last executing test programs: 45.837056197s ago: executing program 3 (id=4): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth1_to_bond\x00', 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f00000000c0)={0x0, @aes128, 0x0, @desc2}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000180)={0x290, r3, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0xc8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x98, 0x3, "0fe77cf975645045f1daded893860d38c15faec13c96e84087f5cc6d95608ca5fcea921395e4fb65f77def9070c4a5d3009914ba5f42f181761c1761a04065fd0c78e3e460adc2584b738c22b3a2de79dc0e2621c031c53513b77f8f6f8bc30fcff1d18985da4dc7803d7a3b2e48c75a534ff987d44ad12ea1e1a26ba8b9e6b714bc75cd314ed9c2f39412a557a325249c44fa76"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x10000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x80}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_BEARER={0xf0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc21c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2ca96877}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x7, @loopback, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @private=0xa010100}}, {0x14, 0x2, @in={0x2, 0x4e21, @local}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x67}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x51c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4ae0}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000001}, @TIPC_NLA_PUBL_LOWER={0x8}]}]}, 0x290}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000910) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000022c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0x2, 0xfff1}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) 45.630723328s ago: executing program 3 (id=6): pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r1, &(0x7f00000002c0)=ANY=[], 0xffffff6a) tee(r0, 0xffffffffffffffff, 0xfffffffffffffc01, 0x0) tee(r0, 0xffffffffffffffff, 0x60000000000, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) io_setup(0x200, &(0x7f0000000000)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bpf(0x200000000000, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000180)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000200)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000240)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2042, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x100) syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000020000402505a9a440000000018b09024400010100000009040000120206055d65d3518f0db80000052406000005240000000d240f01000000000000fcff00090581031000020b0009058202000200000009bce0d02c2c841ddd4f7d4b1e55c6109832542e19c531f61b83b93212508e0665158a341a"], 0x0) clock_getres(0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0xc, 0x6}, {0x5, 0xffff}, {0x0, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000580)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 42.946409963s ago: executing program 3 (id=37): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000680)='./pipefs\x00', &(0x7f00000006c0)='rpc_pipefs\x00', 0x800000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000740)='fd/3\x00') readv(r1, &(0x7f0000000780)=[{&(0x7f00000007c0)=""/4096, 0x1000}], 0x1) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newsa={0xf0, 0x10, 0x7, 0x0, 0x0, {{@in6=@empty, @in=@local, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x9, 0x10000000, 0x1}, {0x0, 0x2, 0x7}, {0x40000, 0xffffffff, 0xae8}, 0x0, 0x3508, 0xa, 0x2, 0xfe, 0x34}}, 0xf0}, 0x1, 0x0, 0x0, 0x1}, 0x890) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = getpid() r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x80) r5 = syz_pidfd_open(r3, 0x0) setns(r5, 0x24020000) r6 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000580)='\x00', 0x89901) mount_setattr(r8, &(0x7f00000005c0)='.\x00', 0x9000, &(0x7f0000000600)={0x0, 0xf5, 0x20000}, 0x20) rmdir(&(0x7f00000002c0)='./file2\x00') chdir(&(0x7f00000004c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./debug\x00', 0x1ff) sendmsg$nl_xfrm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x10c, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in6=@empty, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xc0f3, 0x2, 0x4, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x8001, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@loopback}, @XFRMA_SET_MARK={0x8, 0x1d, 0x5}]}, 0x10c}}, 0x8000) 42.859936717s ago: executing program 3 (id=39): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000600)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000640)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) setsockopt(r3, 0x84, 0x80, &(0x7f0000000040)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) r4 = socket$can_j1939(0x1d, 0x2, 0x7) mount$cgroup(0x0, &(0x7f00000007c0)='.