslab, interval 1, probability 0, space 0, times 0 [ 113.549487][ T8941] CPU: 3 UID: 0 PID: 8941 Comm: syz.3.1087 Tainted: G L syzkaller #0 PREEMPT(full) [ 113.549507][ T8941] Tainted: [L]=SOFTLOCKUP [ 113.549512][ T8941] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.549520][ T8941] Call Trace: [ 113.549524][ T8941] [ 113.549529][ T8941] dump_stack_lvl+0x100/0x190 [ 113.549553][ T8941] should_fail_ex.cold+0x5/0xa [ 113.549573][ T8941] should_failslab+0xc2/0x120 [ 113.549592][ T8941] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 113.549608][ T8941] ? __pfx_clockevents_program_event+0x10/0x10 [ 113.549628][ T8941] ? sock_alloc_inode+0x26/0x2c0 [ 113.549647][ T8941] ? __pfx_sock_alloc_inode+0x10/0x10 [ 113.549666][ T8941] sock_alloc_inode+0x26/0x2c0 [ 113.549683][ T8941] ? __pfx_sock_alloc_inode+0x10/0x10 [ 113.549699][ T8941] alloc_inode+0x68/0x250 [ 113.549712][ T8941] sock_alloc+0x44/0x280 [ 113.549727][ T8941] ? security_socket_create+0x7f/0x250 [ 113.549752][ T8941] __sock_create+0xc2/0x860 [ 113.549776][ T8941] udp_sock_create6+0xc7/0x6a0 [ 113.549816][ T8941] ? __pfx_udp_sock_create6+0x10/0x10 [ 113.549843][ T8941] ? crng_make_state+0x2ab/0x6c0 [ 113.549865][ T8941] ? crng_make_state+0x2b0/0x6c0 [ 113.549888][ T8941] rxrpc_open_socket+0x206/0x6e0 [ 113.549905][ T8941] ? __pfx_rxrpc_open_socket+0x10/0x10 [ 113.549924][ T8941] ? net_generic+0x25/0x2a0 [ 113.549943][ T8941] ? rcu_is_watching+0x13/0xc0 [ 113.549964][ T8941] rxrpc_lookup_local+0xac7/0x1220 [ 113.549983][ T8941] ? __pfx_rxrpc_lookup_local+0x10/0x10 [ 113.550002][ T8941] ? __local_bh_enable_ip+0xa5/0x120 [ 113.550019][ T8941] rxrpc_sendmsg+0x34a/0x680 [ 113.550039][ T8941] ____sys_sendmsg+0xa4d/0xbe0 [ 113.550065][ T8941] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 113.550084][ T8941] ? __pfx_____sys_sendmsg+0x10/0x10 [ 113.550113][ T8941] ? lock_acquire+0x1d1/0x380 [ 113.550126][ T8941] ? get_pid_task+0x2a/0x250 [ 113.550146][ T8941] ___sys_sendmsg+0x190/0x1e0 [ 113.550160][ T8941] ? __pfx____sys_sendmsg+0x10/0x10 [ 113.550173][ T8941] ? get_pid_task+0x106/0x250 [ 113.550198][ T8941] ? find_held_lock+0x2b/0x80 [ 113.550228][ T8941] __sys_sendmsg+0x160/0x210 [ 113.550246][ T8941] ? __pfx___sys_sendmsg+0x10/0x10 [ 113.550273][ T8941] do_syscall_64+0x123/0x790 [ 113.550295][ T8941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.550309][ T8941] RIP: 0033:0x7f9e8b19e159 [ 113.550321][ T8941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.550335][ T8941] RSP: 002b:00007f9e8bff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 113.550349][ T8941] RAX: ffffffffffffffda RBX: 00007f9e8b425fa0 RCX: 00007f9e8b19e159 [ 113.550357][ T8941] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 113.550365][ T8941] RBP: 00007f9e8bff8090 R08: 0000000000000000 R09: 0000000000000000 [ 113.550373][ T8941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.550381][ T8941] R13: 00007f9e8b426038 R14: 00007f9e8b425fa0 R15: 00007ffffbc0f7d8 [ 113.550398][ T8941] [ 113.550959][ T8941] socket: no more sockets [ 113.582671][ T5835] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 113.595679][ T5835] usb 7-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 113.595695][ T5835] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 113.595705][ T5835] usb 7-1: config 1 has no interface number 0 [ 113.634667][ T5835] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.634690][ T5835] usb 7-1: Product: syz [ 113.634701][ T5835] usb 7-1: Manufacturer: syz [ 113.634712][ T5835] usb 7-1: SerialNumber: syz [ 113.686291][ T5835] usb 7-1: 3:1 : does not exist [ 113.686305][ T5835] usb 7-1: 3:2 : does not exist [ 114.308881][ T8982] trusted_key: encrypted_key: insufficient parameters specified [ 114.442489][ T57] usb 7-1: USB disconnect, device number 15 [ 114.581091][ T8986] ipvlan2: entered allmulticast mode [ 114.581106][ T8986] batadv0: entered allmulticast mode [ 114.582524][ T8986] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 114.936800][ T8992] gadgetfs: bound to dummy_udc driver [ 114.940137][ T57] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 115.043196][ T8994] smpboot: CPU 1 is now offline [ 115.100821][ T57] usb 8-1: Using ep0 maxpacket: 32 [ 115.101756][ T57] usb 8-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 115.105351][ T57] usb 8-1: config index 0 descriptor too short (expected 29220, got 36) [ 115.105365][ T57] usb 8-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 115.105376][ T57] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 115.105385][ T57] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 115.105405][ T57] usb 8-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 115.105416][ T57] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 115.105435][ T57] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.106684][ T57] usb 8-1: config 0 descriptor?? [ 115.179263][ T8997] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 115.313395][ T5835] usb 8-1: USB disconnect, device number 9 [ 115.403046][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 115.403058][ T43] audit: type=1400 audit(371.332:600): avc: denied { read } for pid=9019 comm="syz.2.1116" dev="nsfs" ino=4026533186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 115.403965][ T43] audit: type=1400 audit(371.332:601): avc: denied { open } for pid=9019 comm="syz.2.1116" path="net:[4026533186]" dev="nsfs" ino=4026533186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 115.404408][ T43] audit: type=1400 audit(371.332:602): avc: denied { execute } for pid=9019 comm="syz.2.1116" path="/dev/nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 115.408925][ T43] audit: type=1400 audit(371.332:603): avc: denied { ioctl } for pid=9019 comm="syz.2.1116" path="/dev/nullb0" dev="devtmpfs" ino=705 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 115.508444][ T9026] gadgetfs: bound to dummy_udc driver [ 115.563310][ T9031] FAULT_INJECTION: forcing a failure. [ 115.563310][ T9031] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 115.563333][ T9031] CPU: 0 UID: 0 PID: 9031 Comm: syz.1.1121 Tainted: G L syzkaller #0 PREEMPT(full) [ 115.563348][ T9031] Tainted: [L]=SOFTLOCKUP [ 115.563352][ T9031] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 115.563358][ T9031] Call Trace: [ 115.563361][ T9031] [ 115.563366][ T9031] dump_stack_lvl+0x100/0x190 [ 115.563394][ T9031] should_fail_ex.cold+0x5/0xa [ 115.563410][ T9031] _copy_from_iter+0x1f4/0x1690 [ 115.563429][ T9031] ? __pfx__copy_from_iter+0x10/0x10 [ 115.563441][ T9031] ? bio_associate_blkg+0xcf/0x730 [ 115.563455][ T9031] ? bio_init+0x404/0x610 [ 115.563468][ T9031] ? bio_alloc_bioset+0x25d/0x1060 [ 115.563483][ T9031] copy_page_from_iter+0x238/0x300 [ 115.563521][ T9031] bio_copy_from_iter+0x129/0x280 [ 115.563539][ T9031] blk_rq_map_user_iov+0xa20/0x1440 [ 115.563555][ T9031] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 115.563569][ T9031] ? rcu_is_watching+0x13/0xc0 [ 115.563584][ T9031] ? trace_contention_end+0x126/0x160 [ 115.563598][ T9031] ? __mutex_lock+0x26c/0x1bd0 [ 115.563619][ T9031] ? sg_common_write.isra.0+0xb79/0x1b90 [ 115.563648][ T9031] ? find_held_lock+0x2b/0x80 [ 115.563665][ T9031] ? sg_common_write.isra.0+0xe26/0x1b90 [ 115.563677][ T9031] ? import_ubuf+0x1b6/0x220 [ 115.563689][ T9031] blk_rq_map_user_io+0x1ff/0x230 [ 115.563702][ T9031] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 115.563721][ T9031] sg_common_write.isra.0+0xf74/0x1b90 [ 115.563740][ T9031] ? __pfx_sg_common_write.isra.0+0x10/0x10 [ 115.563759][ T9031] sg_write+0x7eb/0xdb0 [ 115.563774][ T9031] ? __pfx_sg_write+0x10/0x10 [ 115.563801][ T9031] ? bpf_lsm_file_permission+0x9/0x10 [ 115.563816][ T9031] ? security_file_permission+0x76/0x210 [ 115.563830][ T9031] ? rw_verify_area+0xce/0x6d0 [ 115.563848][ T9031] vfs_write+0x2aa/0x1050 [ 115.563860][ T9031] ? __pfx_sg_write+0x10/0x10 [ 115.563872][ T9031] ? lock_acquire+0x1d1/0x380 [ 115.563883][ T9031] ? __fget_files+0x34/0x3d0 [ 115.563896][ T9031] ? __pfx_vfs_write+0x10/0x10 [ 115.563906][ T9031] ? find_held_lock+0x2b/0x80 [ 115.563921][ T9031] ? __fget_files+0x215/0x3d0 [ 115.563934][ T9031] ? __fget_files+0x215/0x3d0 [ 115.563949][ T9031] ? __fget_files+0x21f/0x3d0 [ 115.563966][ T9031] ksys_write+0x12a/0x250 [ 115.563977][ T9031] ? __pfx_ksys_write+0x10/0x10 [ 115.563992][ T9031] do_syscall_64+0x123/0x790 [ 115.564010][ T9031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.564021][ T9031] RIP: 0033:0x7f4ccd59e159 [ 115.564031][ T9031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.564042][ T9031] RSP: 002b:00007f4cce488028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.564053][ T9031] RAX: ffffffffffffffda RBX: 00007f4ccd825fa0 RCX: 00007f4ccd59e159 [ 115.564060][ T9031] RDX: 0000000000000125 RSI: 0000200000000480 RDI: 0000000000000003 [ 115.564066][ T9031] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 115.564072][ T9031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 115.564079][ T9031] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 115.564093][ T9031] [ 115.597879][ T9036] openvswitch: netlink: IPv6 tunnel dst address is zero [ 115.599331][ T9036] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1122'. [ 115.600502][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.600666][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.600819][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.600974][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.601118][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.602498][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.602657][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.602807][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.602989][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.603147][ T9036] netlink: 'syz.1.1122': attribute type 3 has an invalid length. [ 115.983238][ T9058] macvlan0: entered promiscuous mode [ 116.067571][ T9062] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1127'. [ 116.067585][ T9062] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1127'. [ 116.140610][ T9069] gadgetfs: bound to dummy_udc driver [ 116.322158][ T9080] busy [ 116.322606][ T9080] overlayfs: failed to resolve './bus': -2 [ 116.401309][ T9084] trusted_key: encrypted_key: insufficient parameters specified [ 116.474398][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.474438][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.474466][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.474497][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.836457][ T9119] busy [ 116.836838][ T9119] overlayfs: failed to resolve './bus': -2 [ 116.932487][ T9122] can0: slcan on ttynull. [ 117.002166][ T9126] gadgetfs: bound to dummy_udc driver [ 117.024984][ T43] audit: type=1400 audit(372.952:604): avc: denied { write } for pid=9124 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.061208][ T9130] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 117.078912][ T43] audit: type=1400 audit(373.002:605): avc: denied { write } for pid=9131 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.117653][ T9134] overlay: Unknown parameter 'fowner<00000000000000000000' [ 117.169937][ T57] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 117.187555][ T9136] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 117.308181][ T43] audit: type=1400 audit(373.232:606): avc: denied { create } for pid=9145 comm="syz.2.1154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 117.328646][ T43] audit: type=1400 audit(373.252:607): avc: denied { read } for pid=9145 comm="syz.2.1154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 117.331397][ T57] usb 6-1: Using ep0 maxpacket: 16 [ 117.332092][ T57] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 117.333348][ T57] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 117.333367][ T57] usb 6-1: config 0 has no interfaces? [ 117.336066][ T57] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.336085][ T57] usb 6-1: Product: syz [ 117.336099][ T57] usb 6-1: Manufacturer: syz [ 117.336111][ T57] usb 6-1: SerialNumber: syz [ 117.338495][ T57] usb 6-1: config 0 descriptor?? [ 117.601349][ T43] audit: type=1400 audit(373.532:608): avc: denied { getopt } for pid=9148 comm="syz.0.1155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 117.641426][ T5742] Bluetooth: hci1: Dropping invalid advertising data [ 117.641455][ T5742] Bluetooth: hci1: Malformed LE Event: 0x02 [ 117.641891][ T9151] syzkaller1: entered promiscuous mode [ 117.641902][ T9151] syzkaller1: entered allmulticast mode [ 