last executing test programs: 3.419158387s ago: executing program 1 (id=94): gettid() timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x23, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) 2.77723293s ago: executing program 3 (id=101): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000680), 0x4000000000001f2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}]}, 0x34}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, 0x0, 0x40040) writev(r0, 0x0, 0x0) 2.527554466s ago: executing program 1 (id=104): msgget(0x0, 0x323) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000300)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000340)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) pselect6(0x40, &(0x7f0000000400)={0x2, 0x0, 0x3, 0x0, 0x1, 0x40, 0x0, 0x2}, 0x0, &(0x7f0000000440)={0x1f, 0xc, 0x0, 0x8000000000000000, 0x0, 0x80000000000000, 0x8000000000000000, 0x20000}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)=""/80}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.521011073s ago: executing program 3 (id=105): syz_emit_ethernet(0x46, &(0x7f0000000600)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca4f400038e0000000000000000100100200001267000000000100100201001001"], 0x0) 2.439580119s ago: executing program 3 (id=106): openat(0xffffffffffffff9c, 0x0, 0x240240, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) 2.379032136s ago: executing program 2 (id=107): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRES16=0x0, @ANYBLOB="100029bd7000ffdb"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.064813952s ago: executing program 2 (id=108): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x42001, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000380)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newtfilter={0x878, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x5}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x84c, 0x2, [@TCA_BPF_POLICE={0x848, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x400014, 0x10000, 0x80000001, 0x3, 0x3, 0x80000000, 0x5, 0xbf, 0x4, 0xf4, 0xffffffff, 0x7, 0x1, 0x81, 0x80000000, 0x81, 0x6, 0x0, 0x7, 0x9cc7, 0xfff, 0xff, 0x9, 0x5, 0x7f, 0x9, 0x1000003, 0x3, 0x4, 0x9, 0x0, 0x2, 0x1, 0x6, 0xfffffd0b, 0x4, 0x3, 0x8, 0xfffffffd, 0x1, 0xd, 0x40, 0x1, 0x0, 0x7fffffff, 0x9, 0x101, 0x107, 0x263, 0x98, 0x80, 0x80000001, 0x6, 0x4, 0xfffffffa, 0x5, 0x0, 0x9, 0x1ff, 0x5, 0x27, 0x0, 0x8, 0xfffffe01, 0x7d4, 0x0, 0x1389, 0x53b7, 0xd18, 0x6, 0x5, 0x56, 0x645ec805, 0x4, 0x3, 0xfffffffb, 0x5007, 0x3, 0x2, 0x8a92, 0x4, 0x7, 0x4, 0xbbb, 0x5ffee5c7, 0x8, 0x9, 0x271, 0xffffe819, 0xa, 0xe8, 0x3, 0x200, 0x8001, 0x3, 0x87d7, 0x9, 0x851, 0x2, 0x8, 0x3, 0x7, 0x8, 0x6f47, 0x3, 0x5c90, 0x5, 0x1ff, 0x0, 0xf02, 0x1e, 0x57e7, 0x5adaaf8c, 0x3f8, 0x4, 0x79, 0x7, 0x5, 0x4, 0x2, 0x2, 0x1, 0x7, 0x3ff, 0x85f, 0x8, 0x7, 0x3, 0x2000002, 0x25a, 0x4, 0x3, 0x1, 0xfffffff8, 0x8001, 0xffff6a70, 0x6, 0x5, 0x2, 0x9, 0x8001, 0x5, 0x5, 0x1, 0xffffffc0, 0x9, 0x3ff, 0x5, 0x9, 0xb, 0x7, 0xf, 0xfffffff7, 0x8, 0x7fff, 0x0, 0x2e7, 0x3ff, 0x8, 0x5, 0x7, 0x7fffffff, 0x5, 0x5, 0x5, 0x2, 0x1, 0x1000, 0x5, 0x3, 0x4, 0x7, 0x2, 0x0, 0x0, 0x1, 0x80, 0x6670, 0x5, 0x16d, 0x2, 0x4, 0x9, 0x200, 0xc, 0xd, 0x13f9, 0x9, 0x0, 0x5, 0x7, 0x45, 0x80000001, 0xb, 0x3, 0x2, 0x0, 0x6, 0x8000, 0x4, 0x3, 0x6, 0x2, 0x9, 0x8, 0x1, 0xc, 0x6, 0x7, 0x400, 0x2, 0x401, 0x8, 0x205, 0x5072f7e2, 0x1000, 0x1, 0x58ba, 0x5, 0x59b1, 0x40005, 0x120, 0x3, 0x5, 0x6, 0x6f1da0e, 0x80000001, 0x2, 0x8, 0x4, 0x696, 0x5, 0x8, 0x2, 0x3ff, 0x3, 0x0, 0x8, 0x2, 0x8f0d, 0x5, 0xa, 0xfffffff6, 0xfffffff7, 0x6, 0x6, 0x1, 0x80, 0x5, 0x0, 0x6, 0x8e, 0xb5d, 0x9, 0xfffffd4c]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xc2, 0x20000000, 0x859, 0xaedb, 0x7, {0x7, 0x2, 0xd, 0x8, 0x204, 0x95a5}, {0x8, 0x2, 0x7ff, 0xf95b, 0x2, 0x280000}, 0x10001, 0xfffffffd, 0x6}}, @TCA_POLICE_RATE={0x404, 0x2, [0x4009, 0x0, 0xfffffffe, 0x14, 0x5, 0x0, 0x9, 0x0, 0x7, 0x8, 0x4d8b, 0x6, 0x40, 0x1, 0x0, 0x81, 0x0, 0xf, 0x0, 0x0, 0x5, 0xc, 0x8000, 0x4, 0x9, 0x9, 0x81, 0xa00000, 0xe, 0x4, 0x80000000, 0x6, 0xfffffff9, 0x3, 0x2, 0x7, 0x7, 0x1, 0x14f, 0x8, 0x200, 0x7, 0x5, 0x69, 0x84, 0xc, 0x0, 0xf0eb, 0x7, 0x487, 0x4, 0x8, 0x7fffffff, 0x3ff, 0x7fffffff, 0x0, 0xbd, 0x6, 0x0, 0xa, 0x10001, 0x2, 0x200043, 0x1, 0x7, 0x38095a10, 0x6, 0x8333f, 0x7, 0xc8a, 0x6, 0x1, 0x3, 0x7f, 0x7, 0x8, 0x100, 0x8003, 0x8, 0x4, 0x9, 0x81, 0x5, 0x4, 0x4, 0x0, 0x7f, 0xb, 0x6, 0x4, 0x4, 0x2, 0x9, 0x2, 0xffffff78, 0x4, 0x4e, 0x3, 0x8004, 0x1ff, 0x4, 0x4, 0x5b3a, 0xfffffff7, 0x6d, 0x8001, 0x10000, 0x4000001, 0x2c29, 0x7, 0x4, 0x0, 0x5, 0x0, 0xfffffffb, 0xea, 0x0, 0x9, 0x40, 0xfffffffa, 0xffffff00, 0x1, 0x7, 0xda, 0x7f, 0x3, 0x8566, 0x2f, 0x9, 0xfffffff9, 0xb, 0xa97e, 0x8, 0x9, 0x2002b36, 0x60f63eb, 0x4, 0x6, 0x2, 0x7f, 0x5, 0x1ff, 0x7d, 0x101, 0xfffffffa, 0xd, 0x6, 0x0, 0xf, 0x9, 0xb, 0x7f, 0x1, 0x10, 0x0, 0x5, 0x1038, 0x9, 0x5, 0xf0, 0x200, 0x0, 0x6, 0x80000000, 0x5, 0xffffffff, 0x6, 0x2, 0x3ff, 0x3, 0x7ff, 0x5, 0x1, 0xa, 0x3, 0x632, 0x2, 0xc4, 0xffff, 0x8, 0x1, 0x9, 0x3, 0x8, 0x5, 0x7, 0x3, 0x10001, 0xd, 0xd, 0x7, 0x7, 0xf2, 0x5, 0x600000, 0x7, 0x4, 0xfffffff7, 0x1, 0x3, 0x33fbb166, 0x9, 0x3, 0x4, 0x8, 0x4, 0xc, 0x6, 0x400, 0x9, 0x8, 0x1, 0x2e5c, 0x5, 0x7, 0x5, 0x1, 0x7fff, 0x80000001, 0x8c, 0xffffffc0, 0x80000000, 0x7, 0x7d3, 0xfff0, 0x1, 0x8, 0xb, 0x7ff, 0x4, 0x0, 0x6, 0x4, 0x5, 0x6, 0xd143, 0x4, 0x3a6, 0x7, 0x6, 0x7, 0x1000, 0x1, 0x4, 0x2b, 0x7, 0xa, 0x6, 0xdfb, 0x30d, 0xfff, 0x1, 0x3ff, 0x7ff, 0xfffffffd, 0x7]}]}]}}]}, 0x878}, 0x1, 0x0, 0x0, 0x24048001}, 0x20044804) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000e80)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f0000000ec0)={&(0x7f0000000f00)=@xdp={0x2c, 0x7, r12, 0x3c}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000fc0)='\'', 0x1}], 0x1}, 0x804) 1.979232689s ago: executing program 2 (id=109): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$rds(0x15, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2a0140, 0x0) socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000001400b59500000c00000000000ac0"], 0x18}}, 0x0) r0 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) 1.897265018s ago: executing program 2 (id=110): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.779664286s ago: executing program 0 (id=111): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRES16=0x0, @ANYBLOB="100029bd7000ffdb"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.619368309s ago: executing program 1 (id=112): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 1.488544041s ago: executing program 2 (id=113): gettid() timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x23, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) 1.488378247s ago: executing program 3 (id=114): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x1001001}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010006000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca5b500028003a0000000000000100100200001267"], 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000600)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca4f400038e0000000000000000100100200001267000000000100100201001001"], 0x0) 1.486081169s ago: executing program 1 (id=121): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 1.417336086s ago: executing program 0 (id=115): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000680)={'wpan0\x00'}) write$cgroup_int(r2, &(0x7f0000000500)=0x8, 0x12) 1.416386629s ago: executing program 1 (id=116): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000680), 0x4000000000001f2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}]}, 0x34}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, 0x0, 0x40040) writev(r0, 0x0, 0x0) 1.415841426s ago: executing program 3 (id=117): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x42001, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000380)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newtfilter={0x878, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x5}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x84c, 0x2, [@TCA_BPF_POLICE={0x848, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x400014, 0x10000, 0x80000001, 0x3, 0x3, 0x80000000, 0x5, 0xbf, 0x4, 0xf4, 0xffffffff, 0x7, 0x1, 0x81, 0x80000000, 0x81, 0x6, 0x0, 0x7, 0x9cc7, 0xfff, 0xff, 0x9, 0x5, 0x7f, 0x9, 0x1000003, 0x3, 0x4, 0x9, 0x0, 0x2, 0x1, 0x6, 0xfffffd0b, 0x4, 0x3, 0x8, 0xfffffffd, 0x1, 0xd, 0x40, 0x1, 0x0, 0x7fffffff, 0x9, 0x101, 0x107, 0x263, 0x98, 0x80, 0x80000001, 0x6, 0x4, 0xfffffffa, 0x5, 0x0, 0x9, 0x1ff, 0x5, 0x27, 0x0, 0x8, 0xfffffe01, 0x7d4, 0x0, 0x1389, 0x53b7, 0xd18, 0x6, 0x5, 0x56, 0x645ec805, 0x4, 0x3, 0xfffffffb, 0x5007, 0x3, 0x2, 0x8a92, 0x4, 0x7, 0x4, 0xbbb, 0x5ffee5c7, 0x8, 0x9, 0x271, 0xffffe819, 0xa, 0xe8, 0x3, 0x200, 0x8001, 0x3, 0x87d7, 0x9, 0x851, 0x2, 0x8, 