\x00', &(0x7f0000000800), 0x10012, &(0x7f0000000840)={[{}, {@subsystem='blkio'}]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r5, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000000380)={&(0x7f00000003c0)={0x1d, r5, 0x0, {0x0, 0x0, 0x1}, 0xfe}, 0x18, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20008840}, 0x14004000) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000440)={r5, 0x1, 0x6}, 0x10) sendto$inet6(r3, &(0x7f00000000c0)="b0", 0x1, 0x40811, &(0x7f0000000100)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x38}}}}, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e20, 0x80, @remote, 0xb}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @loopback}}}, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) (async) close(r0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000600)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000640)={0x0, 0x1}, 0x1}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) (async) setsockopt(r3, 0x84, 0x80, &(0x7f0000000040)="1400000009000000", 0x8) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) mount$cgroup(0x0, &(0x7f00000007c0)='.\x00', &(0x7f0000000800), 0x10012, &(0x7f0000000840)={[{}, {@subsystem='blkio'}]}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) (async) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r5, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) (async) sendmsg$can_j1939(r4, &(0x7f0000000380)={&(0x7f00000003c0)={0x1d, r5, 0x0, {0x0, 0x0, 0x1}, 0xfe}, 0x18, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20008840}, 0x14004000) (async) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000440)={r5, 0x1, 0x6}, 0x10) (async) sendto$inet6(r3, &(0x7f00000000c0)="b0", 0x1, 0x40811, &(0x7f0000000100)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x38}}}}, 0x84) (async) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e20, 0x80, @remote, 0xb}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @loopback}}}, 0x84) (async) 27.804633611s ago: executing program 32 (id=39): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000600)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000640)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) setsockopt(r3, 0x84, 0x80, &(0x7f0000000040)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) r4 = socket$can_j1939(0x1d, 0x2, 0x7) mount$cgroup(0x0, &(0x7f00000007c0)='.\x00', &(0x7f0000000800), 0x10012, &(0x7f0000000840)={[{}, {@subsystem='blkio'}]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r5, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000000380)={&(0x7f00000003c0)={0x1d, r5, 0x0, {0x0, 0x0, 0x1}, 0xfe}, 0x18, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20008840}, 0x14004000) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000440)={r5, 0x1, 0x6}, 0x10) sendto$inet6(r3, &(0x7f00000000c0)="b0", 0x1, 0x40811, &(0x7f0000000100)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x38}}}}, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e20, 0x80, @remote, 0xb}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @loopback}}}, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) (async) close(r0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000600)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000640)={0x0, 0x1}, 0x1}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) (async) setsockopt(r3, 0x84, 0x80, &(0x7f0000000040)="1400000009000000", 0x8) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) mount$cgroup(0x0, &(0x7f00000007c0)='.\x00', &(0x7f0000000800), 0x10012, &(0x7f0000000840)={[{}, {@subsystem='blkio'}]}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) (async) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r5, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) (async) sendmsg$can_j1939(r4, &(0x7f0000000380)={&(0x7f00000003c0)={0x1d, r5, 0x0, {0x0, 0x0, 0x1}, 0xfe}, 0x18, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20008840}, 0x14004000) (async) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000440)={r5, 0x1, 0x6}, 0x10) (async) sendto$inet6(r3, &(0x7f00000000c0)="b0", 0x1, 0x40811, &(0x7f0000000100)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x38}}}}, 0x84) (async) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e20, 0x80, @remote, 0xb}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @loopback}}}, 0x84) (async) 26.610068416s ago: executing program 0 (id=197): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x28, 0x1e, 0x21, 0x70bd2b, 0x0, {0xa}, [@typed={0x14, 0xcb, 0x0, 0x0, @ipv6=@remote}]}, 0x28}}, 0x0) ioctl$TIOCSETD(r1, 0x80045440, &(0x7f00000000c0)=0x15) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth0_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x3b, 0x2, [{0x10009, 0x3}, {0x8000006, 0x6}]}}) 26.609558501s ago: executing program 0 (id=198): r0 = socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) (async) madvise(&(0x7f0000cf6000/0x4000)=nil, 0x4000, 0x16) (async) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x0, 0x0, 0x0, 