117.875157][ T9153] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 118.263413][ T9167] netlink: Unknown conntrack attr (type=53, max=9) [ 118.263432][ T9167] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 118.485585][ T9181] overlayfs: failed to resolve './bus': -2 [ 118.521659][ T43] audit: type=1400 audit(374.452:609): avc: denied { watch_mount } for pid=9182 comm="syz.2.1167" path="/303" dev="tmpfs" ino=1702 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 118.565712][ T13] ip6_tunnel: K xmit: Local address not yet configured! [ 118.590723][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.590813][ T5778] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.590852][ T5778] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.590881][ T5778] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.713920][ T9189] netlink: 6256 bytes leftover after parsing attributes in process `syz.2.1177'. [ 118.968136][ T9193] trusted_key: encrypted_key: insufficient parameters specified [ 119.473586][ T9205] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 119.473633][ T9205] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 119.496963][ T9205] smpboot: CPU 1 is now offline [ 119.871158][ T5806] usb 6-1: USB disconnect, device number 15 [ 120.003335][ T9222] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1182'. [ 120.013913][ T9120] can0 (unregistered): slcan off ttynull. [ 120.337728][ T9268] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1194'. [ 120.369480][ T9268] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1194'. [ 120.451405][ T9282] FAULT_INJECTION: forcing a failure. [ 120.451405][ T9282] name fail_futex, interval 1, probability 0, space 0, times 0 [ 120.451427][ T9282] CPU: 3 UID: 0 PID: 9282 Comm: syz.1.1200 Tainted: G L syzkaller #0 PREEMPT(full) [ 120.451443][ T9282] Tainted: [L]=SOFTLOCKUP [ 120.451447][ T9282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.451454][ T9282] Call Trace: [ 120.451458][ T9282] [ 120.451463][ T9282] dump_stack_lvl+0x100/0x190 [ 120.451517][ T9282] should_fail_ex.cold+0x5/0xa [ 120.451535][ T9282] get_futex_key+0x1d0/0x14f0 [ 120.451554][ T9282] ? __pfx_get_futex_key+0x10/0x10 [ 120.451569][ T9282] ? find_held_lock+0x2b/0x80 [ 120.451586][ T9282] ? futex_wake+0x4ea/0x5e0 [ 120.451607][ T9282] futex_wake+0xf4/0x5e0 [ 120.451623][ T9282] ? futex_wait+0x11e/0x370 [ 120.451636][ T9282] ? __pfx_futex_wake+0x10/0x10 [ 120.451662][ T9282] do_futex+0x2b2/0x440 [ 120.451678][ T9282] ? __pfx_do_futex+0x10/0x10 [ 120.451695][ T9282] ? putname+0xb1/0x110 [ 120.451709][ T9282] ? kmem_cache_free+0x127/0x6c0 [ 120.451728][ T9282] __x64_sys_futex+0x34f/0x4d0 [ 120.451746][ T9282] ? __pfx___x64_sys_futex+0x10/0x10 [ 120.451767][ T9282] do_syscall_64+0x123/0x790 [ 120.451785][ T9282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.451797][ T9282] RIP: 0033:0x7f4ccd59e159 [ 120.451806][ T9282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.451818][ T9282] RSP: 002b:00007f4cce4880e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 120.451830][ T9282] RAX: ffffffffffffffda RBX: 00007f4ccd825fa8 RCX: 00007f4ccd59e159 [ 120.451837][ T9282] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4ccd825fac [ 120.451843][ T9282] RBP: 00007f4ccd825fa0 R08: 0000000000000001 R09: 0000000000000000 [ 120.451850][ T9282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.451857][ T9282] R13: 00007f4ccd826038 R14: 00007ffc594d7860 R15: 00007ffc594d7948 [ 120.451871][ T9282] [ 120.521831][ T9286] overlayfs: failed to resolve './bus': -2 [ 120.655100][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 120.655113][ T43] audit: type=1400 audit(376.582:620): avc: denied { bind } for pid=9294 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 120.655597][ T43] audit: type=1400 audit(376.582:621): avc: denied { listen } for pid=9294 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 120.656199][ T43] audit: type=1400 audit(376.582:622): avc: denied { connect } for pid=9294 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 120.678816][ T43] audit: type=1400 audit(376.602:623): avc: denied { accept } for pid=9294 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 120.761319][ T9298] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 121.040612][ T9305] syzkaller1: entered promiscuous mode [ 121.040626][ T9305] syzkaller1: entered allmulticast mode [ 121.048604][ T9305] x_tables: ip_tables: .0 target: invalid size 8 (kernel) != (user) 4 [ 121.274822][ T9318] busy [ 121.275673][ T9318] overlayfs: failed to resolve './bus': -2 [ 121.288420][ T9320] FAULT_INJECTION: forcing a failure. [ 121.288420][ T9320] name fail_futex, interval 1, probability 0, space 0, times 0 [ 121.288445][ T9320] CPU: 3 UID: 0 PID: 9320 Comm: syz.0.1213 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.288461][ T9320] Tainted: [L]=SOFTLOCKUP [ 121.288466][ T9320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.288473][ T9320] Call Trace: [ 121.288477][ T9320] [ 121.288483][ T9320] dump_stack_lvl+0x100/0x190 [ 121.288504][ T9320] should_fail_ex.cold+0x5/0xa [ 121.288520][ T9320] get_futex_key+0x1d0/0x14f0 [ 121.288538][ T9320] ? __pfx_get_futex_key+0x10/0x10 [ 121.288558][ T9320] futex_wait_setup+0x91/0x540 [ 121.288574][ T9320] __futex_wait+0x19f/0x300 [ 121.288604][ T9320] ? __pfx___futex_wait+0x10/0x10 [ 121.288614][ T9320] ? __pfx_try_to_wake_up+0x10/0x10 [ 121.288631][ T9320] ? futex_hash+0x311/0x400 [ 121.288647][ T9320] ? __pfx_futex_wake_mark+0x10/0x10 [ 121.288667][ T9320] ? find_held_lock+0x2b/0x80 [ 121.288682][ T9320] ? futex_wake+0x4ea/0x5e0 [ 121.288703][ T9320] futex_wait+0xe6/0x370 [ 121.288714][ T9320] ? __pfx_futex_wait+0x10/0x10 [ 121.288727][ T9320] ? percpu_counter_add_batch+0xb9/0x230 [ 121.288742][ T9320] ? errseq_sample+0x51/0x70 [ 121.288754][ T9320] ? file_init_path+0x48e/0x670 [ 121.288772][ T9320] do_futex+0x265/0x440 [ 121.288788][ T9320] ? __pfx_do_futex+0x10/0x10 [ 121.288804][ T9320] ? fd_install+0x223/0x580 [ 121.288820][ T9320] __x64_sys_futex+0x34f/0x4d0 [ 121.288837][ T9320] ? __sys_socket+0xac/0x260 [ 121.288848][ T9320] ? __pfx___x64_sys_futex+0x10/0x10 [ 121.288870][ T9320] do_syscall_64+0x123/0x790 [ 121.288888][ T9320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.288900][ T9320] RIP: 0033:0x7faa7279e159 [ 121.288909][ T9320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.288921][ T9320] RSP: 002b:00007faa7374b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 121.288932][ T9320] RAX: ffffffffffffffda RBX: 00007faa72a25fa8 RCX: 00007faa7279e159 [ 121.288940][ T9320] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007faa72a25fa8 [ 121.288946][ T9320] RBP: 00007faa72a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 121.288954][ T9320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 121.288961][ T9320] R13: 00007faa72a26038 R14: 00007ffe72f49b50 R15: 00007ffe72f49c38 [ 121.288976][ T9320] [ 121.498189][ T9327] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1217'. [ 121.699074][ T9350] 9pnet_virtio: no channels available for device syz [ 121.717585][ T43] audit: type=1400 audit(377.642:624): avc: denied { unmount } for pid=5740 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 121.796081][ T5742] Bluetooth: hci1: command 0x2016 tx timeout [ 121.855607][ T9360] busy [ 121.856056][ T9360] overlayfs: failed to resolve './bus': -2 [ 122.058867][ T43] audit: type=1400 audit(377.982:625): avc: denied { getopt } for pid=9361 comm="syz.0.1226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.152121][ T9371] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 122.400054][ T57] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 122.439992][ C3] ip6_tunnel: K xmit: Local address not yet configured! [ 122.472430][ T9385] gadgetfs: bound to dummy_udc driver [ 122.582294][ T57] usb 8-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 122.584471][ T57] usb 8-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 122.584495][ T57] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 122.584513][ T57] usb 8-1: config 1 has no interface number 0 [ 122.588124][ T57] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.588147][ T57] usb 8-1: Product: syz [ 122.588160][ T57] usb 8-1: Manufacturer: syz [ 122.588173][ T57] usb 8-1: SerialNumber: syz [ 122.626327][ T57] usb 8-1: 3:1 : does not exist [ 122.626346][ T57] usb 8-1: 3:2 : does not exist [ 122.668449][ T9399] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 122.970145][ T9419] gadgetfs: bound to dummy_udc driver [ 123.024037][ T9421] 9pnet_virtio: no channels available for device syz [ 123.172926][ T9431] overlayfs: failed to resolve './bus': -2 [ 123.308211][ T43] audit: type=1400 audit(379.232:626): avc: denied { read write } for pid=9436 comm="syz.0.1248" name="uhid" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 123.308266][ T43] audit: type=1400 audit(379.232:627): avc: denied { open } for pid=9436 comm="syz.0.1248" path="/dev/uhid" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 123.321807][ T43] audit: type=1400 audit(379.242:628): avc: denied { ioctl } for pid=9436 comm="syz.0.1248" path="/dev/uhid" dev="devtmpfs" ino=1293 ioctlcmd=0x5882 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 123.361604][ T5806] usb 8-1: USB disconnect, device number 10 [ 123.561272][ T9448] FAULT_INJECTION: forcing a failure. [ 123.561272][ T9448] name failslab, interval 1, probability 0, space 0, times 0 [ 123.561294][ T9448] CPU: 3 UID: 0 PID: 9448 Comm: syz.1.1251 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.561309][ T9448] Tainted: [L]=SOFTLOCKUP [ 123.561313][ T9448] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.561319][ T9448] Call Trace: [ 123.561324][ T9448] [ 123.561328][ T9448] dump_stack_lvl+0x100/0x190 [ 123.561358][ T9448] should_fail_ex.cold+0x5/0xa [ 123.561375][ T9448] should_failslab+0xc2/0x120 [ 123.561393][ T9448] __kmalloc_cache_noprof+0x91/0x6d0 [ 123.561411][ T9448] ? usbdev_ioctl+0x1a7/0x3a90 [ 123.561426][ T9448] ? proc_do_submiturb+0x1d49/0x3820 [ 123.561441][ T9448] proc_do_submiturb+0x1d49/0x3820 [ 123.561463][ T9448] usbdev_ioctl+0x2ae7/0x3a90 [ 123.561481][ T9448] ? __pfx_usbdev_ioctl+0x10/0x10 [ 123.561502][ T9448] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 123.561517][ T9448] ? do_vfs_ioctl+0x226/0x13e0 [ 123.561529][ T9448] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 123.561539][ T9448] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 123.561555][ T9448] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 123.561570][ T9448] ? __fget_files+0x34/0x3d0 [ 123.561589][ T9448] ? selinux_file_ioctl+0x13b/0x290 [ 123.561601][ T9448] ? selinux_file_ioctl+0xb6/0x290 [ 123.561615][ T9448] ? __pfx_usbdev_ioctl+0x10/0x10 [ 123.561630][ T9448] __x64_sys_ioctl+0x18e/0x210 [ 123.561649][ T9448] do_syscall_64+0x123/0x790 [ 123.561677][ T9448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.561688][ T9448] RIP: 0033:0x7f4ccd59e159 [ 123.561698][ T9448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.561709][ T9448] RSP: 002b:00007f4cce488028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 123.561721][ T9448] RAX: ffffffffffffffda RBX: 00007f4ccd825fa0 RCX: 00007f4ccd59e159 [ 123.561728][ T9448] RDX: 0000200000000000 RSI: 000000008038550a RDI: 0000000000000004 [ 123.561735][ T9448] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 123.561741][ T9448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.561747][ T9448] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 123.561762][ T9448] [ 123.591414][ T9450] gadgetfs: bound to dummy_udc driver [ 123.997079][ T9478] busy [ 123.997506][ T9478] overlayfs: failed to resolve './bus': -2 [ 124.049559][ T9482] gadgetfs: bound to dummy_udc driver [ 124.114276][ T9486] bond2: (slave bond_slave_0): Device is not bonding slave [ 124.114291][ T9486] bond2: option active_slave: invalid value (bond_slave_0) [ 124.123603][ T9486] bond2 (unregistering): Released all slaves [ 124.140172][ T9492] validate_nla: 23 callbacks suppressed [ 124.140187][ T9492] netlink: 'syz.0.1264': attribute type 6 has an invalid length. [ 124.140194][ T9492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1264'. [ 124.190778][ T9495] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 124.312760][ T9507] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1271'. [ 124.384249][ T9513] gadgetfs: bound to dummy_udc driver [ 124.433664][ T25] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 124.451513][ T43] audit: type=1400 audit(380.382:629): avc: denied { bind } for pid=9522 