0x3, 0x7, 0x8, 0x6f47, 0x3, 0x5c90, 0x5, 0x1ff, 0x0, 0xf02, 0x1e, 0x57e7, 0x5adaaf8c, 0x3f8, 0x4, 0x79, 0x7, 0x5, 0x4, 0x2, 0x2, 0x1, 0x7, 0x3ff, 0x85f, 0x8, 0x7, 0x3, 0x2000002, 0x25a, 0x4, 0x3, 0x1, 0xfffffff8, 0x8001, 0xffff6a70, 0x6, 0x5, 0x2, 0x9, 0x8001, 0x5, 0x5, 0x1, 0xffffffc0, 0x9, 0x3ff, 0x5, 0x9, 0xb, 0x7, 0xf, 0xfffffff7, 0x8, 0x7fff, 0x0, 0x2e7, 0x3ff, 0x8, 0x5, 0x7, 0x7fffffff, 0x5, 0x5, 0x5, 0x2, 0x1, 0x1000, 0x5, 0x3, 0x4, 0x7, 0x2, 0x0, 0x0, 0x1, 0x80, 0x6670, 0x5, 0x16d, 0x2, 0x4, 0x9, 0x200, 0xc, 0xd, 0x13f9, 0x9, 0x0, 0x5, 0x7, 0x45, 0x80000001, 0xb, 0x3, 0x2, 0x0, 0x6, 0x8000, 0x4, 0x3, 0x6, 0x2, 0x9, 0x8, 0x1, 0xc, 0x6, 0x7, 0x400, 0x2, 0x401, 0x8, 0x205, 0x5072f7e2, 0x1000, 0x1, 0x58ba, 0x5, 0x59b1, 0x40005, 0x120, 0x3, 0x5, 0x6, 0x6f1da0e, 0x80000001, 0x2, 0x8, 0x4, 0x696, 0x5, 0x8, 0x2, 0x3ff, 0x3, 0x0, 0x8, 0x2, 0x8f0d, 0x5, 0xa, 0xfffffff6, 0xfffffff7, 0x6, 0x6, 0x1, 0x80, 0x5, 0x0, 0x6, 0x8e, 0xb5d, 0x9, 0xfffffd4c]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xc2, 0x20000000, 0x859, 0xaedb, 0x7, {0x7, 0x2, 0xd, 0x8, 0x204, 0x95a5}, {0x8, 0x2, 0x7ff, 0xf95b, 0x2, 0x280000}, 0x10001, 0xfffffffd, 0x6}}, @TCA_POLICE_RATE={0x404, 0x2, [0x4009, 0x0, 0xfffffffe, 0x14, 0x5, 0x0, 0x9, 0x0, 0x7, 0x8, 0x4d8b, 0x6, 0x40, 0x1, 0x0, 0x81, 0x0, 0xf, 0x0, 0x0, 0x5, 0xc, 0x8000, 0x4, 0x9, 0x9, 0x81, 0xa00000, 0xe, 0x4, 0x80000000, 0x6, 0xfffffff9, 0x3, 0x2, 0x7, 0x7, 0x1, 0x14f, 0x8, 0x200, 0x7, 0x5, 0x69, 0x84, 0xc, 0x0, 0xf0eb, 0x7, 0x487, 0x4, 0x8, 0x7fffffff, 0x3ff, 0x7fffffff, 0x0, 0xbd, 0x6, 0x0, 0xa, 0x10001, 0x2, 0x200043, 0x1, 0x7, 0x38095a10, 0x6, 0x8333f, 0x7, 0xc8a, 0x6, 0x1, 0x3, 0x7f, 0x7, 0x8, 0x100, 0x8003, 0x8, 0x4, 0x9, 0x81, 0x5, 0x4, 0x4, 0x0, 0x7f, 0xb, 0x6, 0x4, 0x4, 0x2, 0x9, 0x2, 0xffffff78, 0x4, 0x4e, 0x3, 0x8004, 0x1ff, 0x4, 0x4, 0x5b3a, 0xfffffff7, 0x6d, 0x8001, 0x10000, 0x4000001, 0x2c29, 0x7, 0x4, 0x0, 0x5, 0x0, 0xfffffffb, 0xea, 0x0, 0x9, 0x40, 0xfffffffa, 0xffffff00, 0x1, 0x7, 0xda, 0x7f, 0x3, 0x8566, 0x2f, 0x9, 0xfffffff9, 0xb, 0xa97e, 0x8, 0x9, 0x2002b36, 0x60f63eb, 0x4, 0x6, 0x2, 0x7f, 0x5, 0x1ff, 0x7d, 0x101, 0xfffffffa, 0xd, 0x6, 0x0, 0xf, 0x9, 0xb, 0x7f, 0x1, 0x10, 0x0, 0x5, 0x1038, 0x9, 0x5, 0xf0, 0x200, 0x0, 0x6, 0x80000000, 0x5, 0xffffffff, 0x6, 0x2, 0x3ff, 0x3, 0x7ff, 0x5, 0x1, 0xa, 0x3, 0x632, 0x2, 0xc4, 0xffff, 0x8, 0x1, 0x9, 0x3, 0x8, 0x5, 0x7, 0x3, 0x10001, 0xd, 0xd, 0x7, 0x7, 0xf2, 0x5, 0x600000, 0x7, 0x4, 0xfffffff7, 0x1, 0x3, 0x33fbb166, 0x9, 0x3, 0x4, 0x8, 0x4, 0xc, 0x6, 0x400, 0x9, 0x8, 0x1, 0x2e5c, 0x5, 0x7, 0x5, 0x1, 0x7fff, 0x80000001, 0x8c, 0xffffffc0, 0x80000000, 0x7, 0x7d3, 0xfff0, 0x1, 0x8, 0xb, 0x7ff, 0x4, 0x0, 0x6, 0x4, 0x5, 0x6, 0xd143, 0x4, 0x3a6, 0x7, 0x6, 0x7, 0x1000, 0x1, 0x4, 0x2b, 0x7, 0xa, 0x6, 0xdfb, 0x30d, 0xfff, 0x1, 0x3ff, 0x7ff, 0xfffffffd, 0x7]}]}]}}]}, 0x878}, 0x1, 0x0, 0x0, 0x24048001}, 0x20044804) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000e80)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f0000000ec0)={&(0x7f0000000f00)=@xdp={0x2c, 0x7, r12, 0x3c}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000fc0)='\'', 0x1}], 0x1}, 0x804) 1.168082575s ago: executing program 1 (id=118): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$rds(0x15, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2a0140, 0x0) socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000001400b59500000c00000000000ac0"], 0x18}}, 0x0) r0 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) 1.089532345s ago: executing program 0 (id=119): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0xb0}]}, &(0x7f0000000140)=0x10) socket$inet6_tcp(0xa, 0x1, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000003c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000680)={'wpan0\x00'}) write$cgroup_int(r3, &(0x7f0000000500)=0x8, 0x12) 546.947632ms ago: executing program 2 (id=120): msgget(0x0, 0x323) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000300)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000340)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) pselect6(0x40, &(0x7f0000000400)={0x2, 0x0, 0x3, 0x0, 0x1, 0x40, 0x0, 0x2}, 0x0, &(0x7f0000000440)={0x1f, 0xc, 0x0, 0x8000000000000000, 0x0, 0x80000000000000, 0x8000000000000000, 0x20000}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)=""/80}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 210.067827ms ago: executing program 0 (id=122): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) 209.66875ms ago: executing program 0 (id=123): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x8}}, 0x14}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/fs/cgroup', 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRES8, @ANYBLOB="010000000000000000001400000008"], 0x5c}, 0x1, 0x0, 0x0, 0x2000}, 0x40090) r1 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16a", 0x5, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 119.277768ms ago: executing program 3 (id=124): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 0 (id=125): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0x2, 0x45200) ioctl$DVB_DEMUX_DMX_QUERYBUF(r0, 0xc0186f3d, &(0x7f0000000140)={0x4, 0xd7c, 0x0, 0x9, 0x4, 0x9}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, 0x0) symlinkat(&(0x7f0000000180)='./sys\x00', 0xffffffffffffff9c, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000280)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f00000002c0)={0x0, 0x0, 0x0, &(0x7f0000000340)}) mount(0x0, &(0x7f0000000380)='./sys\x00', &(0x7f00000003c0)='sysfs\x00', 0x9048ef, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='usbip', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff) symlinkat(&(0x7f0000000740)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:34945' (ED25519) to the list of known hosts. [ 30.808821][ T43] audit: type=1400 audit(1792073796.386:116): avc: denied { name_bind } for pid=5642 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 30.851338][ T43] audit: type=1400 audit(1792073796.426:117): avc: denied { execute } for pid=5643 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.851865][ T43] audit: type=1400 audit(1792073796.426:118): avc: denied { execute_no_trans } for pid=5643 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 32.101190][ T43] audit: type=1400 audit(1792073797.676:119): avc: denied { write } for pid=5644 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.155000][ T43] audit: type=1400 audit(1792073797.736:120): avc: denied { write } for pid=5647 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.452385][ T43] audit: type=1400 audit(1792073798.026:121): avc: denied { write } for pid=5650 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.499425][ T43] audit: type=1400 audit(1792073798.076:122): avc: denied { write } for pid=5653 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.572713][ T43] audit: type=1400 audit(1792073798.146:123): avc: denied { write } for pid=5656 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.619712][ T43] audit: type=1400 audit(1792073798.196:124): avc: denied { write } for pid=5659 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.691759][ T43] audit: type=1400 audit(1792073798.266:125): avc: denied { write } for pid=5662 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.204276][ T5643] cgroup: Unknown subsys name 'net' [ 33.370151][ T5643] cgroup: Unknown subsys name 'cpuset' [ 33.378024][ T5643] cgroup: Unknown subsys name 'rlimit' [ 33.572623][ T5695] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.271278][ T5643] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.704678][ T43] kauditd_printk_skb: 28 callbacks suppressed [ 37.704691][ T43] audit: type=1400 audit(1792073803.276:154): avc: denied { execmem } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 37.900068][ T43] audit: type=1400 audit(1792073803.476:155): avc: denied { create } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.900520][ T43] audit: type=1400 audit(1792073803.476:156): avc: denied { read write } for pid=5728 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.900911][ T43] audit: type=1400 audit(1792073803.476:157): avc: denied { open } for pid=5728 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.908736][ T43] audit: type=1400 audit(1792073803.486:158): avc: denied { ioctl } for pid=5728 comm="syz-executor" path="socket:[2010]" dev="sockfs" ino=2010 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.941305][ T5741] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.942273][ T5741] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 37.943373][ T5744] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 37.944926][ T5741] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.945272][ T5741] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 37.945956][ T5741] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.946083][ T5741] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 37.946766][ T5744] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 37.947348][ T5744] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 37.948038][ T5741] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.948083][ T5744] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 37.948145][ T5743] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 37.948511][ T5744] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 37.948649][ T5741] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.949047][ T5743] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.949168][ T5744] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 37.951049][ T5744] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 37.952129][ T5744] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 37.956340][ T43] audit: type=1400 audit(1792073803.526:159): avc: denied { read } for pid=5729 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.956365][ T43] audit: type=1400 audit(1792073803.526:160): avc: denied { open } for pid=5729 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.961944][ T43] audit: type=1400 audit(1792073803.536:161): avc: denied { mounton } for pid=5729 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 37.969438][ T5743] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 37.971511][ T5739] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 37.981827][ T43] audit: type=1400 audit(1792073803.556:162): avc: denied { module_request } for pid=5729 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 37.982173][ T43] audit: type=1400 audit(1792073803.556:163): avc: denied { module_request } for pid=5728 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 38.157666][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.158755][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.159538][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.161358][ T5731] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 38.194733][ T5729] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 38.201108][ T5730] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 38.271107][ T5728] infiniband rxe0: set active [ 38.273597][ T5728] infiniband rxe0: added rxe_eth0 [ 38.280542][ T5728] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 38.280561][ T5728] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 38.280582][ T5728] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 38.292182][ T1857] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.302849][ T5728] RDS/IB: rxe0: added [ 38.302956][ T5728] smc: adding ib device rxe0 with port count 1 [ 38.302988][ T5728] smc: ib device rxe0 port 1 has no pnetid [ 38.320307][ T30] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.331970][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.440049][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.579945][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.593315][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.593437][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.593530][ T5731] bridge_slave_0: entered allmulticast mode [ 38.595423][ T5731] bridge_slave_0: entered promiscuous mode [ 38.598747][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.598885][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.598984][ T5731] bridge_slave_1: entered allmulticast mode [ 38.600458][ T5731] bridge_slave_1: entered promiscuous mode [ 38.672085][ T5729] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.672778][ T5729] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.673050][ T5729] bridge_slave_0: entered allmulticast mode [ 38.674335][ T5729] bridge_slave_0: entered promiscuous mode [ 38.676800][ T5729] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.676892][ T5729] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.677439][ T5729] bridge_slave_1: entered allmulticast mode [ 38.678747][ T5729] bridge_slave_1: entered promiscuous mode [ 38.680227][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.680293][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.680370][ T5730] bridge_slave_0: entered allmulticast mode [ 38.681591][ T5730] bridge_slave_0: entered promiscuous mode [ 38.686574][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.689246][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.703678][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.703720][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.703775][ T5730] bridge_slave_1: entered allmulticast mode [ 38.704495][ T5730] bridge_slave_1: entered promiscuous mode [ 38.717936][ T5729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.720026][ T5729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.730278][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.748816][ T5728] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.752323][ T5729] team0: Port device team_slave_0 added [ 38.755574][ T5729] team0: Port device team_slave_1 added [ 38.756796][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.763481][ T5731] team0: Port device team_slave_0 added [ 38.765081][ T5731] team0: Port device team_slave_1 added [ 38.790560][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.790571][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.790583][ T5729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.792099][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.792107][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.792118][ T5729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.793307][ T5730] team0: Port device team_slave_0 added [ 38.794755][ T5730] team0: Port device team_slave_1 added [ 38.813415][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.813425][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.813437][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.824069][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.824079][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.824092][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.825284][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.825296][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.825315][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.832653][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.832666][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.832684][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.859814][ T5729] hsr_slave_0: entered promiscuous mode [ 38.860674][ T5729] hsr_slave_1: entered promiscuous mode [ 38.921149][ T5730] hsr_slave_0: entered promiscuous mode [ 38.921602][ T5730] hsr_slave_1: entered promiscuous mode [ 38.922286][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 38.922346][ T5730] Cannot create hsr debugfs directory [ 38.931211][ T5731] hsr_slave_0: entered promiscuous mode [ 38.931678][ T5731] hsr_slave_1: entered promiscuous mode [ 38.932005][ T5731] debugfs: 'hsr0' already exists in 'hsr' [ 38.932021][ T5731] Cannot create hsr debugfs directory [ 39.216015][ T5729] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.221320][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.222018][ T5729] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.228128][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.228742][ T5729] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.231800][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.232225][ T5729] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.234054][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.316065][ T5728] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.316111][ T5728] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.316165][ T5728] bridge_slave_0: entered allmulticast mode [ 39.316953][ T5728] bridge_slave_0: entered promiscuous mode [ 39.325555][ T5728] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.325623][ T5728] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.325703][ T5728] bridge_slave_1: entered allmulticast mode [ 39.326470][ T5728] bridge_slave_1: entered promiscuous mode [ 39.337156][ T5729] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.337241][ T5729] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.337650][ T5729] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.337726][ T5729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.354039][ T5728] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.362331][ T5728] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.371686][ T5731] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 39.374580][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.375545][ T5731] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 39.378907][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.379304][ T5731] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 39.385970][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.396485][ T5728] team0: Port device team_slave_0 added [ 39.399343][ T5731] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 39.401196][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.402477][ T5728] team0: Port device team_slave_1 added [ 39.430328][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.431245][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.448908][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.448917][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.448930][ T5728] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.470330][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.470344][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.470365][ T5728] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.517442][ T5730] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 39.520965][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.526207][ T5728] hsr_slave_0: entered promiscuous mode [ 39.526993][ T5728] hsr_slave_1: entered promiscuous mode [ 39.527531][ T5728] debugfs: 'hsr0' already exists in 'hsr' [ 39.527548][ T5728] Cannot create hsr debugfs directory [ 39.538593][ T5730] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 39.542311][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.559112][ T5730] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 39.561037][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.561920][ T5730] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 39.569008][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.612848][ T5729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.690956][ T5729] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.723676][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.723889][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.742905][ T5728] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 39.747033][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.748264][ T5728] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.753010][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.759090][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.759167][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.762589][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.762726][ T5728] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.765018][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.765820][ T5728] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.769105][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.800355][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.817112][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.817371][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.834380][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.834423][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.837130][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.868872][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.874232][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.874299][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.883399][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.883479][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.900986][ T5728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.921100][ T5728] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.926761][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.926806][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.934324][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.934369][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.976041][ T5728] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 40.045890][ T66] Bluetooth: hci2: command tx timeout [ 40.046177][ T5745] Bluetooth: hci1: command tx timeout [ 40.046181][ T66] Bluetooth: hci0: command tx timeout [ 40.046525][ T5093] Bluetooth: hci3: command tx timeout [ 40.080687][ T5729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.107449][ T5729] veth0_vlan: entered promiscuous mode [ 40.111585][ T5729] veth1_vlan: entered promiscuous mode [ 40.130584][ T5729] veth0_macvtap: entered promiscuous mode [ 40.133336][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.134475][ T5729] veth1_macvtap: entered promiscuous mode [ 40.153574][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.159625][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.181127][ T5728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.185892][ T5731] veth0_vlan: entered promiscuous mode [ 40.198550][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.199715][ T5731] veth1_vlan: entered promiscuous mode [ 40.268316][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.268336][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.270592][ T5728] veth0_vlan: entered promiscuous mode [ 40.280098][ T5730] veth0_vlan: entered promiscuous mode [ 40.283064][ T5730] veth1_vlan: entered promiscuous mode [ 40.304230][ T5728] veth1_vlan: entered promiscuous mode [ 40.306225][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.306236][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.314104][ T5731] veth0_macvtap: entered promiscuous mode [ 40.326611][ T5731] veth1_macvtap: entered promiscuous mode [ 40.344141][ T5728] veth0_macvtap: entered promiscuous mode [ 40.353208][ T5730] veth0_macvtap: entered promiscuous mode [ 40.356394][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.357117][ T5728] veth1_macvtap: entered promiscuous mode [ 40.366243][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.367743][ T5730] veth1_macvtap: entered promiscuous mode [ 40.367858][ T5729] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 40.391354][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.395558][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.398731][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.415440][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.447004][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.447023][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.468035][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.468047][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.511799][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.511818][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.541174][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.541192][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.571740][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.571754][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.581024][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.581037][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.584892][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.584918][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.584935][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.584953][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.584970][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.584994][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585011][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585028][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585045][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585062][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585078][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585095][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585112][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585129][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585146][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.585163][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.627443][ T5885] event trace: Could not enable event p1 [ 40.734660][ T5894] syzkaller0: entered promiscuous mode [ 40.734674][ T5894] syzkaller0: entered allmulticast mode [ 40.765871][ T5896] syzkaller1: entered promiscuous mode [ 40.765884][ T5896] syzkaller1: entered allmulticast mode [ 40.991505][ T5907] tipc: Started in network mode [ 40.991518][ T5907] tipc: Node identity 1001001, cluster identity 4711 [ 40.991525][ T5907] tipc: Node number set to 16781313 [ 40.992630][ T5907] tipc: Enabled bearer , priority 0 [ 41.041336][ T5909] FAULT_INJECTION: forcing a failure. [ 41.041336][ T5909] name failslab, interval 1, probability 0, space 0, times 1 [ 41.041358][ T5909] CPU: 0 UID: 0 PID: 5909 Comm: syz.0.11 Not tainted syzkaller #0 PREEMPT(full) [ 41.041371][ T5909] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 41.041377][ T5909] Call Trace: [ 41.041381][ T5909] [ 41.041385][ T5909] dump_stack_lvl+0x100/0x190 [ 41.041405][ T5909] should_fail_ex.cold+0x5/0xa [ 41.041420][ T5909] should_failslab+0xc2/0x120 [ 41.041437][ T5909] __kmalloc_cache_node_noprof+0x94/0x720 [ 41.041454][ T5909] ? page_pool_create_percpu+0x7a/0xd50 [ 41.041481][ T5909] page_pool_create_percpu+0x7a/0xd50 [ 41.041500][ T5909] __veth_napi_enable_range+0x179/0xae0 [ 41.041517][ T5909] ? __xdp_reg_mem_model+0x34e/0x6a0 [ 41.041532][ T5909] ? __pfx___xdp_reg_mem_model+0x10/0x10 [ 41.041546][ T5909] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 41.041564][ T5909] ? __pfx___veth_napi_enable_range+0x10/0x10 [ 41.041582][ T5909] ? veth_enable_xdp_range+0x1ea/0x500 [ 41.041598][ T5909] veth_enable_xdp+0x2f4/0x560 [ 41.041615][ T5909] veth_xdp+0x51c/0x8c0 [ 41.041629][ T5909] dev_xdp_install+0x674/0xf00 [ 41.041640][ T5909] ? __pfx_veth_xdp+0x10/0x10 [ 41.041653][ T5909] ? __pfx_dev_xdp_install+0x10/0x10 [ 41.041669][ T5909] ? __pfx_veth_xdp+0x10/0x10 [ 41.041681][ T5909] dev_xdp_attach+0x4c7/0xff0 [ 41.041696][ T5909] ? __pfx_dev_xdp_attach+0x10/0x10 [ 41.041710][ T5909] ? bpf_link_prime+0x2c7/0x4c0 [ 41.041723][ T5909] bpf_xdp_link_attach+0x333/0x8f0 [ 41.041736][ T5909] ? __pfx_bpf_xdp_link_attach+0x10/0x10 [ 41.041746][ T5909] ? find_held_lock+0x2b/0x80 [ 41.041762][ T5909] ? __fget_files+0x215/0x3d0 [ 41.041784][ T5909] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 41.041800][ T5909] __sys_bpf+0x3cbf/0x4a30 [ 41.041816][ T5909] ? __pfx___sys_bpf+0x10/0x10 [ 41.041826][ T5909] ? find_held_lock+0x2b/0x80 [ 41.041842][ T5909] ? futex_wake+0x4ea/0x5e0 [ 41.041862][ T5909] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 41.041885][ T5909] ? __x64_sys_futex+0x34f/0x4d0 [ 41.041901][ T5909] ? __x64_sys_futex+0x358/0x4d0 [ 41.041918][ T5909] ? __pfx___x64_sys_futex+0x10/0x10 [ 41.041933][ T5909] ? selinux_file_ioctl+0xb6/0x290 [ 41.041951][ T5909] ? __x64_sys_bpf+0xce/0x140 [ 41.041962][ T5909] __x64_sys_bpf+0xce/0x140 [ 41.041977][ T5909] ? do_syscall_64+0xae/0x790 [ 41.041996][ T5909] do_syscall_64+0x123/0x790 [ 41.042019][ T5909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 41.042039][ T5909] RIP: 0033:0x7ff55b99e559 [ 41.042056][ T5909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.042073][ T5909] RSP: 002b:00007ff55c91a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 41.042095][ T5909] RAX: ffffffffffffffda RBX: 00007ff55bc25fa0 RCX: 00007ff55b99e559 [ 41.042106][ T5909] RDX: 0000000000000030 RSI: 0000200000000800 RDI: 000000000000001c [ 41.042116][ T5909] RBP: 00007ff55ba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 41.042127][ T5909] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.042136][ T5909] R13: 00007ff55bc26038 R14: 00007ff55bc25fa0 R15: 00007ffc4b60da78 [ 41.042162][ T5909] [ 41.115507][ T5912] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 41.359302][ T5918] syzkaller1: entered promiscuous mode [ 41.359316][ T5918] syzkaller1: entered allmulticast mode [ 41.669243][ T5920] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 41.745297][ T5922] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 41.878975][ T5925] Bluetooth: MGMT ver 1.23 [ 41.946696][ T5922] md: personality for level 1918987361 is not loaded! [ 41.999106][ T5931] tipc: Started in network mode [ 41.999123][ T5931] tipc: Node identity 76d69f20cfca, cluster identity 4711 [ 41.999243][ T5931] tipc: Enabled bearer , priority 0 [ 41.999961][ T5931] syzkaller0: entered promiscuous mode [ 41.999971][ T5931] syzkaller0: entered allmulticast mode [ 42.002953][ T5931] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 42.009661][ T5931] netlink: 116 bytes leftover after parsing attributes in process `syz.2.19'. [ 42.012422][ T5931] tipc: Resetting bearer [ 42.015080][ T5930] tipc: Resetting bearer [ 42.027094][ T5930] tipc: Disabling bearer [ 42.106129][ T5935] netlink: 'syz.1.21': attribute type 1 has an invalid length. [ 42.124744][ T5093] Bluetooth: hci1: command tx timeout [ 42.124772][ T5093] Bluetooth: hci2: command tx timeout [ 42.124787][ T5093] Bluetooth: hci3: command tx timeout [ 42.124826][ T5093] Bluetooth: hci0: command tx timeout [ 42.331258][ T5944] syzkaller0: entered promiscuous mode [ 42.331277][ T5944] syzkaller0: entered allmulticast mode [ 42.447140][ T5948] syz.1.26 uses obsolete (PF_INET,SOCK_PACKET) [ 42.686998][ T42] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 42.834752][ T42] usb 6-1: Using ep0 maxpacket: 32 [ 42.836057][ T42] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 42.837431][ T42] usb 6-1: config 0 has no interfaces? [ 42.839006][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.839018][ T42] usb 6-1: Product: syz [ 42.839026][ T42] usb 6-1: Manufacturer: syz [ 42.839033][ T42] usb 6-1: SerialNumber: syz [ 42.841489][ T42] usb 6-1: config 0 descriptor?? [ 42.963866][ T5953] fuse: Unknown parameter '00000000000000000000' [ 42.963891][ T43] kauditd_printk_skb: 140 callbacks suppressed [ 42.963903][ T43] audit: type=1400 audit(1792073808.536:304): avc: denied { mounton } for pid=5952 comm="syz.0.28" path="/8/file0/file0" dev="9p" ino=71827719 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 42.969800][ T43] audit: type=1400 audit(1792073808.546:305): avc: denied { append } for pid=5952 comm="syz.0.28" name="file0" dev="9p" ino=71827719 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 42.969827][ T43] audit: type=1400 audit(1792073808.546:306): avc: denied { open } for pid=5952 comm="syz.0.28" path="/8/file0/file0" dev="9p" ino=71827719 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 43.052158][ T1041] usb 6-1: USB disconnect, device number 2 [ 43.208979][ T5955] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 43.229371][ T5955] kvm: pic: non byte read [ 43.367729][ T5961] syzkaller0: entered promiscuous mode [ 43.367744][ T5961] syzkaller0: entered allmulticast mode [ 43.399433][ T43] audit: type=1400 audit(1792073808.976:307): avc: denied { ioctl } for pid=5962 comm="syz.0.32" path="/dev/vbi3" dev="devtmpfs" ino=988 ioctlcmd=0x565a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 43.400492][ T5963] netlink: 'syz.0.32': attribute type 267 has an invalid length. [ 43.486806][ T5965] syzkaller0: entered promiscuous mode [ 43.486820][ T5965] syzkaller0: entered allmulticast mode [ 43.520340][ T43] audit: type=1400 audit(1792073809.096:308): avc: denied { create } for pid=5966 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 43.521829][ T43] audit: type=1400 audit(1792073809.096:309): avc: denied { connect } for pid=5966 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 43.540394][ T43] audit: type=1400 audit(1792073809.116:310): avc: denied { create } for pid=5969 comm="syz.2.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 43.541684][ T43] audit: type=1400 audit(1792073809.116:311): avc: denied { read } for pid=5969 comm="syz.2.35" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 43.542069][ T43] audit: type=1400 audit(1792073809.116:312): avc: denied { open } for pid=5969 comm="syz.2.35" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 43.543160][ T5969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 43.837394][ T43] audit: type=1400 audit(1792073809.416:313): avc: denied { create } for pid=5976 comm="syz.1.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 43.847863][ T5977] protocol 0000 is buggy, dev veth0_vlan [ 43.936583][ T5983] syzkaller0: entered promiscuous mode [ 43.936597][ T5983] syzkaller0: entered allmulticast mode [ 43.938190][ T5983] tipc: Started in network mode [ 43.938205][ T5983] tipc: Node identity be6dafa07077, cluster identity 4711 [ 43.938373][ T5983] tipc: Enabled bearer , priority 0 [ 43.940066][ T5983] tipc: Resetting bearer [ 43.943466][ T5982] tipc: Resetting bearer [ 43.955899][ T5982] tipc: Disabling bearer [ 43.966807][ T5981] netlink: 48 bytes leftover after parsing attributes in process `syz.3.39'. [ 44.205046][ T66] Bluetooth: hci0: command tx timeout [ 44.205069][ T66] Bluetooth: hci3: command tx timeout [ 44.205082][ T66] Bluetooth: hci2: command tx timeout [ 44.205094][ T66] Bluetooth: hci1: command tx timeout [ 44.511139][ T6005] syzkaller0: entered promiscuous mode [ 44.511154][ T6005] syzkaller0: entered allmulticast mode [ 44.659827][ T6010] binder: 6006:6010 ioctl c0306201 0 returned -14 [ 44.891129][ T6016] tipc: Started in network mode [ 44.891142][ T6016] tipc: Node identity 4, cluster identity 4711 [ 44.891149][ T6016] tipc: Node number set to 4 [ 44.934025][ T5777] tipc: Subscription rejected, illegal request [ 45.431144][ T6038] tipc: New replicast peer: 172.20.20.187 [ 45.432258][ T6038] tipc: Enabled bearer , priority 10 [ 45.579009][ T6050] syzkaller0: entered promiscuous mode [ 45.579023][ T6050] syzkaller0: entered allmulticast mode [ 45.581187][ T6050] simple: /dev/video#_3 [ 45.581197][ T6050] simple: /dev/video#_6 [ 45.581203][ T6050] simple: /dev/video#_9 [ 45.581208][ T6050] simple: /dev/video#_12 [ 45.581212][ T6050] simple: /dev/video#_15 [ 45.581217][ T6050] simple: /dev/video#_18 [ 45.581222][ T6050] simple: /dev/video#_21 [ 45.581226][ T6050] simple: /dev/video#_24 [ 45.581231][ T6050] simple: /dev/video#_27 [ 45.581236][ T6050] simple: /dev/video#_30 [ 45.581240][ T6050] simple: /dev/video#_33 [ 45.581245][ T6050] simple: /dev/video#_36 [ 45.581250][ T6050] simple: /dev/video#_39 [ 45.581254][ T6050] simple: /dev/video#_42 [ 45.581259][ T6050] simple: /dev/video#_45 [ 45.581264][ T6050] simple: /dev/video#_48 [ 45.581268][ T6050] simple: /dev/video#_51 [ 45.581273][ T6050] simple: /dev/video#_54 [ 45.581278][ T6050] simple: /dev/video#_57 [ 45.581283][ T6050] simple: /dev/video#_60 [ 45.581287][ T6050] simple: /dev/video#_63 [ 45.581292][ T6050] simple: /dev/video#_66 [ 45.581297][ T6050] simple: /dev/video#_69 [ 45.581302][ T6050] simple: /dev/video#_72 [ 45.581306][ T6050] simple: /dev/video#_75 [ 45.581311][ T6050] simple: /dev/video#_78 [ 45.581316][ T6050] simple: /dev/video#_81 [ 45.581321][ T6050] simple: /dev/video#_84 [ 45.581325][ T6050] simple: /dev/video#_87 [ 45.581330][ T6050] simple: /dev/video#_90 [ 45.581335][ T6050] simple: /dev/video#_93 [ 45.581339][ T6050] simple: /dev/video#_96 [ 45.581345][ T6050] TC_ACT_REPEAT abuse ? [ 45.960629][ T5736] udevd[5736]: inotify_add_watch(7, /dev/nbd0, 10) failed: No such file or directory [ 45.963756][ T5736] udevd[5736]: inotify_add_watch(7, /dev/nbd0, 10) failed: No such file or directory [ 46.035578][ T6064] syzkaller0: entered promiscuous mode [ 46.035598][ T6064] syzkaller0: entered allmulticast mode [ 46.041822][ T6064] tc mirred: Loop (syzkaller0:egress --> syzkaller0:egress) [ 46.284702][ T5093] Bluetooth: hci2: command tx timeout [ 46.294888][ T5746] Bluetooth: hci1: command tx timeout [ 46.294913][ T5093] Bluetooth: hci3: command tx timeout [ 46.415712][ T6067] syzkaller1: entered promiscuous mode [ 46.415732][ T6067] syzkaller1: entered allmulticast mode [ 46.516917][ T837] IPVS: starting estimator thread 0... [ 46.634784][ T6072] IPVS: using max 42 ests per chain, 100800 per kthread [ 46.670793][ T67] block nbd0: Receive control failed (result -32) [ 46.671418][ T6061] block nbd0: Receive control failed (result -32) [ 46.672142][ T6060] block nbd0: Receive control failed (result -32) [ 46.674558][ T6059] block nbd0: shutting down sockets [ 46.754815][ T852] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 46.816549][ T6080] binder: 6077:6080 ioctl c0306201 0 returned -14 [ 46.904689][ T852] usb 6-1: Using ep0 maxpacket: 16 [ 46.905394][ T852] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 46.906447][ T852] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 46.908072][ T852] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.908084][ T852] usb 6-1: Product: syz [ 46.908091][ T852] usb 6-1: Manufacturer: syz [ 46.908098][ T852] usb 6-1: SerialNumber: syz [ 46.909472][ T852] usb 6-1: config 0 descriptor?? [ 46.916896][ T852] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 46.916921][ T852] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 47.519415][ T852] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 47.884804][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 47.894673][ T9] usb 7-1: new low-speed USB device number 2 using dummy_hcd [ 48.035542][ T50] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 48.036472][ T50] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 48.037649][ T50] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 48.039543][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.039562][ T50] usb 5-1: Product: syz [ 48.039575][ T50] usb 5-1: Manufacturer: syz [ 48.039585][ T50] usb 5-1: SerialNumber: syz [ 48.048121][ T50] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 48.051791][ T50] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 48.055829][ T9] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 48.057894][ T9] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 48.057974][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 48.057996][ T9] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 48.058014][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 48.058033][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 48.058081][ T50] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 48.059564][ T9] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 48.059596][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 48.059615][ T9] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 48.059633][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 48.059714][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 48.061081][ T9] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 48.061113][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 48.061131][ T9] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 48.061148][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 48.061228][ T9] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 48.066391][ T9] usb 7-1: string descriptor 0 read error: -22 [ 48.066521][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.078925][ T9] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 48.187535][ T852] em28xx 6-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 48.188077][ T852] em28xx 6-1:0.0: board has no eeprom [ 48.287051][ T5886] usb 7-1: USB disconnect, device number 2 [ 48.853324][ T6155] Zero length message leads to an empty skb [ 49.246152][ T6071] em28xx 6-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 49.305027][ T852] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 49.305045][ T852] em28xx 6-1:0.0: dvb set to bulk mode. [ 49.305696][ T9] em28xx 6-1:0.0: Binding DVB extension [ 49.314031][ T852] usb 6-1: USB disconnect, device number 3 [ 49.315263][ T852] em28xx 6-1:0.0: Disconnecting em28xx [ 49.336508][ T9] em28xx 6-1:0.0: Registering input extension [ 49.337045][ T852] em28xx 6-1:0.0: Closing input extension [ 49.354198][ T852] em28xx: Freeing device [ 49.532534][ T6165] binder: 6163:6165 ioctl c0306201 0 returned -14 [ 49.805893][ T5093] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 49.805932][ T5093] Bluetooth: hci0: Injecting HCI hardware error event [ 49.806697][ T5746] Bluetooth: hci0: hardware error 0x00 [ 49.867368][ T5886] rxe_eth0 speed is unknown, defaulting to 1000 [ 49.912649][ T43] kauditd_printk_skb: 56 callbacks suppressed [ 49.912664][ T43] audit: type=1400 audit(1792073815.486:370): avc: denied { write } for pid=6172 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.988502][ T43] audit: type=1400 audit(1792073815.566:371): avc: denied { write } for pid=6176 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.594894][ T5886] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 50.745959][ T5886] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 50.746974][ T5886] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 50.746996][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 50.747009][ T5886] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 50.747020][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 50.747032][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 50.748749][ T5886] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 50.748788][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 50.748803][ T5886] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 50.748815][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 50.748827][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 50.749824][ T5886] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 50.749843][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 50.749856][ T5886] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 50.749867][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 50.749879][ T5886] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 50.752902][ T5886] usb 8-1: string descriptor 0 read error: -22 [ 50.753023][ T5886] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.768763][ T5886] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 50.974425][ T5809] usb 8-1: USB disconnect, device number 2 [ 51.327408][ T6139] ti_usb_3410_5052_2 ttyUSB0: ti_get_lsr - get port status command failed, -110 [ 51.328468][ T6139] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -32 [ 51.330781][ T5809] usb 5-1: USB disconnect, device number 2 [ 51.340383][ T5809] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 51.344790][ T5809] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 51.345377][ T5809] ti_usb_3410_5052 5-1:2.0: device disconnected [ 51.431981][ T6208] syzkaller0: entered promiscuous mode [ 51.432001][ T6208] syzkaller0: entered allmulticast mode [ 51.606314][ T43] audit: type=1400 audit(1792073817.186:372): avc: denied { read write } for pid=6216 comm="syz.3.101" name="uinput" dev="devtmpfs" ino=941 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 51.606654][ T43] audit: type=1400 audit(1792073817.186:373): avc: denied { open } for pid=6216 comm="syz.3.101" path="/dev/uinput" dev="devtmpfs" ino=941 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 51.613404][ T6217] lo: entered promiscuous mode [ 51.637306][ T6217] tunl0: entered promiscuous mode [ 51.639447][ T6217] gre0: entered promiscuous mode [ 51.647100][ T6217] gretap0: entered promiscuous mode [ 51.650869][ T6217] erspan0: entered promiscuous mode [ 51.653858][ T6217] ip_vti0: entered promiscuous mode [ 51.656960][ T6217] ip6_vti0: entered promiscuous mode [ 51.659251][ T6217] sit0: entered promiscuous mode [ 51.661833][ T6217] ip6tnl0: entered promiscuous mode [ 51.663381][ T6217] ip6gre0: entered promiscuous mode [ 51.663908][ T43] audit: type=1400 audit(1792073817.236:374): avc: denied { bind } for pid=6216 comm="syz.3.