0x8000005}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r3, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 26.531167286s ago: executing program 0 (id=202): r0 = fsopen(&(0x7f0000000000)='fusectl\x00', 0x0) (async) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000040)=0x2, 0x4) r2 = syz_open_dev$sndpcmc(0x0, 0x0, 0x40000) ioctl$SNDRV_PCM_IOCTL_INFO(r2, 0x81204101, 0x0) (async) openat$cgroup_freezer_state(0xffffffffffffffff, 0x0, 0x2, 0x0) (async) r3 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) recvmmsg(r3, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}, 0x100}], 0x1, 0x1000, 0x0) (async, rerun: 64) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async, rerun: 64) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x200000000000020) (async) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r4, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) set_mempolicy(0x1, 0x0, 0x6) (async) dup(r5) (async) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='pagemap\x00') pread64(r6, &(0x7f0000000700)=""/102400, 0x19000, 0x1000000000) (async) close_range(r0, 0xffffffffffffffff, 0x2) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000180)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) (async) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 32) r10 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) setsockopt$IP_VS_SO_SET_EDITDEST(r10, 0x0, 0x489, &(0x7f00000002c0)={{0x2c, @empty, 0x4e20, 0x0, 'sed\x00', 0x0, 0xffffffff, 0x64}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e21, 0x2000, 0x8000, 0x3, 0x1}}, 0x44) 26.346939779s ago: executing program 0 (id=204): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8a000, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x103a42, 0x32) ftruncate(r1, 0x6000000) copy_file_range(r1, 0x0, r1, &(0x7f00000001c0)=0x100, 0x9, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000100)=0x1a) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f00000002c0)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xc0}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000000300)='GPL\x00', 0x2, 0xfd90, &(0x7f0000002600)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000140)={0x7, 0x6, 0x8, 0x10000, 0x17, "9cbecf7e982e4b98c96ffb8248ebd8aa24425b"}) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r2, &(0x7f0000000500)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r2, &(0x7f0000002540)={0x90, 0x0, r3, {0x20000000000007, 0x0, 0x8, 0xe, 0x0, 0x7, {0x1, 0x0, 0x2, 0x6, 0xe, 0x5, 0x4007fff, 0x9, 0x7fd, 0x0, 0x5, r4, r5, 0x0, 0x1000}}}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x30}, [@ldst={0x6, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0xffffff33}, 0x48) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8a000, 0x0) (async) ioctl$TCXONC(r0, 0x540a, 0x2) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x103a42, 0x32) (async) ftruncate(r1, 0x6000000) (async) copy_file_range(r1, 0x0, r1, &(0x7f00000001c0)=0x100, 0x9, 0x0) (async) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000100)=0x1a) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f00000002c0)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xc0}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000000300)='GPL\x00', 0x2, 0xfd90, &(0x7f0000002600)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) (async) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000140)={0x7, 0x6, 0x8, 0x10000, 0x17, "9cbecf7e982e4b98c96ffb8248ebd8aa24425b"}) (async) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) read$FUSE(r2, &(0x7f0000000500)={0x2020}, 0x2020) (async) write$FUSE_ENTRY(r2, &(0x7f0000002540)={0x90, 0x0, r3, {0x20000000000007, 0x0, 0x8, 0xe, 0x0, 0x7, {0x1, 0x0, 0x2, 0x6, 0xe, 0x5, 0x4007fff, 0x9, 0x7fd, 0x0, 0x5, r4, r5, 0x0, 0x1000}}}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x30}, [@ldst={0x6, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0xffffff33}, 0x48) (async) 26.278086778s ago: executing program 0 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r0 = socket$inet_icmp(0x2, 0x2, 0x1) r1 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000400)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000440)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000540)={&(0x7f0000000580)=[0x0, 0x0], &(0x7f00000005c0), 0x2, r2}) mknodat$loop(0xffffffffffffff9c, &(0x7f00000005c0)='./file2\x00', 0x6000, 0x0) r4 = open(&(0x7f0000000700)='./file2\x00', 0x501, 0x10dd722b6e14c3dd) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000bc0)={&(0x7f0000000ac0)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000b40), 0x4, 0x1, 0x4, 0x4000028e}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r1, 0xc01064ab, &(0x7f0000000c00)={0x6, r3}) r5 = syz_ublk_setup_io_uring(0x832, &(0x7f0000000740)={0x0, 0x3, 0x100, 0xffffffff, 0x5e5, 0x0, r4}, &(0x7f00000007c0)=0x0, &(0x7f0000000800)=0x0, &(0x7f0000000840)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000c40)={0x2e, 