comm="syz.2.1277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 124.452711][ T9523] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 124.507505][ T9529] busy [ 124.508003][ T9529] overlayfs: failed to resolve './bus': -2 [ 124.580658][ T25] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 124.581641][ T25] usb 6-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 124.581662][ T25] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 124.581680][ T25] usb 6-1: config 1 has no interface number 0 [ 124.583539][ T25] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.583552][ T25] usb 6-1: Product: syz [ 124.583559][ T25] usb 6-1: Manufacturer: syz [ 124.583566][ T25] usb 6-1: SerialNumber: syz [ 124.588303][ T25] usb 6-1: 3:1 : does not exist [ 124.588317][ T25] usb 6-1: 3:2 : does not exist [ 124.639531][ T9541] tipc: Enabling of bearer rejected, failed to enable media [ 124.639670][ T9539] gadgetfs: bound to dummy_udc driver [ 124.978943][ T9574] tipc: Started in network mode [ 124.978962][ T9574] tipc: Node identity 1000001, cluster identity 4369 [ 124.978973][ T9574] tipc: Node number set to 16777217 [ 124.979300][ T9574] tipc: Cannot configure node identity twice [ 125.000526][ T9574] e1000 0000:00:06.0 eth0: Unsupported Speed/Duplex configuration [ 125.001415][ T9574] tipc: New replicast peer: 127.0.0.1 [ 125.001905][ T9574] tipc: Enabled bearer , priority 10 [ 125.019295][ T9575] overlayfs: failed to resolve './bus': -2 [ 125.090143][ T9577] gadgetfs: bound to dummy_udc driver [ 125.199510][ T9582] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1298'. [ 125.229672][ T9584] xt_SECMARK: invalid mode: 2 [ 125.298420][ T9586] tipc: Can't bind to reserved service type 0 [ 125.299133][ T9587] FAULT_INJECTION: forcing a failure. [ 125.299133][ T9587] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.299163][ T9587] CPU: 0 UID: 0 PID: 9587 Comm: syz.3.1300 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.299188][ T9587] Tainted: [L]=SOFTLOCKUP [ 125.299194][ T9587] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.299203][ T9587] Call Trace: [ 125.299208][ T9587] [ 125.299216][ T9587] dump_stack_lvl+0x100/0x190 [ 125.299245][ T9587] should_fail_ex.cold+0x5/0xa [ 125.299268][ T9587] _copy_to_user+0x32/0xd0 [ 125.299293][ T9587] simple_read_from_buffer+0xcb/0x170 [ 125.299320][ T9587] proc_fail_nth_read+0x1af/0x230 [ 125.299362][ T9587] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.299388][ T9587] ? rw_verify_area+0xce/0x6d0 [ 125.299415][ T9587] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.299438][ T9587] vfs_read+0x1e4/0xb40 [ 125.299476][ T9587] ? lock_acquire+0x1d1/0x380 [ 125.299497][ T9587] ? __fget_files+0x34/0x3d0 [ 125.299521][ T9587] ? __pfx_vfs_read+0x10/0x10 [ 125.299537][ T9587] ? find_held_lock+0x2b/0x80 [ 125.299563][ T9587] ? __fget_files+0x215/0x3d0 [ 125.299589][ T9587] ? __fget_files+0x21f/0x3d0 [ 125.299614][ T9587] ksys_read+0x12a/0x250 [ 125.299630][ T9587] ? __pfx_ksys_read+0x10/0x10 [ 125.299654][ T9587] do_syscall_64+0x123/0x790 [ 125.299680][ T9587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.299700][ T9587] RIP: 0033:0x7f9e8b15e98e [ 125.299715][ T9587] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.299729][ T9587] RSP: 002b:00007f9e8bff7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 125.299749][ T9587] RAX: ffffffffffffffda RBX: 00007f9e8bff86c0 RCX: 00007f9e8b15e98e [ 125.299760][ T9587] RDX: 000000000000000f RSI: 00007f9e8bff80a0 RDI: 0000000000000004 [ 125.299771][ T9587] RBP: 00007f9e8bff8090 R08: 0000000000000000 R09: 0000000000000000 [ 125.299781][ T9587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.299793][ T9587] R13: 00007f9e8b426038 R14: 00007f9e8b425fa0 R15: 00007ffffbc0f7d8 [ 125.299819][ T9587] [ 125.356334][ T5878] usb 6-1: USB disconnect, device number 16 [ 125.602966][ T9596] xt_l2tp: missing protocol rule (udp|l2tpip) [ 125.721910][ T9603] tmpfs: Bad value for 'mpol' [ 126.092838][ T9617] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1312'. [ 126.092866][ T9617] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1312'. [ 126.139735][ T9619] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1313'. [ 126.143764][ T9619] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1313'. [ 126.150812][ T5878] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 126.160580][ T9621] FAULT_INJECTION: forcing a failure. [ 126.160580][ T9621] name failslab, interval 1, probability 0, space 0, times 0 [ 126.160621][ T9621] CPU: 2 UID: 0 PID: 9621 Comm: syz.3.1314 Tainted: G L syzkaller #0 PREEMPT(full) [ 126.160650][ T9621] Tainted: [L]=SOFTLOCKUP [ 126.160658][ T9621] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.160669][ T9621] Call Trace: [ 126.160676][ T9621] [ 126.160683][ T9621] dump_stack_lvl+0x100/0x190 [ 126.160720][ T9621] should_fail_ex.cold+0x5/0xa [ 126.160751][ T9621] should_failslab+0xc2/0x120 [ 126.160778][ T9621] __kmalloc_noprof+0xfc/0x840 [ 126.160801][ T9621] ? tomoyo_encode2+0xfb/0x3c0 [ 126.160880][ T9621] tomoyo_encode2+0xfb/0x3c0 [ 126.160920][ T9621] tomoyo_encode+0x29/0x50 [ 126.160939][ T9621] tomoyo_realpath_from_path+0x18c/0x690 [ 126.160968][ T9621] tomoyo_path_number_perm+0x23c/0x580 [ 126.160985][ T9621] ? tomoyo_path_number_perm+0x22e/0x580 [ 126.161006][ T9621] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 126.161035][ T9621] ? __lock_acquire+0x5c0/0x1f40 [ 126.161068][ T9621] ? __fget_files+0x34/0x3d0 [ 126.161091][ T9621] ? find_held_lock+0x2b/0x80 [ 126.161117][ T9621] ? hook_file_ioctl_common+0x140/0x440 [ 126.161143][ T9621] ? __fget_files+0x21f/0x3d0 [ 126.161166][ T9621] security_file_ioctl+0xd3/0x230 [ 126.161187][ T9621] __x64_sys_ioctl+0xb7/0x210 [ 126.161208][ T9621] do_syscall_64+0x123/0x790 [ 126.161239][ T9621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.161256][ T9621] RIP: 0033:0x7f9e8b19e159 [ 126.161271][ T9621] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.161289][ T9621] RSP: 002b:00007f9e8bff8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 126.161307][ T9621] RAX: ffffffffffffffda RBX: 00007f9e8b425fa0 RCX: 00007f9e8b19e159 [ 126.161318][ T9621] RDX: 0000200000000040 RSI: 0000000080045519 RDI: 0000000000000003 [ 126.161330][ T9621] RBP: 00007f9e8bff8090 R08: 0000000000000000 R09: 0000000000000000 [ 126.161341][ T9621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 126.161351][ T9621] R13: 00007f9e8b426038 R14: 00007f9e8b425fa0 R15: 00007ffffbc0f7d8 [ 126.161375][ T9621] [ 126.161396][ T9621] ERROR: Out of memory at tomoyo_realpath_from_path. [ 126.203048][ T9624] gadgetfs: bound to dummy_udc driver [ 126.215772][ T9625] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 126.300630][ T5878] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 126.301889][ T5878] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 126.303696][ T5878] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.303716][ T5878] usb 6-1: Product: syz [ 126.303727][ T5878] usb 6-1: Manufacturer: syz [ 126.303738][ T5878] usb 6-1: SerialNumber: syz [ 126.312737][ T5878] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 126.313001][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 87 [ 126.313123][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 7 [ 126.319190][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 126.319231][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 82 [ 126.319261][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 126.319291][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 126.319321][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 85 [ 126.319352][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 5 [ 126.329467][ T5878] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 126.331344][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 83 [ 126.331415][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 126.331512][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 126.331579][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 4 [ 126.331651][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 86 [ 126.331715][ T5878] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 126.333796][ T5878] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 126.388254][ T9631] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1319'. [ 126.433648][ T9633] netlink: 'syz.3.1320': attribute type 10 has an invalid length. [ 126.434124][ T9633] syz_tun: entered promiscuous mode [ 126.441960][ T9633] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 126.449297][ T9633] batman_adv: batadv0: Adding interface: dummy0 [ 126.449312][ T9633] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.449386][ T9633] batman_adv: batadv0: Interface activated: dummy0 [ 126.561034][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 126.561053][ T43] audit: type=1804 audit(382.482:634): pid=9608 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.1308" name="/newroot/311/file1" dev="tmpfs" ino=1709 res=1 errno=0 [ 126.587874][ T9639] befs: (nbd0): unable to read superblock [ 126.608521][ T9638] batadv0: mtu less than device minimum [ 126.609036][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.610211][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.610723][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.611222][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.611745][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.612840][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.613336][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.613829][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.614317][ T9638] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 126.650806][ T9633] netlink: 'syz.3.1320': attribute type 10 has an invalid length. [ 126.650820][ T9633] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1320'. [ 126.659645][ T9608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1308'. [ 126.666225][ T9633] batadv0: entered promiscuous mode [ 126.666612][ T9633] bridge0: port 3(batadv0) entered blocking state [ 126.666697][ T9633] bridge0: port 3(batadv0) entered disabled state [ 126.669305][ T9633] bridge0: port 3(batadv0) entered blocking state [ 126.669351][ T9633] bridge0: port 3(batadv0) entered forwarding state [ 126.669423][ T5100] usb 6-1: USB disconnect, device number 17 [ 126.715194][ T5100] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 126.722723][ T5100] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 126.723241][ T5100] keyspan 6-1:1.0: device disconnected [ 127.086838][ T9663] netlink: 'syz.2.1333': attribute type 6 has an invalid length. [ 127.086852][ T9663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1333'. [ 127.106110][ T9661] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 127.170561][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 127.170580][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 127.202731][ T9666] tipc: Enabling of bearer rejected, failed to enable media [ 127.327045][ T43] audit: type=1400 audit(383.252:635): avc: denied { setopt } for pid=9677 comm="syz.3.1338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 127.341108][ T5100] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 127.377455][ T9680] random: crng reseeded on system resumption [ 127.387834][ T9680] fuse: Bad value for 'rootmode' [ 127.485476][ T9700] e1000 0000:00:06.0 eth0: Unsupported Speed/Duplex configuration [ 127.485690][ T9700] tipc: Enabling of bearer rejected, failed to enable media [ 127.512664][ T5100] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 127.513663][ T5100] usb 5-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 127.513686][ T5100] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 127.513703][ T5100] usb 5-1: config 1 has no interface number 0 [ 127.519913][ T5100] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.519937][ T5100] usb 5-1: Product: syz [ 127.519949][ T5100] usb 5-1: Manufacturer: syz [ 127.519961][ T5100] usb 5-1: SerialNumber: syz [ 127.531198][ T5100] usb 5-1: 3:1 : does not exist [ 127.531221][ T5100] usb 5-1: 3:2 : does not exist [ 127.699798][ T9713] ±ÿª¨úrBº“€: renamed from lo (while UP) [ 127.704468][ T43] audit: type=1400 audit(383.632:636): avc: denied { shutdown } for pid=9709 comm="syz.3.1349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 127.803838][ T43] audit: type=1400 audit(383.732:637): avc: denied { ioctl } for pid=9718 comm="syz.1.1352" path="socket:[30856]" dev="sockfs" ino=30856 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 127.975082][ T9727] gadgetfs: bound to