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 51.664400][ T43] audit: type=1400 audit(1792073817.236:375): avc: denied { setopt } for pid=6216 comm="syz.3.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 51.666267][ T6217] syz_tun: entered promiscuous mode [ 51.668733][ T6217] ip6gretap0: entered promiscuous mode [ 51.671306][ T6217] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.671797][ T6217] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.673174][ T6217] bridge0: entered promiscuous mode [ 51.676044][ T6217] vcan0: entered promiscuous mode [ 51.682621][ T6217] bond0: entered promiscuous mode [ 51.682637][ T6217] bond_slave_0: entered promiscuous mode [ 51.682788][ T6217] bond_slave_1: entered promiscuous mode [ 51.686449][ T6217] team0: entered promiscuous mode [ 51.686459][ T6217] team_slave_0: entered promiscuous mode [ 51.686566][ T6217] team_slave_1: entered promiscuous mode [ 51.688132][ T6217] dummy0: entered promiscuous mode [ 51.693261][ T6217] nlmon0: entered promiscuous mode [ 51.694476][ T6217] batadv0: entered promiscuous mode [ 51.697179][ T6217] vxcan0: entered promiscuous mode [ 51.697565][ T6217] vxcan1: entered promiscuous mode [ 51.697945][ T6217] veth0: entered promiscuous mode [ 51.699143][ T6217] veth1: entered promiscuous mode [ 51.703081][ T6217] wg0: entered promiscuous mode [ 51.705329][ T6217] wg1: entered promiscuous mode [ 51.708007][ T6217] wg2: entered promiscuous mode [ 51.708838][ T6217] veth0_to_bridge: entered promiscuous mode [ 51.711085][ T6217] veth1_to_bridge: entered promiscuous mode [ 51.713570][ T6217] veth0_to_bond: entered promiscuous mode [ 51.716588][ T6217] veth1_to_bond: entered promiscuous mode [ 51.718057][ T6217] veth0_to_team: entered promiscuous mode [ 51.719984][ T6217] veth1_to_team: entered promiscuous mode [ 51.722874][ T6217] veth0_to_batadv: entered promiscuous mode [ 51.724088][ T6217] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 51.724113][ T6217] batadv_slave_0: entered promiscuous mode [ 51.725490][ T6217] veth1_to_batadv: entered promiscuous mode [ 51.726655][ T6217] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 51.726678][ T6217] batadv_slave_1: entered promiscuous mode [ 51.727915][ T6217] xfrm0: entered promiscuous mode [ 51.728912][ T6217] veth0_to_hsr: entered promiscuous mode [ 51.731451][ T6217] veth1_to_hsr: entered promiscuous mode [ 51.736137][ T6217] hsr0: entered promiscuous mode [ 51.738066][ T6217] veth1_virt_wifi: entered promiscuous mode [ 51.740071][ T6217] veth0_virt_wifi: entered promiscuous mode [ 51.742687][ T6217] virt_wifi0: entered promiscuous mode [ 51.753031][ T6217] vlan0: entered promiscuous mode [ 51.756367][ T6217] vlan1: entered promiscuous mode [ 51.762558][ T6217] macvlan0: entered promiscuous mode [ 51.765282][ T6217] macvlan1: entered promiscuous mode [ 51.768250][ T6217] ipvlan0: entered promiscuous mode [ 51.768359][ T6217] ipvlan1: entered promiscuous mode [ 51.781059][ T6217] macvtap0: entered promiscuous mode [ 51.783635][ T6217] macsec0: entered promiscuous mode [ 51.787704][ T6217] geneve0: entered promiscuous mode [ 51.792659][ T6217] geneve1: entered promiscuous mode [ 51.799919][ T6217] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 51.810726][ T6217] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 51.812127][ T6217] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 51.813569][ T6217] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 51.834518][ T6217] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 51.841973][ T6217] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 51.847088][ T5777] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.847113][ T5777] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.847131][ T5777] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.847148][ T5777] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.886538][ T5746] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 51.990889][ T6232] file system registered [ 51.991171][ T43] audit: type=1400 audit(1792073817.556:376): avc: denied { write } for pid=6228 comm="syz.3.106" name="functions" dev="configfs" ino=8129 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.392259][ T6241] syzkaller1: entered promiscuous mode [ 52.392278][ T6241] syzkaller1: entered allmulticast mode [ 52.941299][ T6255] tipc: Enabled bearer , priority 0 [ 52.999716][ T6258] lo: entered promiscuous mode [ 53.004299][ T6258] tunl0: entered promiscuous mode [ 53.006753][ T6258] gre0: entered promiscuous mode [ 53.013661][ T6258] gretap0: entered promiscuous mode [ 53.017343][ T6258] erspan0: entered promiscuous mode [ 53.021201][ T6258] ip_vti0: entered promiscuous mode [ 53.023230][ T6258] ip6_vti0: entered promiscuous mode [ 53.025776][ T6258] sit0: entered promiscuous mode [ 53.027296][ T6258] ip6tnl0: entered promiscuous mode [ 53.028534][ T6258] ip6gre0: entered promiscuous mode [ 53.032268][ T6258] syz_tun: entered promiscuous mode [ 53.036601][ T6258] ip6gretap0: entered promiscuous mode [ 53.037940][ T6258] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.038173][ T6258] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.038622][ T6258] bridge0: entered promiscuous mode [ 53.039957][ T6258] vcan0: entered promiscuous mode [ 53.041454][ T6258] bond0: entered promiscuous mode [ 53.041464][ T6258] bond_slave_0: entered promiscuous mode [ 53.041549][ T6258] bond_slave_1: entered promiscuous mode [ 53.042779][ T6258] team0: entered promiscuous mode [ 53.042787][ T6258] team_slave_0: entered promiscuous mode [ 53.042873][ T6258] team_slave_1: entered promiscuous mode [ 53.044129][ T6258] dummy0: entered promiscuous mode [ 53.047319][ T6258] nlmon0: entered promiscuous mode [ 53.048190][ T6258] batadv0: entered promiscuous mode [ 53.049695][ T6258] vxcan0: entered promiscuous mode [ 53.050076][ T6258] vxcan1: entered promiscuous mode [ 53.050592][ T6258] veth0: entered promiscuous mode [ 53.051930][ T6258] veth1: entered promiscuous mode [ 53.056046][ T6258] wg0: entered promiscuous mode [ 53.058282][ T6258] wg1: entered promiscuous mode [ 53.063072][ T6258] wg2: entered promiscuous mode [ 53.064428][ T6258] veth0_to_bridge: entered promiscuous mode [ 53.067516][ T6258] veth1_to_bridge: entered promiscuous mode [ 53.069578][ T6258] veth0_to_bond: entered promiscuous mode [ 53.070956][ T6258] veth1_to_bond: entered promiscuous mode [ 53.072433][ T6258] veth0_to_team: entered promiscuous mode [ 53.074677][ T6258] veth1_to_team: entered promiscuous mode [ 53.076806][ T6258] veth0_to_batadv: entered promiscuous mode [ 53.078018][ T6258] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 53.078041][ T6258] batadv_slave_0: entered promiscuous mode [ 53.079188][ T6258] veth1_to_batadv: entered promiscuous mode [ 53.080340][ T6258] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.080363][ T6258] batadv_slave_1: entered promiscuous mode [ 53.081538][ T6258] xfrm0: entered promiscuous mode [ 53.082462][ T6258] veth0_to_hsr: entered promiscuous mode [ 53.084318][ T6258] veth1_to_hsr: entered promiscuous mode [ 53.086908][ T6258] hsr0: entered promiscuous mode [ 53.087882][ T6258] veth1_virt_wifi: entered promiscuous mode [ 53.089063][ T6258] veth0_virt_wifi: entered promiscuous mode [ 53.090195][ T6258] virt_wifi0: entered promiscuous mode [ 53.093302][ T6258] vlan0: entered promiscuous mode [ 53.096894][ T6258] vlan1: entered promiscuous mode [ 53.101491][ T6258] macvlan0: entered promiscuous mode [ 53.103842][ T6258] macvlan1: entered promiscuous mode [ 53.110357][ T6258] ipvlan0: entered promiscuous mode [ 53.110435][ T6258] ipvlan1: entered promiscuous mode [ 53.116933][ T6258] macvtap0: entered promiscuous mode [ 53.119037][ T6258] macsec0: entered promiscuous mode [ 53.121040][ T6258] geneve0: entered promiscuous mode [ 53.123122][ T6258] geneve1: entered promiscuous mode [ 53.130370][ T6258] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 53.134151][ T6258] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 53.142296][ T6258] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 53.151576][ T6258] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 53.179280][ T6258] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 53.192008][ T6258] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 53.241431][ T6262] syzkaller0: entered promiscuous mode [ 53.241445][ T6262] syzkaller0: entered allmulticast mode [ 54.150197][ T6273] syzkaller1: entered promiscuous mode [ 54.150220][ T6273] syzkaller1: entered allmulticast mode [ 54.195374][ T5777] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.195407][ T5777] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.195429][ T5777] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.195447][ T5777] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.389838][ T43] audit: type=1400 audit(1792073819.966:377): avc: denied { write } for pid=6291 comm="syz.0.125" name="uncompressed" dev="configfs" ino=11577 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 54.392426][ T43] audit: type=1400 audit(1792073819.966:378): avc: denied { write } for pid=6291 comm="syz.0.125" name="h" dev="configfs" ino=11586 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 54.393691][ T43] audit: type=1400 audit(1792073819.966:379): avc: denied { write } for pid=6291 comm="syz.0.125" name="h" dev="configfs" ino=11586 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 54.393779][ T6292] [ 54.422083][ T6292] ====================================================== [ 54.424993][ T6292] WARNING: possible circular locking dependency detected [ 54.427676][ T6292] syzkaller #0 Not tainted [ 54.429368][ T6292] ------------------------------------------------------ [ 54.432248][ T6292] syz.0.125/6292 is trying to acquire lock: [ 54.434749][ T6292] ffffffff913ff8c8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.439375][ T6292] [ 54.439375][ T6292] but task is already holding lock: [ 54.442462][ T6292] ffff8880598b9dc0 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 54.446836][ T6292] [ 54.446836][ T6292] which lock already depends on the new lock. [ 54.446836][ T6292] [ 54.451178][ T6292] [ 54.451178][ T6292] the existing dependency chain (in reverse order) is: [ 54.454936][ T6292] [ 54.454936][ T6292] -> #3 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 54.458566][ T6292] lock_acquire+0x1d1/0x380 [ 54.460686][ T6292] down_write+0x8b/0x1f0 [ 54.462731][ T6292] configfs_depend_item_unlocked+0xf3/0x6a0 [ 54.465437][ T6292] usbg_make_tpg+0x251/0x610 [ 54.467597][ T6292] target_fabric_make_tpg+0xab/0x8c0 [ 54.470067][ T6292] configfs_mkdir+0x525/0xd40 [ 54.472306][ T6292] vfs_mkdir+0x364/0x850 [ 54.474339][ T6292] filename_mkdirat+0x48b/0x5e0 [ 54.476538][ T6292] __x64_sys_mkdirat+0x89/0xc0 [ 54.478754][ T6292] do_syscall_64+0x123/0x790 [ 54.480931][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.483621][ T6292] [ 54.483621][ T6292] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 54.486904][ T6292] lock_acquire+0x1d1/0x380 [ 54.489043][ T6292] __mutex_lock+0x1a4/0x1bd0 [ 54.491235][ T6292] tcm_alloc_inst+0x5f/0x1e0 [ 54.493424][ T6292] try_get_usb_function_instance+0x136/0x1f0 [ 54.496152][ T6292] usb_get_function_instance+0x16/0x70 [ 54.498670][ T6292] function_make+0x18c/0x3f0 [ 54.500825][ T6292] configfs_mkdir+0x525/0xd40 [ 54.503018][ T6292] vfs_mkdir+0x364/0x850 [ 54.505051][ T6292] filename_mkdirat+0x48b/0x5e0 [ 54.507308][ T6292] __x64_sys_mkdirat+0x89/0xc0 [ 54.509595][ T6292] do_syscall_64+0x123/0x790 [ 54.511752][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.514470][ T6292] [ 54.514470][ T6292] -> #1 (func_lock){+.+.}-{4:4}: [ 54.517457][ T6292] lock_acquire+0x1d1/0x380 [ 54.519579][ T6292] __mutex_lock+0x1a4/0x1bd0 [ 54.521773][ T6292] try_get_usb_function_instance+0x26/0x1f0 [ 54.524457][ T6292] usb_get_function_instance+0x16/0x70 [ 54.527001][ T6292] function_make+0x18c/0x3f0 [ 54.529182][ T6292] configfs_mkdir+0x525/0xd40 [ 54.531371][ T6292] vfs_mkdir+0x364/0x850 [ 54.533312][ T6292] filename_mkdirat+0x48b/0x5e0 [ 54.535545][ T6292] __x64_sys_mkdirat+0x89/0xc0 [ 54.537601][ T6292] do_syscall_64+0x123/0x790 [ 54.539750][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.542457][ T6292] [ 54.542457][ T6292] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 54.545893][ T6292] check_prev_add+0xeb/0xe60 [ 54.548045][ T6292] __lock_acquire+0x1528/0x1f40 [ 54.550316][ T6292] lock_acquire+0x1d1/0x380 [ 54.552471][ T6292] __mutex_lock+0x1a4/0x1bd0 [ 54.554631][ T6292] uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.557445][ T6292] configfs_symlink+0x695/0x1340 [ 54.559748][ T6292] vfs_symlink+0x178/0x4d0 [ 54.561907][ T6292] filename_symlinkat+0x2a6/0x560 [ 54.564317][ T6292] __x64_sys_symlinkat+0x9c/0xe0 [ 54.566629][ T6292] do_syscall_64+0x123/0x790 [ 54.568839][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.571546][ T6292] [ 54.571546][ T6292] other info that might help us debug this: [ 54.571546][ T6292] [ 54.575747][ T6292] Chain exists of: [ 54.575747][ T6292] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#26 [ 54.575747][ T6292] [ 54.581824][ T6292] Possible unsafe locking scenario: [ 54.581824][ T6292] [ 54.584900][ T6292] CPU0 CPU1 [ 54.587124][ T6292] ---- ---- [ 54.589390][ T6292] lock(&sb->s_type->i_mutex_key#26); [ 54.591702][ T6292] lock(tpg_instances_lock); [ 54.594697][ T6292] lock(&sb->s_type->i_mutex_key#26); [ 54.597975][ T6292] lock(gadget_subsys.su_mutex); [ 54.600089][ T6292] [ 54.600089][ T6292] *** DEADLOCK *** [ 54.600089][ T6292] [ 54.603452][ T6292] locks held by syz.0.125/6292: 2, last CPU#3: [ 54.606034][ T6292] #0: ffff888025252460 (sb_writers#14){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 54.609976][ T6292] #1: ffff8880598b9dc0 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 54.614488][ T6292] [ 54.614488][ T6292] stack backtrace: [ 54.616839][ T6292] CPU: 3 UID: 0 PID: 6292 Comm: syz.0.125 Not tainted syzkaller #0 PREEMPT(full) [ 54.620445][ T6292] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.624383][ T6292] Call Trace: [ 54.625752][ T6292] [ 54.626967][ T6292] dump_stack_lvl+0x100/0x190 [ 54.628924][ T6292] print_circular_bug.cold+0x178/0x1be [ 54.631151][ T6292] check_noncircular+0x146/0x160 [ 54.633167][ T6292] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 54.635590][ T6292] check_prev_add+0xeb/0xe60 [ 54.637486][ T6292] __lock_acquire+0x1528/0x1f40 [ 54.639431][ T6292] lock_acquire+0x1d1/0x380 [ 54.641289][ T6292] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.643763][ T6292] ? __pfx___might_resched+0x10/0x10 [ 54.645873][ T6292] ? audit_inode_permission+0x1ea/0x2a0 [ 54.648054][ T6292] __mutex_lock+0x1a4/0x1bd0 [ 54.649926][ T6292] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.652410][ T6292] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.654962][ T6292] ? __lock_acquire+0xe8b/0x1f40 [ 54.656982][ T6292] ? __pfx___mutex_lock+0x10/0x10 [ 54.658996][ T6292] ? selinux_inode_permission+0x14a/0x1130 [ 54.661376][ T6292] ? __pfx___might_resched+0x10/0x10 [ 54.663474][ T6292] ? make_vfsgid+0xf1/0x140 [ 54.665321][ T6292] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.667838][ T6292] ? security_inode_permission+0xbf/0x250 [ 54.670154][ T6292] uvcg_streaming_header_allow_link+0x7c/0x650 [ 54.672627][ T6292] ? inode_permission+0x374/0x620 [ 54.674642][ T6292] ? mntput_no_expire+0xe8/0x220 [ 54.676561][ T6292] configfs_symlink+0x695/0x1340 [ 54.678581][ T6292] ? __pfx_configfs_symlink+0x10/0x10 [ 54.680329][ T6292] vfs_symlink+0x178/0x4d0 [ 54.682100][ T6292] filename_symlinkat+0x2a6/0x560 [ 54.684100][ T6292] ? __pfx_filename_symlinkat+0x10/0x10 [ 54.686309][ T6292] ? strncpy_from_user+0x19d/0x2d0 [ 54.688306][ T6292] ? do_getname+0x191/0x390 [ 54.690148][ T6292] __x64_sys_symlinkat+0x9c/0xe0 [ 54.692172][ T6292] do_syscall_64+0x123/0x790 [ 54.694081][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.696443][ T6292] RIP: 0033:0x7ff55b99e559 [ 54.698339][ T6292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.706229][ T6292] RSP: 002b:00007ff55c91a028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 54.709728][ T6292] RAX: ffffffffffffffda RBX: 00007ff55bc25fa0 RCX: 00007ff55b99e559 [ 54.713023][ T6292] RDX: 0000200000000780 RSI: ffffffffffffff9c RDI: 0000200000000740 [ 54.716335][ T6292] RBP: 00007ff55ba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 54.719608][ T6292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.722874][ T6292] R13: 00007ff55bc26038 R14: 00007ff55bc25fa0 R15: 00007ffc4b60da78 [ 54.726147][ T6292]