dummy_udc driver [ 128.042606][ T9729] e1000 0000:00:06.0 eth0: Unsupported Speed/Duplex configuration [ 128.042978][ T9729] tipc: Enabling of bearer rejected, failed to enable media [ 128.285593][ T5878] usb 5-1: USB disconnect, device number 9 [ 128.358801][ T9744] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1362'. [ 128.369664][ T9740] ±ÿª¨úrBº“€: renamed from lo (while UP) [ 128.463852][ T43] audit: type=1400 audit(384.392:638): avc: denied { bind } for pid=9749 comm="syz.1.1365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 128.463899][ T43] audit: type=1400 audit(384.392:639): avc: denied { node_bind } for pid=9749 comm="syz.1.1365" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 128.592382][ T9761] FAULT_INJECTION: forcing a failure. [ 128.592382][ T9761] name failslab, interval 1, probability 0, space 0, times 0 [ 128.592417][ T9761] CPU: 2 UID: 0 PID: 9761 Comm: syz.1.1370 Tainted: G L syzkaller #0 PREEMPT(full) [ 128.592441][ T9761] Tainted: [L]=SOFTLOCKUP [ 128.592448][ T9761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.592459][ T9761] Call Trace: [ 128.592465][ T9761] [ 128.592473][ T9761] dump_stack_lvl+0x100/0x190 [ 128.592505][ T9761] should_fail_ex.cold+0x5/0xa [ 128.592532][ T9761] should_failslab+0xc2/0x120 [ 128.592557][ T9761] kmem_cache_alloc_noprof+0x92/0x6a0 [ 128.592578][ T9761] ? security_file_alloc+0x34/0x2c0 [ 128.592606][ T9761] security_file_alloc+0x34/0x2c0 [ 128.592628][ T9761] init_file+0x95/0x480 [ 128.592651][ T9761] alloc_empty_file+0x79/0x1c0 [ 128.592674][ T9761] path_openat+0xdb/0x2440 [ 128.592701][ T9761] ? __pfx_path_openat+0x10/0x10 [ 128.592727][ T9761] do_file_open+0x20e/0x430 [ 128.592751][ T9761] ? __pfx_do_file_open+0x10/0x10 [ 128.592791][ T9761] ? _raw_spin_unlock+0x28/0x50 [ 128.592814][ T9761] ? alloc_fd+0x471/0x7a0 [ 128.592844][ T9761] do_sys_openat2+0x10f/0x1e0 [ 128.592869][ T9761] ? __pfx_do_sys_openat2+0x10/0x10 [ 128.592895][ T9761] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 128.592924][ T9761] ? __fget_files+0x21f/0x3d0 [ 128.592951][ T9761] __x64_sys_openat+0x12d/0x210 [ 128.592979][ T9761] ? __pfx___x64_sys_openat+0x10/0x10 [ 128.593004][ T9761] ? ksys_write+0x1ac/0x250 [ 128.593030][ T9761] do_syscall_64+0x123/0x790 [ 128.593057][ T9761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.593075][ T9761] RIP: 0033:0x7f4ccd59e159 [ 128.593100][ T9761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.593120][ T9761] RSP: 002b:00007f4cce488028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 128.593142][ T9761] RAX: ffffffffffffffda RBX: 00007f4ccd825fa0 RCX: 00007f4ccd59e159 [ 128.593156][ T9761] RDX: 0000000000000400 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 128.593169][ T9761] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 128.593182][ T9761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.593193][ T9761] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 128.593222][ T9761] [ 128.696750][ T9767] gadgetfs: bound to dummy_udc driver [ 128.840177][ T5778] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 128.840211][ T5778] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.869244][ T9777] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9777 comm=syz.2.1375 [ 128.960599][ T9784] can0: slcan on ttynull. [ 129.006913][ T43] audit: type=1400 audit(384.932:640): avc: denied { write } for pid=9788 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.064441][ T43] audit: type=1400 audit(384.992:641): avc: denied { write } for pid=9792 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.152752][ T9800] sd 0:0:0:0: PR command failed: 1026 [ 129.152799][ T9800] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 129.152843][ T9800] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 129.237473][ T43] audit: type=1400 audit(385.162:642): avc: denied { write } for pid=9803 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.325815][ T43] audit: type=1400 audit(385.252:643): avc: denied { write } for pid=9815 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.712371][ T5739] Bluetooth: hci1: command 0x2016 tx timeout [ 130.199984][ C3] ip6_tunnel: K xmit: Local address not yet configured! [ 130.344443][ T9832] netlink: 'syz.2.1391': attribute type 7 has an invalid length. [ 130.344466][ T9832] netlink: 'syz.2.1391': attribute type 8 has an invalid length. [ 130.447686][ T9838] fuse: Bad value for 'fd' [ 130.680505][ T5742] Bluetooth: hci2: command 0x0c1a tx timeout [ 130.990004][ T5734] Bluetooth: hci0: command 0x0c1a tx timeout [ 130.990128][ T9779] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 131.760061][ T13] net_ratelimit: 22 callbacks suppressed [ 131.760082][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 131.763049][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 131.763063][ T43] audit: type=1400 audit(387.692:646): avc: denied { getopt } for pid=9865 comm="syz.2.1405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 131.763481][ T5734] Bluetooth: hci0: unexpected event for opcode 0x0401 [ 131.771645][ T9866] 9pnet_fd: p9_fd_create_unix (9866): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 131.886500][ T9779] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 131.886634][ T9779] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 131.886747][ T9779] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 131.942025][ T9805] program syz.1.1384 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 131.985154][ T43] audit: type=1400 audit(387.912:647): avc: denied { write } for pid=9868 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.021024][ T9784] can0 (unregistered): slcan off ttynull. [ 132.055800][ T43] audit: type=1400 audit(387.982:648): avc: denied { write } for pid=9873 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.146386][ T9883] FAULT_INJECTION: forcing a failure. [ 132.146386][ T9883] name failslab, interval 1, probability 0, space 0, times 0 [ 132.146423][ T9883] CPU: 2 UID: 0 PID: 9883 Comm: syz.0.1409 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.146451][ T9883] Tainted: [L]=SOFTLOCKUP [ 132.146458][ T9883] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.146470][ T9883] Call Trace: [ 132.146477][ T9883] [ 132.146486][ T9883] dump_stack_lvl+0x100/0x190 [ 132.146520][ T9883] should_fail_ex.cold+0x5/0xa [ 132.146549][ T9883] should_failslab+0xc2/0x120 [ 132.146575][ T9883] __kmalloc_noprof+0xfc/0x840 [ 132.146595][ T9883] ? rcu_is_watching+0x13/0xc0 [ 132.146628][ T9883] ? tomoyo_realpath_from_path+0xb6/0x690 [ 132.146660][ T9883] tomoyo_realpath_from_path+0xb6/0x690 [ 132.146691][ T9883] tomoyo_path_number_perm+0x23c/0x580 [ 132.146711][ T9883] ? tomoyo_path_number_perm+0x22e/0x580 [ 132.146733][ T9883] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 132.146764][ T9883] ? __lock_acquire+0x5c0/0x1f40 [ 132.146798][ T9883] ? __fget_files+0x34/0x3d0 [ 132.146823][ T9883] ? find_held_lock+0x2b/0x80 [ 132.146850][ T9883] ? hook_file_ioctl_common+0x140/0x440 [ 132.146883][ T9883] ? __fget_files+0x21f/0x3d0 [ 132.146912][ T9883] security_file_ioctl+0xd3/0x230 [ 132.146936][ T9883] __x64_sys_ioctl+0xb7/0x210 [ 132.146960][ T9883] do_syscall_64+0x123/0x790 [ 132.146991][ T9883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.147012][ T9883] RIP: 0033:0x7faa7279e159 [ 132.147029][ T9883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.147048][ T9883] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.147076][ T9883] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 132.147090][ T9883] RDX: 0000200000000480 RSI: 00000000c1007c00 RDI: 0000000000000003 [ 132.147102][ T9883] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 132.147114][ T9883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 132.147126][ T9883] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 132.147154][ T9883] [ 132.147162][ T9883] ERROR: Out of memory at tomoyo_realpath_from_path. [ 132.230138][ T43] audit: type=1400 audit(388.152:649): avc: denied { write } for pid=9882 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.280584][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 132.306813][ T43] audit: type=1400 audit(388.232:650): avc: denied { write } for pid=9892 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.336799][ T9896] busy [ 132.337261][ T9896] overlayfs: failed to resolve './bus': -2 [ 132.383735][ T5778] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 132.383757][ T5778] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.434258][ T9904] FAULT_INJECTION: forcing a failure. [ 132.434258][ T9904] name failslab, interval 1, probability 0, space 0, times 0 [ 132.434280][ T9904] CPU: 0 UID: 0 PID: 9904 Comm: syz.0.1416 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.434295][ T9904] Tainted: [L]=SOFTLOCKUP [ 132.434299][ T9904] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.434305][ T9904] Call Trace: [ 132.434309][ T9904] [ 132.434314][ T9904] dump_stack_lvl+0x100/0x190 [ 132.434334][ T9904] should_fail_ex.cold+0x5/0xa [ 132.434350][ T9904] should_failslab+0xc2/0x120 [ 132.434365][ T9904] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 132.434378][ T9904] ? __d_alloc+0x35/0xa50 [ 132.434395][ T9904] __d_alloc+0x35/0xa50 [ 132.434412][ T9904] d_alloc_pseudo+0x1c/0xc0 [ 132.434423][ T9904] alloc_file_pseudo+0x118/0x290 [ 132.434440][ T9904] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 132.434455][ T9904] ? alloc_fd+0x471/0x7a0 [ 132.434469][ T9904] ? do_raw_spin_unlock+0x145/0x1e0 [ 132.434486][ T9904] __anon_inode_getfile+0xe8/0x280 [ 132.434500][ T9904] anon_inode_getfile_fmode+0x37/0xa0 [ 132.434513][ T9904] __do_sys_fanotify_init+0xa0d/0xe30 [ 132.434530][ T9904] do_syscall_64+0x123/0x790 [ 132.434548][ T9904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.434559][ T9904] RIP: 0033:0x7faa7279e159 [ 132.434569][ T9904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.434580][ T9904] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 000000000000012c [ 132.434591][ T9904] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 132.434599][ T9904] RDX: 0000000000000000 RSI: 0000000000040000 RDI: 0000000000000081 [ 132.434606][ T9904] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 132.434612][ T9904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 132.434619][ T9904] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 132.434633][ T9904] [ 132.434744][ T43] audit: type=1400 audit(388.362:651): avc: denied { write } for pid=9901 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.552578][ T9908] overlayfs: conflicting options: userxattr,metacopy=on [ 132.555704][ T9908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=42838 sclass=netlink_route_socket pid=9908 comm=syz.0.1418 [ 132.563112][ T9914] gadgetfs: bound to dummy_udc driver [ 132.580848][ T43] audit: type=1400 audit(388.512:652): avc: denied { write } for pid=9911 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.624788][ T9917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1420'. [ 132.686761][ T43] audit: type=1400 audit(388.612:653): avc: denied { write } for pid=9919 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.714259][ T43] audit: type=1400 audit(388.642:654): avc: denied { create } for pid=9925 comm="syz.1.1423" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 132.758779][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.765220][ T43] audit: type=1400 audit(388.692:655): avc: denied { write } for pid=9928 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.799977][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 132.992837][ T9943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1427'. [ 132.992866][ T9943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1427'. [ 133.000261][ T5806] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 133.071698][ T5742] Bluetooth: hci2: command 0x0c1a tx timeout [ 133.101379][ T9956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1430'. [ 133.101402][ T9956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1430'. [ 133.158638][ T5806] usb 5-1: Using ep0 maxpacket: 8 [ 133.159357][ T5806] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 133.161209][ T5806] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 133.161249][ T5806] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 133.161267][ T5806] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 133.161286][ T5806] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 133.161305][ T5806] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 133.161338][ T5806] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.310449][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 133.369931][ T5806] usb 5-1: usb_control_msg returned -32 [ 133.369970][ T5806] usbtmc 5-1:16.0: can't read capabilities [ 133.414788][ T9964] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 133.414992][ T9964] CIFS: Attempting to mount //1#7.0.0.1/Ë7Ì/Ðä…¯»—yshare [ 133.421312][ T9964] CIFS: VFS: Error connecting to socket. Aborting operation. [ 133.421373][ T9964] CIFS: VFS: cifs_mount failed w/return code = -111 [ 133.786094][ T9979] gadgetfs: bound to dummy_udc driver [ 133.796784][ T5742] Bluetooth: hci3: Invalid handle: 0xed88 > 0x0eff [ 133.806628][ T9982] batman_adv: batadv0: Adding interface: syzkaller0 [ 133.806643][ T9982] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.806668][ T9982] batman_adv: batadv0: Interface activated: syzkaller0 [ 133.806681][ T9982] batadv0: mtu less than device minimum [ 133.809108][ T9982] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 133.810199][ T9982] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 133.812020][ T9982] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 133.812999][ T9982] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 133.813924][ T9982] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 133.860935][ T9980] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 133.902876][ T9987] erspan1: entered allmulticast mode [ 133.907679][ T9981] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 133.937106][ T9981] batman_adv: batadv0: Removing interface: syzkaller0 [ 133.944739][ T9986] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.949997][ T5734] Bluetooth: hci3: command 0x0c1a tx timeout [ 133.950036][ T5734] Bluetooth: hci1: command 0x2016 tx timeout [ 133.999640][ T9990] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.054900][ T9986] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.602670][T10013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1451'. [ 134.602695][T10013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1451'. [ 134.798361][T10019] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 134.849176][T10032] FAULT_INJECTION: forcing a failure. [ 134.849176][T10032] name failslab, interval 1, probability 0, space 0, times 0 [ 134.849202][T10032] CPU: 3 UID: 0 PID: 10032 Comm: syz.3.1459 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.849218][T10032] Tainted: [L]=SOFTLOCKUP [ 134.849222][T10032] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.849229][T10032] Call Trace: [ 134.849233][T10032] [ 134.849237][T10032] dump_stack_lvl+0x100/0x190 [ 134.849258][T10032] should_fail_ex.cold+0x5/0xa [ 134.849274][T10032] should_failslab+0xc2/0x120 [ 134.849290][T10032] __kmalloc_cache_noprof+0x91/0x6d0 [ 134.849308][T10032] ? fuse_dentry_init+0x45/0x130 [ 134.849322][T10032] ? __pfx_fuse_dentry_init+0x10/0x10 [ 134.849336][T10032] fuse_dentry_init+0x45/0x130 [ 134.849348][T10032] ? __pfx_fuse_dentry_init+0x10/0x10 [ 134.849361][T10032] __d_alloc+0x5fb/0xa50 [ 134.849378][T10032] d_alloc_parallel+0x105/0x14c0 [ 134.849393][T10032] ? lock_acquire+0x1d1/0x380 [ 134.849405][T10032] ? __d_lookup+0x73/0x4a0 [ 134.849417][T10032] ? __pfx_d_alloc_parallel+0x10/0x10 [ 134.849428][T10032] ? __d_lookup+0x25c/0x4a0 [ 134.849442][T10032] ? __d_lookup+0x266/0x4a0 [ 134.849463][T10032] lookup_open+0x6bb/0x1990 [ 134.849480][T10032] path_openat+0xa2c/0x2440 [ 134.849496][T10032] ? __pfx_path_openat+0x10/0x10 [ 134.849514][T10032] do_file_open+0x20e/0x430 [ 134.849529][T10032] ? __pfx_do_file_open+0x10/0x10 [ 134.849553][T10032] ? _raw_spin_unlock+0x28/0x50 [ 134.849567][T10032] ? alloc_fd+0x471/0x7a0 [ 134.849585][T10032] do_sys_openat2+0x10f/0x1e0 [ 134.849601][T10032] ? __pfx_do_sys_openat2+0x10/0x10 [ 134.849616][T10032] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 134.849634][T10032] ? __fget_files+0x21f/0x3d0 [ 134.849650][T10032] __x64_sys_openat+0x12d/0x210 [ 134.849666][T10032] ? __pfx___x64_sys_openat+0x10/0x10 [ 134.849680][T10032] ? ksys_write+0x1ac/0x250 [ 134.849697][T10032] do_syscall_64+0x123/0x790 [ 134.849714][T10032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.849726][T10032] RIP: 0033:0x7f9e8b19e159 [ 134.849735][T10032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.849746][T10032] RSP: 002b:00007f9e8bfd7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 134.849757][T10032] RAX: ffffffffffffffda RBX: 00007f9e8b426090 RCX: 00007f9e8b19e159 [ 134.849764][T10032] RDX: 0000000000060a41 RSI: 00002000000013c0 RDI: ffffffffffffff9c [ 134.849771][T10032] RBP: 00007f9e8bfd7090 R08: 0000000000000000 R09: 0000000000000000 [ 134.849777][T10032] R10: 0b3836f6d7a15f29 R11: 0000000000000246 R12: 0000000000000001 [ 134.849800][T10032] R13: 00007f9e8b426128 R14: 00007f9e8b426090 R15: 00007ffffbc0f7d8 [ 134.849815][T10032] [ 134.887396][T10034] netlink: 'syz.2.1460': attribute type 1 has an invalid length. [ 134.922744][T10034] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1460'. [ 134.923526][T10034] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1460'. [ 134.995255][T10039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1462'. [ 135.068059][T10043] FAULT_INJECTION: forcing a failure. [ 135.068059][T10043] name failslab, interval 1, probability 0, space 0, times 0 [ 135.068094][T10043] CPU: 3 UID: 0 PID: 10043 Comm: syz.1.1463 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.068122][T10043] Tainted: [L]=SOFTLOCKUP [ 135.068129][T10043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.068140][T10043] Call Trace: [ 135.068146][T10043] [ 135.068154][T10043] dump_stack_lvl+0x100/0x190 [ 135.068188][T10043] should_fail_ex.cold+0x5/0xa [ 135.068218][T10043] should_failslab+0xc2/0x120 [ 135.068244][T10043] kmem_cache_alloc_noprof+0x92/0x6a0 [ 135.068265][T10043] ? lockdep_init_map_type+0x5c/0x250 [ 135.068289][T10043] ? copy_process+0x47c7/0x8370 [ 135.068318][T10043] copy_process+0x47c7/0x8370 [ 135.068355][T10043] ? __pfx_copy_process+0x10/0x10 [ 135.068376][T10043] ? find_held_lock+0x2b/0x80 [ 135.068413][T10043] kernel_clone+0x176/0x9d0 [ 135.068434][T10043] ? find_held_lock+0x2b/0x80 [ 135.068462][T10043] ? __pfx_kernel_clone+0x10/0x10 [ 135.068490][T10043] ? ksys_write+0x190/0x250 [ 135.068512][T10043] ? lock_acquire+0x1d1/0x380 [ 135.068538][T10043] __do_sys_clone+0xd9/0x120 [ 135.068562][T10043] ? __pfx___do_sys_clone+0x10/0x10 [ 135.068583][T10043] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 135.068626][T10043] ? ksys_write+0x1ac/0x250 [ 135.068655][T10043] ? __pfx_ksys_write+0x10/0x10 [ 135.068685][T10043] do_syscall_64+0x123/0x790 [ 135.068715][T10043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.068734][T10043] RIP: 0033:0x7f4ccd59e159 [ 135.068751][T10043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.068768][T10043] RSP: 002b:00007f4cce487fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 135.068788][T10043] RAX: ffffffffffffffda RBX: 00007f4ccd825fa0 RCX: 00007f4ccd59e159 [ 135.068801][T10043] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 135.068812][T10043] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 135.068824][T10043] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 135.068835][T10043] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 135.068862][T10043] [ 135.174314][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 135.174330][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 135.174340][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x9196 instead [ 135.174350][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xd851 instead [ 135.174359][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 135.174368][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 135.174377][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 135.174388][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 135.174406][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 135.174424][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 135.174432][T10054] jffs2: Further such events for this erase block will not be printed [ 135.175174][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 135.175188][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 135.175198][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x9196 instead [ 135.175208][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xd851 instead [ 135.175216][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 135.175225][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 135.175233][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 135.175244][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 135.175262][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 135.175279][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 135.175287][T10054] jffs2: Further such events for this erase block will not be printed [ 135.175634][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 135.175650][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 135.175665][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x9196 instead [ 135.175679][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xd851 instead [ 135.175718][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 135.175732][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 135.175747][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x9196 instead [ 135.175764][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xd851 instead [ 135.175800][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 135.175815][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 135.175830][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x9196 instead [ 135.175846][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xd851 instead [ 135.175880][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 135.175894][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 135.175908][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x9196 instead [ 135.175924][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xd851 instead [ 135.175959][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 135.175978][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 135.176276][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x9196 instead [ 135.176294][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xd851 instead [ 135.176330][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 135.176344][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 135.176359][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x9196 instead [ 135.176375][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xd851 instead [ 135.176410][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 135.176425][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 135.176440][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x9196 instead [ 135.176457][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xd851 instead [ 135.176493][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 135.176508][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 135.176524][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x9196 instead [ 135.176540][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xd851 instead [ 135.176576][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 135.176590][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 135.176605][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x9196 instead [ 135.176622][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xd851 instead [ 135.176660][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 135.176671][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 135.176687][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x9196 instead [ 135.176703][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xd851 instead [ 135.176744][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 135.176754][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 135.176769][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x9196 instead [ 135.176785][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xd851 instead [ 135.176827][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 135.176838][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 135.176852][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x9196 instead [ 135.176868][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xd851 instead [ 135.176909][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 135.176923][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 135.176933][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x9196 instead [ 135.176951][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xd851 instead [ 135.176998][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 135.177011][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 135.177022][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x9196 instead [ 135.177038][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xd851 instead [ 135.177080][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 135.177095][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 135.177106][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x9196 instead [ 135.177122][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xd851 instead [ 135.177164][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 135.177273][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 135.177286][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x9196 instead [ 135.177303][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xd851 instead [ 135.177347][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 135.177361][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 135.177374][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x9196 instead [ 135.177387][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xd851 instead [ 135.177429][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 135.177444][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 135.177458][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x9196 instead [ 135.177470][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xd851 instead [ 135.177511][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 135.177525][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 135.177540][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x9196 instead [ 135.177554][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xd851 instead [ 135.177593][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 135.177608][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 135.177623][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x9196 instead [ 135.177639][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xd851 instead [ 135.177675][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 135.177690][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 135.177705][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x9196 instead [ 135.177721][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xd851 instead [ 135.177755][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 135.177770][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 135.177785][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x9196 instead [ 135.177802][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xd851 instead [ 135.177832][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 135.177841][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 135.177850][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x9196 instead [ 135.177861][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xd851 instead [ 135.177885][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 135.177894][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 135.177904][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x9196 instead [ 135.177915][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xd851 instead [ 135.177939][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 135.177948][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 135.177958][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x9196 instead [ 135.177968][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xd851 instead [ 135.177998][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 135.178007][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 135.178017][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x9196 instead [ 135.178028][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xd851 instead [ 135.178070][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 135.178079][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 135.178089][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x9196 instead [ 135.178100][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xd851 instead [ 135.178125][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 135.178134][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 135.178144][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x9196 instead [ 135.178155][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xd851 instead [ 135.178179][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 135.178188][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 135.178198][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x9196 instead [ 135.178208][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xd851 instead [ 135.178233][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 135.178242][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 135.178252][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x9196 instead [ 135.178263][T10054] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xd851 instead [ 135.178282][T10054] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 135.178287][T10054] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 135.227701][T10059] netlink: 'syz.1.1470': attribute type 2 has an invalid length. [ 135.238220][T10059] : entered promiscuous mode [ 135.589920][ T25] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 135.715984][ T5878] usb 5-1: USB disconnect, device number 10 [ 135.752582][ T25] usb 6-1: Using ep0 maxpacket: 8 [ 135.753075][ T25] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 135.753898][ T25] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 135.753938][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 135.753965][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 135.753983][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 135.754000][ T25] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 135.754030][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.756217][T10075] FAULT_INJECTION: forcing a failure. [ 135.756217][T10075] name failslab, interval 1, probability 0, space 0, times 0 [ 135.756245][T10075] CPU: 0 UID: 0 PID: 10075 Comm: syz.0.1477 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.756269][T10075] Tainted: [L]=SOFTLOCKUP [ 135.756275][T10075] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.756286][T10075] Call Trace: [ 135.756311][T10075] [ 135.756321][T10075] dump_stack_lvl+0x100/0x190 [ 135.756351][T10075] should_fail_ex.cold+0x5/0xa [ 135.756377][T10075] should_failslab+0xc2/0x120 [ 135.756398][T10075] kmem_cache_alloc_noprof+0x92/0x6a0 [ 135.756416][T10075] ? __sys_bpf+0x12a0/0x4a30 [ 135.756431][T10075] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 135.756459][T10075] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 135.756485][T10075] idr_get_free+0x52e/0xa00 [ 135.756516][T10075] idr_alloc_u32+0x1ac/0x320 [ 135.756542][T10075] ? __pfx_idr_alloc_u32+0x10/0x10 [ 135.756568][T10075] ? lock_acquire+0x1d1/0x380 [ 135.756586][T10075] ? __radix_tree_preload+0x7c/0x820 [ 135.756610][T10075] idr_alloc_cyclic+0x10b/0x230 [ 135.756636][T10075] ? __pfx_idr_alloc_cyclic+0x10/0x10 [ 135.756659][T10075] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 135.756687][T10075] map_create+0x1698/0x30d0 [ 135.756710][T10075] ? find_held_lock+0x2b/0x80 [ 135.756733][T10075] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 135.756756][T10075] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 135.756786][T10075] ? __pfx_map_create+0x10/0x10 [ 135.756809][T10075] ? avc_has_perm+0x135/0x1e0 [ 135.756832][T10075] ? __pfx_avc_has_perm+0x10/0x10 [ 135.756852][T10075] ? __might_fault+0xc5/0x140 [ 135.756878][T10075] ? __might_fault+0xc5/0x140 [ 135.756907][T10075] ? selinux_bpf+0xfb/0x150 [ 135.756933][T10075] __sys_bpf+0x12a0/0x4a30 [ 135.756956][T10075] ? __pfx___sys_bpf+0x10/0x10 [ 135.756979][T10075] ? find_held_lock+0x2b/0x80 [ 135.757001][T10075] ? get_pid_task+0xfc/0x250 [ 135.757023][T10075] ? get_pid_task+0xfc/0x250 [ 135.757053][T10075] ? find_held_lock+0x2b/0x80 [ 135.757081][T10075] ? rcu_read_lock_any_held+0x6a/0x90 [ 135.757106][T10075] ? find_held_lock+0x2b/0x80 [ 135.757128][T10075] ? ksys_write+0x190/0x250 [ 135.757144][T10075] ? ksys_write+0x190/0x250 [ 135.757160][T10075] ? lock_acquire+0x1d1/0x380 [ 135.757192][T10075] ? fput+0x7c/0x100 [ 135.757213][T10075] ? ksys_write+0x1ac/0x250 [ 135.757232][T10075] ? __x64_sys_bpf+0xce/0x140 [ 135.757248][T10075] __x64_sys_bpf+0xce/0x140 [ 135.757266][T10075] ? do_syscall_64+0xae/0x790 [ 135.757290][T10075] do_syscall_64+0x123/0x790 [ 135.757315][T10075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.757333][T10075] RIP: 0033:0x7faa7279e159 [ 135.757348][T10075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.757364][T10075] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 135.757381][T10075] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 135.757392][T10075] RDX: 0000000000000048 RSI: 00002000000009c0 RDI: 0000000000000000 [ 135.757403][T10075] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 135.757414][T10075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 135.757424][T10075] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 135.757447][T10075] [ 136.096243][T10065] netlink: 'syz.1.1473': attribute type 1 has an invalid length. [ 136.114069][T10065] 8021q: adding VLAN 0 to HW filter on device bond1 [ 136.126305][T10065] bond1: (slave dummy0): making interface the new active one [ 136.128360][T10065] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 136.141115][T10099] busy [ 136.141421][T10099] overlayfs: failed to resolve './bus': -2 [ 136.181765][T10101] netlink: 'syz.1.1473': attribute type 10 has an invalid length. [ 136.182010][T10101] dummy0: entered promiscuous mode [ 136.184904][T10101] bond1: (slave dummy0): Releasing active interface [ 136.189291][ T25] usb 6-1: usb_control_msg returned -32 [ 136.189336][ T25] usbtmc 6-1:16.0: can't read capabilities [ 136.190009][ T5806] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 136.226246][T10103] fuse: Bad value for 'fd' [ 136.341652][ T5806] usb 8-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 136.342822][ T5806] usb 8-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 136.342845][ T5806] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 136.342863][ T5806] usb 8-1: config 1 has no interface number 0 [ 136.344785][ T5806] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.344805][ T5806] usb 8-1: Product: syz [ 136.344817][ T5806] usb 8-1: Manufacturer: syz [ 136.344830][ T5806] usb 8-1: SerialNumber: syz [ 136.353035][ T5806] usb 8-1: 3:1 : does not exist [ 136.353062][ T5806] usb 8-1: 3:2 : does not exist [ 136.604536][T10126] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 136.910455][ T13] net_ratelimit: 40 callbacks suppressed [ 136.910475][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 137.108087][ T5806] usb 8-1: USB disconnect, device number 11 [ 137.129317][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 137.129331][ T43] audit: type=1326 audit(393.052:673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10149 comm="syz.2.1502" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb1b8b9e159 code=0x0 [ 137.385728][T10162] netlink: 'syz.2.1505': attribute type 9 has an invalid length. [ 137.411165][T10164] FAULT_INJECTION: forcing a failure. [ 137.411165][T10164] name failslab, interval 1, probability 0, space 0, times 0 [ 137.411188][T10164] CPU: 2 UID: 0 PID: 10164 Comm: syz.0.1506 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.411205][T10164] Tainted: [L]=SOFTLOCKUP [ 137.411209][T10164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.411216][T10164] Call Trace: [ 137.411220][T10164] [ 137.411225][T10164] dump_stack_lvl+0x100/0x190 [ 137.411247][T10164] should_fail_ex.cold+0x5/0xa [ 137.411262][T10164] ? __netlink_lookup+0x652/0x900 [ 137.411277][T10164] should_failslab+0xc2/0x120 [ 137.411293][T10164] kmem_cache_alloc_noprof+0x92/0x6a0 [ 137.411307][T10164] ? skb_clone+0x190/0x400 [ 137.411324][T10164] skb_clone+0x190/0x400 [ 137.411339][T10164] netlink_deliver_tap+0xaed/0xcc0 [ 137.411374][T10164] netlink_unicast+0x62b/0x850 [ 137.411391][T10164] ? __pfx_netlink_unicast+0x10/0x10 [ 137.411432][T10164] netlink_sendmsg+0x8b0/0xda0 [ 137.411448][T10164] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.411462][T10164] ? selinux_socket_sendmsg+0x198/0x2f0 [ 137.411479][T10164] ____sys_sendmsg+0xa4d/0xbe0 [ 137.411496][T10164] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.411511][T10164] ? __pfx_____sys_sendmsg+0x10/0x10 [ 137.411531][T10164] ? lock_acquire+0x1d1/0x380 [ 137.411545][T10164] ? get_pid_task+0x2a/0x250 [ 137.411563][T10164] ___sys_sendmsg+0x190/0x1e0 [ 137.411574][T10164] ? __pfx____sys_sendmsg+0x10/0x10 [ 137.411586][T10164] ? get_pid_task+0x106/0x250 [ 137.411607][T10164] ? find_held_lock+0x2b/0x80 [ 137.411633][T10164] __sys_sendmsg+0x160/0x210 [ 137.411653][T10164] ? __pfx___sys_sendmsg+0x10/0x10 [ 137.411675][T10164] do_syscall_64+0x123/0x790 [ 137.411694][T10164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.411707][T10164] RIP: 0033:0x7faa7279e159 [ 137.411718][T10164] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.411729][T10164] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 137.411741][T10164] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 137.411748][T10164] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 137.411756][T10164] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 137.411763][T10164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 137.411770][T10164] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 137.411785][T10164] [ 137.428587][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 137.452793][T10167] Bluetooth: MGMT ver 1.23 [ 137.455085][T10167] FAULT_INJECTION: forcing a failure. [ 137.455085][T10167] name failslab, interval 1, probability 0, space 0, times 0 [ 137.455120][T10167] CPU: 3 UID: 0 PID: 10167 Comm: syz.0.1507 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.455147][T10167] Tainted: [L]=SOFTLOCKUP [ 137.455155][T10167] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.455167][T10167] Call Trace: [ 137.455174][T10167] [ 137.455184][T10167] dump_stack_lvl+0x100/0x190 [ 137.455221][T10167] should_fail_ex.cold+0x5/0xa [ 137.455250][T10167] ? __pfx_update_scan_sync+0x10/0x10 [ 137.455271][T10167] should_failslab+0xc2/0x120 [ 137.455297][T10167] ? __pfx_update_scan_sync+0x10/0x10 [ 137.455316][T10167] __kmalloc_cache_noprof+0x91/0x6d0 [ 137.455351][T10167] ? hci_cmd_sync_submit+0xbc/0x330 [ 137.455387][T10167] ? __pfx_update_scan_sync+0x10/0x10 [ 137.455435][T10167] hci_cmd_sync_submit+0xbc/0x330 [ 137.455471][T10167] hci_update_scan+0x6c/0x90 [ 137.455502][T10167] remove_device+0x465/0xbf0 [ 137.455537][T10167] ? __pfx_remove_device+0x10/0x10 [ 137.455568][T10167] ? lockdep_init_map_type+0x5c/0x250 [ 137.455593][T10167] ? timer_init_key+0x150/0x310 [ 137.455618][T10167] ? __pfx_mgmt_init_hdev+0x10/0x10 [ 137.455649][T10167] hci_sock_sendmsg+0x154e/0x2620 [ 137.455683][T10167] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 137.455712][T10167] ? selinux_socket_sendmsg+0x198/0x2f0 [ 137.455741][T10167] sock_write_iter+0x53a/0x5b0 [ 137.455772][T10167] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 137.455800][T10167] ? __pfx_sock_write_iter+0x10/0x10 [ 137.455839][T10167] ? bpf_lsm_file_permission+0x9/0x10 [ 137.455866][T10167] ? security_file_permission+0x76/0x210 [ 137.455893][T10167] ? rw_verify_area+0xce/0x6d0 [ 137.455925][T10167] vfs_write+0x6af/0x1050 [ 137.455947][T10167] ? __pfx_sock_write_iter+0x10/0x10 [ 137.455987][T10167] ? __pfx_vfs_write+0x10/0x10 [ 137.456006][T10167] ? find_held_lock+0x2b/0x80 [ 137.456054][T10167] ksys_write+0x1f8/0x250 [ 137.456076][T10167] ? __pfx_ksys_write+0x10/0x10 [ 137.456106][T10167] do_syscall_64+0x123/0x790 [ 137.456139][T10167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.456160][T10167] RIP: 0033:0x7faa7279e159 [ 137.456177][T10167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.456196][T10167] RSP: 002b:00007faa7374b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.456217][T10167] RAX: ffffffffffffffda RBX: 00007faa72a25fa0 RCX: 00007faa7279e159 [ 137.456232][T10167] RDX: 000000000000000d RSI: 0000200000000000 RDI: 0000000000000004 [ 137.456244][T10167] RBP: 00007faa7374b090 R08: 0000000000000000 R09: 0000000000000000 [ 137.456257][T10167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 137.456269][T10167] R13: 00007faa72a26038 R14: 00007faa72a25fa0 R15: 00007ffe72f49c38 [ 137.456297][T10167] [ 137.534270][T10169] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 137.536223][T10169] bond2 (unregistering): Released all slaves [ 137.579574][T10171] input: syz0 as /devices/virtual/input/input8 [ 137.719915][T10174] __nla_validate_parse: 8 callbacks suppressed [ 137.719935][T10174] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1508'. [ 137.719949][T10174] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1508'. [ 137.801060][ T43] audit: type=1400 audit(393.728:674): avc: denied { write } for pid=10176 comm="syz.3.1510" name="/" dev="9p" ino=75267629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 137.801108][ T43] audit: type=1400 audit(393.728:675): avc: denied { create } for pid=10176 comm="syz.3.1510" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 137.955261][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 138.417597][ T5806] usb 6-1: USB disconnect, device number 18 [ 138.500405][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 138.822397][T10211] FAULT_INJECTION: forcing a failure. [ 138.822397][T10211] name failslab, interval 1, probability 0, space 0, times 0 [ 138.822432][T10211] CPU: 3 UID: 0 PID: 10211 Comm: syz.3.1522 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.822457][T10211] Tainted: [L]=SOFTLOCKUP [ 138.822464][T10211] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.822474][T10211] Call Trace: [ 138.822482][T10211] [ 138.822489][T10211] dump_stack_lvl+0x100/0x190 [ 138.822522][T10211] should_fail_ex.cold+0x5/0xa [ 138.822548][T10211] should_failslab+0xc2/0x120 [ 138.822572][T10211] kmem_cache_alloc_noprof+0x92/0x6a0 [ 138.822593][T10211] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 138.822623][T10211] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 138.822657][T10211] mmu_topup_memory_caches+0x25/0x170 [ 138.822681][T10211] kvm_mmu_load+0xe8/0x2580 [ 138.822704][T10211] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 138.822730][T10211] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 138.822774][T10211] ? __pfx_kvm_mmu_load+0x10/0x10 [ 138.822811][T10211] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 138.822860][T10211] ? kvm_check_and_inject_events+0x896/0x1050 [ 138.822886][T10211] vcpu_run+0x395d/0x5e80 [ 138.822906][T10211] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 138.822950][T10211] ? __pfx_vcpu_run+0x10/0x10 [ 138.822975][T10211] ? lock_acquire+0x1d1/0x380 [ 138.822993][T10211] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 138.823020][T10211] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 138.823044][T10211] ? __local_bh_enable_ip+0xa5/0x120 [ 138.823069][T10211] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 138.823092][T10211] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 138.823120][T10211] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 138.823142][T10211] ? lock_acquire+0x1d1/0x380 [ 138.823163][T10211] ? do_raw_write_lock+0x11e/0x260 [ 138.823186][T10211] ? find_held_lock+0x2b/0x80 [ 138.823210][T10211] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 138.823234][T10211] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 138.823265][T10211] kvm_vcpu_ioctl+0x730/0x1700 [ 138.823292][T10211] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 138.823318][T10211] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 138.823341][T10211] ? do_vfs_ioctl+0x226/0x13e0 [ 138.823361][T10211] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 138.823376][T10211] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 138.823435][T10211] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 138.823462][T10211] ? __fget_files+0x34/0x3d0 [ 138.823498][T10211] ? selinux_file_ioctl+0x13b/0x290 [ 138.823518][T10211] ? selinux_file_ioctl+0xb6/0x290 [ 138.823540][T10211] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 138.823568][T10211] __x64_sys_ioctl+0x18e/0x210 [ 138.823590][T10211] do_syscall_64+0x123/0x790 [ 138.823620][T10211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.823639][T10211] RIP: 0033:0x7f9e8b19e159 [ 138.823655][T10211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.823673][T10211] RSP: 002b:00007f9e8bff8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 138.823692][T10211] RAX: ffffffffffffffda RBX: 00007f9e8b425fa0 RCX: 00007f9e8b19e159 [ 138.823704][T10211] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 138.823716][T10211] RBP: 00007f9e8bff8090 R08: 0000000000000000 R09: 0000000000000000 [ 138.823727][T10211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 138.823738][T10211] R13: 00007f9e8b426038 R14: 00007f9e8b425fa0 R15: 00007ffffbc0f7d8 [ 138.823764][T10211] [ 138.967237][ T5806] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 139.045800][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 139.124014][ T5806] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 139.125069][ T5806] usb 5-1: config 1 has too many interfaces: 33, using maximum allowed: 32 [ 139.125091][ T5806] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 33 [ 139.125110][ T5806] usb 5-1: config 1 has no interface number 0 [ 139.127288][ T5806] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.127307][ T5806] usb 5-1: Product: syz [ 139.127320][ T5806] usb 5-1: Manufacturer: syz [ 139.127332][ T5806] usb 5-1: SerialNumber: syz [ 139.152532][ T5806] usb 5-1: 3:1 : does not exist [ 139.152552][ T5806] usb 5-1: 3:2 : does not exist [ 139.590803][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 139.681599][ T1159] IPVS: starting estimator thread 0... [ 139.771851][T10241] IPVS: using max 27 ests per chain, 64800 per kthread [ 139.795061][T10250] xt_hashlimit: size too large, truncated to 1048576 [ 139.828236][ T5806] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 139.891370][ T43] audit: type=1400 audit(395.674:676): avc: denied { read write } for pid=10239 comm="syz.1.1531" name="set_event" dev="tracefs" ino=5478 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 139.892065][ T43] audit: type=1400 audit(395.683:677): avc: denied { open } for pid=10239 comm="syz.1.1531" path="/358/trace/set_event" dev="tracefs" ino=5478 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 139.949617][ T5100] usb 5-1: USB disconnect, device number 11 [ 139.986092][ T5806] usb 8-1: Using ep0 maxpacket: 8 [ 139.986636][ T5806] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 139.987622][ T5806] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 139.987646][ T5806] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.991922][ T5806] usb 8-1: config 0 descriptor?? [ 140.135335][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 140.215880][ T5806] iowarrior 8-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 140.217383][ T5806] usb 8-1: USB disconnect, device number 12 [ 140.431071][T10235] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 140.655576][T10270] gadgetfs: bound to dummy_udc driver [ 140.680491][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 140.720844][T10260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.738556][ T43] audit: type=1400 audit(396.479:678): avc: denied { append } for pid=10271 comm="syz.1.1542" name="uprobe_events" dev="tracefs" ino=1063 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 140.742388][ T43] audit: type=1400 audit(396.479:679): avc: denied { read write } for pid=10271 comm="syz.1.1542" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 140.742600][ T43] audit: type=1400 audit(396.479:680): avc: denied { open } for pid=10271 comm="syz.1.1542" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 140.916200][T10284] netlink: 'syz.2.1547': attribute type 9 has an invalid length. [ 141.023832][T10292] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(50397188.0.0), cmd(3) [ 141.225532][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 141.326454][T10312] netlink: 'syz.2.1557': attribute type 9 has an invalid length. [ 141.433511][T10317] erofs (device loop3): cannot find valid erofs superblock [ 141.479126][ T43] audit: type=1400 audit(397.162:681): avc: denied { write } for pid=10316 comm="syz.3.1559" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 141.653227][ T43] audit: type=1400 audit(397.330:682): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 141.739297][ T74] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 141.739508][T10329] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 141.781188][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 141.817786][T10336] xt_hashlimit: size too large, truncated to 1048576 [ 141.888849][T10338] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.916280][T10338] bridge_slave_0 (unregistering): left allmulticast mode [ 141.916299][T10338] bridge_slave_0 (unregistering): left promiscuous mode [ 141.917386][T10338] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.005273][ T5100] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 142.186995][ T5100] usb 6-1: Using ep0 maxpacket: 8 [ 142.188094][ T5100] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 142.189126][ T5100] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 142.189150][ T5100] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 142.189170][ T5100] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 142.189191][ T5100] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 142.189225][ T5100] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.346031][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 142.439765][ T5100] usb 6-1: GET_CAPABILITIES returned 0 [ 142.439809][ T5100] usbtmc 6-1:16.0: can't read capabilities [ 142.616808][T10371] overlayfs: failed to resolve './bus': -2 [ 142.656985][ C3] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.657576][ T5100] usb 6-1: USB disconnect, device number 19 [ 142.800310][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 142.800330][ T43] audit: type=1400 audit(398.407:686): avc: denied { bind } for pid=10378 comm="syz.0.1581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 142.860631][T10383] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1581'. [ 142.860916][ T43] audit: type=1400 audit(398.463:687): avc: denied { setopt } for pid=10378 comm="syz.0.1581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 142.861125][ T43] audit: type=1400 audit(398.463:688): avc: denied { accept } for pid=10378 comm="syz.0.1581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 142.892808][ T5778] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 142.991665][T10397] IPv6: NLM_F_CREATE should be specified when creating new route [ 143.282363][T10429] netlink: 'syz.2.1598': attribute type 11 has an invalid length. [ 143.303026][ T43] audit: type=1400 audit(398.874:689): avc: denied { watch watch_with_perm } for pid=10430 comm="syz.0.1597" path="/408/bus" dev="tmpfs" ino=2221 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 143.340010][ T74] maxtcpc 0-0005: error -ENXIO: Failed to read TCPC_POWER_STATUS [ 143.342830][T10431] i2c i2c-0: new_device: Instantiated device maxtcpc at 0x05 [ 143.439395][ T5805] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 143.510712][T10450] FAULT_INJECTION: forcing a failure. [ 143.510712][T10450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 143.510746][T10450] CPU: 3 UID: 0 PID: 10450 Comm: syz.1.1606 Tainted: G L syzkaller #0 PREEMPT(full) [ 143.510771][T10450] Tainted: [L]=SOFTLOCKUP [ 143.510778][T10450] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.510788][T10450] Call Trace: [ 143.510795][T10450] [ 143.510803][T10450] dump_stack_lvl+0x100/0x190 [ 143.510834][T10450] should_fail_ex.cold+0x5/0xa [ 143.510859][T10450] _copy_from_user+0x2e/0xd0 [ 143.510880][T10450] kstrtouint_from_user+0xd6/0x1d0 [ 143.510905][T10450] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 143.510932][T10450] ? lock_acquire+0x1d1/0x380 [ 143.510966][T10450] proc_fail_nth_write+0x83/0x220 [ 143.510991][T10450] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 143.511021][T10450] vfs_write+0x2aa/0x1050 [ 143.511042][T10450] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 143.511064][T10450] ? lock_acquire+0x1d1/0x380 [ 143.511081][T10450] ? __fget_files+0x34/0x3d0 [ 143.511101][T10450] ? __pfx_vfs_write+0x10/0x10 [ 143.511116][T10450] ? find_held_lock+0x2b/0x80 [ 143.511142][T10450] ? __fget_files+0x215/0x3d0 [ 143.511169][T10450] ? __fget_files+0x21f/0x3d0 [ 143.511197][T10450] ksys_write+0x12a/0x250 [ 143.511214][T10450] ? __pfx_ksys_write+0x10/0x10 [ 143.511241][T10450] do_syscall_64+0x123/0x790 [ 143.511271][T10450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.511291][T10450] RIP: 0033:0x7f4ccd55e98e [ 143.511306][T10450] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 143.511322][T10450] RSP: 002b:00007f4cce487fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.511340][T10450] RAX: ffffffffffffffda RBX: 00007f4cce4886c0 RCX: 00007f4ccd55e98e [ 143.511351][T10450] RDX: 0000000000000001 RSI: 00007f4cce4880a0 RDI: 0000000000000003 [ 143.511361][T10450] RBP: 00007f4cce488090 R08: 0000000000000000 R09: 0000000000000000 [ 143.511406][T10450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 143.511418][T10450] R13: 00007f4ccd826038 R14: 00007f4ccd825fa0 R15: 00007ffc594d7948 [ 143.511444][T10450] [ 143.563667][T10451] netlink: 'syz.0.1600': attribute type 1 has an invalid length. [ 143.590640][T10451] 8021q: adding VLAN 0 to HW filter on device bond2 [ 143.595621][T10451] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1600'. [ 143.678246][T10463] Failure starting scanning (-16) [ 143.681105][ C2] ieee802154 phy0 wpan0: encryption failed: -22 [ 143.681866][ C2] ------------[ cut here ]------------ [ 143.681877][ C2] current_phy->suspended [ 143.681885][ C2] WARNING: drivers/net/ieee802154/mac802154_hwsim.c:266 at hwsim_hw_xmit+0xcbf/0x1540, CPU#2: ksoftirqd/2/24 [ 143.696029][ C2] Modules linked in: [ 143.697794][ C2] CPU: 2 UID: 0 PID: 24 Comm: ksoftirqd/2 Tainted: G L syzkaller #0 PREEMPT(full) [ 143.701986][ C2] Tainted: [L]=SOFTLOCKUP [ 143.703791][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.708018][ C2] RIP: 0010:hwsim_hw_xmit+0xcbf/0x1540 [ 143.710017][ C2] Code: 48 c7 c2 40 45 c0 8c be 52 03 00 00 48 c7 c7 a0 45 c0 8c c6 05 5f 0b c6 09 01 e8 0c f0 7f fa e9 c6 f8 ff ff e8 e2 2e a5 fa 90 <0f> 0b 90 e9 11 f4 ff ff e8 d4 2e a5 fa e8 af de 88 fa 31 ff 89 c5 [ 143.717401][ C2] RSP: 0018:ffffc9000062f978 EFLAGS: 00010246 [ 143.719868][ C2] RAX: 0000000000000000 RBX: ffff88802b17cd20 RCX: 0000000000000102 [ 143.723172][ C2] RDX: ffff88801f6fa580 RSI: ffffffff8766f0ce RDI: ffff88801f6fa580 [ 143.727158][ C2] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 143.730313][ C2] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8766e410 [ 143.733550][ C2] R13: 1ffff920000c5f39 R14: ffff88802b17c720 R15: 0000000000000005 [ 143.736815][ C2] FS: 0000000000000000(0000) GS:ffff8880d5d56000(0000) knlGS:0000000000000000 [ 143.740447][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 143.743070][ C2] CR2: 000000110c4486e6 CR3: 0000000063a4c000 CR4: 0000000000352ef0 [ 143.746577][ C2] DR0: 0000000000000001 DR1: 0000000000000000 DR2: 0000000000000000 [ 143.750009][ C2] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 143.753168][ C2] Call Trace: [ 143.754610][ C2] [ 143.755908][ C2] ? lock_acquire+0x1d1/0x380 [ 143.757805][ C2] ? ieee802154_hold_queue+0x100/0x450 [ 143.760025][ C2] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 143.761928][ C2] ? ieee802154_hold_queue+0x2a4/0x450 [ 143.763962][ C2] ? mark_held_locks+0x40/0x70 [ 143.765815][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 143.768057][ C2] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 143.770000][ C2] ieee802154_tx.isra.0+0x29f/0x570 [ 143.772071][ C2] ieee802154_subif_start_xmit+0xc8/0xf0 [ 143.774295][ C2] dev_hard_start_xmit+0x121/0x760 [ 143.776653][ C2] sch_direct_xmit+0x1b2/0xc70 [ 143.778597][ C2] ? lock_acquire+0x1d1/0x380 [ 143.780616][ C2] ? __pfx_sch_direct_xmit+0x10/0x10 [ 143.782744][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.784714][ C2] ? find_held_lock+0x2b/0x80 [ 143.786695][ C2] ? pfifo_fast_dequeue+0x5ba/0xb80 [ 143.788868][ C2] __qdisc_run+0x52d/0x1b20 [ 143.790872][ C2] net_tx_action+0x549/0xf50 [ 143.792722][ C2] handle_softirqs+0x1e6/0x9d0 [ 143.794604][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 143.796764][ C2] ? run_ksoftirqd+0x5b/0x60 [ 143.798642][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.800687][ C2] ? __pfx_run_ksoftirqd+0x10/0x10 [ 143.802646][ C2] run_ksoftirqd+0x38/0x60 [ 143.804502][ C2] smpboot_thread_fn+0x3d3/0xab0 [ 143.806509][ C2] ? kthread+0x13a/0x450 [ 143.808236][ C2] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 143.810418][ C2] kthread+0x373/0x450 [ 143.812324][ C2] ? __pfx_kthread+0x10/0x10 [ 143.814466][ C2] ret_from_fork+0x730/0xd60 [ 143.816525][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 143.818699][ C2] ? __switch_to+0x800/0x10f0 [ 143.821083][ C2] ? __pfx_kthread+0x10/0x10 [ 143.823266][ C2] ret_from_fork_asm+0x1a/0x30 [ 143.825506][ C2] [ 143.826821][ C2] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 143.829811][ C2] CPU: 2 UID: 0 PID: 24 Comm: ksoftirqd/2 Tainted: G L syzkaller #0 PREEMPT(full) [ 143.834152][ C2] Tainted: [L]=SOFTLOCKUP [ 143.835906][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.840024][ C2] Call Trace: [ 143.841110][ C2] [ 143.842084][ C2] dump_stack_lvl+0x100/0x190 [ 143.843718][ C2] vpanic+0x553/0x970 [ 143.845077][ C2] ? __pfx_vpanic+0x10/0x10 [ 143.846590][ C2] panic+0xd1/0xe0 [ 143.848047][ C2] ? __pfx_panic+0x10/0x10 [ 143.849889][ C2] check_panic_on_warn.cold+0x19/0x34 [ 143.852168][ C2] ? hwsim_hw_xmit+0xcbf/0x1540 [ 143.854154][ C2] __warn.cold+0x191/0x318 [ 143.856019][ C2] __report_bug+0x30f/0x440 [ 143.858034][ C2] ? hwsim_hw_xmit+0xcbf/0x1540 [ 143.860173][ C2] ? __pfx___report_bug+0x10/0x10 [ 143.862250][ C2] ? stack_trace_save+0x8e/0xc0 [ 143.864454][ C2] ? __pfx_stack_trace_save+0x10/0x10 [ 143.866973][ C2] ? hwsim_hw_xmit+0xcbf/0x1540 [ 143.869091][ C2] report_bug+0xb3/0x220 [ 143.870890][ C2] ? hwsim_hw_xmit+0xcbf/0x1540 [ 143.872966][ C2] handle_bug+0x16a/0x2a0 [ 143.874841][ C2] exc_invalid_op+0x17/0x50 [ 143.876790][ C2] asm_exc_invalid_op+0x1a/0x20 [ 143.878875][ C2] RIP: 0010:hwsim_hw_xmit+0xcbf/0x1540 [ 143.881459][ C2] Code: 48 c7 c2 40 45 c0 8c be 52 03 00 00 48 c7 c7 a0 45 c0 8c c6 05 5f 0b c6 09 01 e8 0c f0 7f fa e9 c6 f8 ff ff e8 e2 2e a5 fa 90 <0f> 0b 90 e9 11 f4 ff ff e8 d4 2e a5 fa e8 af de 88 fa 31 ff 89 c5 [ 143.889366][ C2] RSP: 0018:ffffc9000062f978 EFLAGS: 00010246 [ 143.892045][ C2] RAX: 0000000000000000 RBX: ffff88802b17cd20 RCX: 0000000000000102 [ 143.895337][ C2] RDX: ffff88801f6fa580 RSI: ffffffff8766f0ce RDI: ffff88801f6fa580 [ 143.898357][ C2] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 143.901185][ C2] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8766e410 [ 143.903695][ C2] R13: 1ffff920000c5f39 R14: ffff88802b17c720 R15: 0000000000000005 [ 143.906273][ C2] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 143.908246][ C2] ? hwsim_hw_xmit+0xcbe/0x1540 [ 143.909864][ C2] ? hwsim_hw_xmit+0xcbe/0x1540 [ 143.911607][ C2] ? lock_acquire+0x1d1/0x380 [ 143.913616][ C2] ? ieee802154_hold_queue+0x100/0x450 [ 143.915945][ C2] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 143.918091][ C2] ? ieee802154_hold_queue+0x2a4/0x450 [ 143.920416][ C2] ? mark_held_locks+0x40/0x70 [ 143.922461][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 143.924948][ C2] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 143.927095][ C2] ieee802154_tx.isra.0+0x29f/0x570 [ 143.929309][ C2] ieee802154_subif_start_xmit+0xc8/0xf0 [ 143.931682][ C2] dev_hard_start_xmit+0x121/0x760 [ 143.933894][ C2] sch_direct_xmit+0x1b2/0xc70 [ 143.935947][ C2] ? lock_acquire+0x1d1/0x380 [ 143.937937][ C2] ? __pfx_sch_direct_xmit+0x10/0x10 [ 143.940209][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.942310][ C2] ? find_held_lock+0x2b/0x80 [ 143.944280][ C2] ? pfifo_fast_dequeue+0x5ba/0xb80 [ 143.946387][ C2] __qdisc_run+0x52d/0x1b20 [ 143.948398][ C2] net_tx_action+0x549/0xf50 [ 143.950479][ C2] handle_softirqs+0x1e6/0x9d0 [ 143.952680][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 143.955018][ C2] ? run_ksoftirqd+0x5b/0x60 [ 143.956945][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.959007][ C2] ? __pfx_run_ksoftirqd+0x10/0x10 [ 143.961156][ C2] run_ksoftirqd+0x38/0x60 [ 143.963062][ C2] smpboot_thread_fn+0x3d3/0xab0 [ 143.965172][ C2] ? kthread+0x13a/0x450 [ 143.966966][ C2] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 143.969370][ C2] kthread+0x373/0x450 [ 143.971145][ C2] ? __pfx_kthread+0x10/0x10 [ 143.973153][ C2] ret_from_fork+0x730/0xd60 [ 143.975200][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 143.977642][ C2] ? __switch_to+0x800/0x10f0 [ 143.979914][ C2] ? __pfx_kthread+0x10/0x10 [ 143.981964][ C2] ret_from_fork_asm+0x1a/0x30 [ 143.984077][ C2] [ 143.986061][ C2] Kernel Offset: disabled [ 143.987844][ C2] Rebooting in 86400 seconds..