0x0, 0x0, r4, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000900)=@any_dev={0x4, 0x2cf, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0x8}}}, &(0x7f0000000940)) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000600)={0x1, 0x1, &(0x7f0000000640)=[r2], &(0x7f0000000680)=[0x0], &(0x7f00000006c0)=[0x0], &(0x7f0000000700), 0x0, 0x7fffffff}) r9 = fcntl$dupfd(r0, 0x0, r0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x400, @loopback}, 0x1c) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000080)={r9, r10}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000009c0)='./sys\x00', &(0x7f0000000a00)='sysfs\x00', 0x0, 0x0) r11 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./sys/devices/system/machinecheck/machinecheck0/bank1\x00', 0x2, 0x40) write(r11, &(0x7f0000000a80)='3', 0x1) r12 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r13, &(0x7f00000000c0)={0xa, 0x4e21, 0xfffff8d0, @mcast2, 0x9}, 0x1c) process_vm_writev(r12, &(0x7f0000000140)=[{&(0x7f0000000180)=""/156, 0x9c}], 0x1, &(0x7f0000000240)=[{&(0x7f0000000280)=""/116, 0x20001c34}], 0x1, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000300)=r12) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xb635773f05ebbeec, 0x8031, r5, 0x0) mount(0x0, &(0x7f0000000340)='./cifs\x00', &(0x7f0000000380)='cifs\x00', 0x0, &(0x7f0000000cc0)='source=\xb1\x00\x00\x00\x00.0.0 \x97S\xd2\xff\x80\xf8\x82\x9f\x18\xac\xacz.1/test,username=root,pas]wo12345,handletimeout=1\x00\xe8f*H\xbc\x80\xd1O\xa1\x11\xdd\x03\xbbX\xd9.\xdaeF\xc13M\xc7\xe6\xcb\x82-\x18\x84\x98$\xcbA\xe4O\xda\xe4\x8c\x06\x9d\xa1w\x90\xbdN\xa6v\x99\x14\x13\xfb\xcc\xe7\xa1H\xd3[\x92\xeb\x98>\x1f\x14\xc8s\xc4\x18\xf2DG\xadN\x13\xad\x1dMN\xec\x9dM\xea\x8d\xea') 26.170259943s ago: executing program 0 (id=207): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e23, 0xfffffffe, @mcast1, 0x87}}, 0x0, 0x0, 0x3a, 0x0, "276148cd1259e41d8f0ffd4be8b6d180a19ecb3e60c92e9fe908c95534a69b91fe9e2770ba387440609895d7fbb1c08bdfd96493f4fc1810d150cc3f2bbd548044dcec63bc8b2168c59e27175814071e"}, 0xd8) syz_emit_ethernet(0x5e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa95000a11000086ca604df34200280600fc01000000008cae147f6c9d00000000000000000002fe80116300"/58, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a00604009078000013126d84a22012be73afefa596f1a731aeae0000"], 0x0) 17.890211241s ago: executing program 2 (id=260): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000100)="120000001c0000010011223344556600000101010101010101010101010101010100", 0x22) (async) write(r2, &(0x7f0000000140)="1b00000008001122334455660000", 0xe) (async) r3 = gettid() ioprio_get$pid(0x1, r3) (async) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x3c, 0x0, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETSW(r5, 0x5403, &(0x7f0000000180)={0xf8, 0x5, 0xbc, 0x9, 0x12, "1012a2c2e0d99745e390509d287560250d00"}) (async) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000001c0)=0xa) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f00000000c0)=@x86={0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x40, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x10}) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) 16.930631255s ago: executing program 2 (id=265): r0 = syz_open_dev$rtc(&(0x7f0000000000), 0x0, 0x802) ioctl$RTC_PIE_OFF(r0, 0x7006) r1 = syz_open_dev$dri(&(0x7f0000000200), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000240)={0x8, 0x7, {0xffffffffffffffff}, {0xee01}, 0x3, 0xa686}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x6}, @NHA_FDB={0x4}]}, 0x24}}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000340), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000380)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f00000004c0)=0x1) ppoll(&(0x7f0000000500)=[{r3, 0x2103}], 0x1, 0x0, 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000a00)={0x0, &(0x7f0000000b80)=[@nested_set_state_pages={0x140, 0x28, {0x0, 0x28, @gpa=0x58000}}, @nested_amd_clgi={0x17f, 0x10}, @wr_drn={0x68, 0x20, {0x3, 0x3}}, @wr_crn={0x67, 0x20, {0x2, 0x4}}, @nested_load_code={0x12e, 0x60, {0x2, "450f785c5f66430f01b90000008066ba4100b000ee420f7f1ddea6dc46360f09450f01f8b8010000000f01d90f79cc450fc10cac66baf80cb8301a6a88ef66bafc0c66b83c5466ef"}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0xa1, 0x5, 0xfffffffffffffc32, 0x1}}, @out_dx={0x6a, 0x28, {0xd278, 0x5, 0x7}}, @enable_nested={0x12c, 0x18}, @rdmsr={0x66, 0x18, {0x61b}}, @nested_amd_clgi={0x17f, 0x10}, @enable_nested={0x12c, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x10, @control64=0x2018, 0x62c6e254, 0xffffffffffffff2b, 0xfffffffffffffffa}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @guest32=0x480a, 0xfffffffffffffffd, 0x0, 0x7}}, @nested_load_syzos={0x136, 0x182, {0x0, 0x1, [@nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x782a}}, @in_dx={0x69, 0x20, {0x8bd7, 0x2}}, @rdmsr={0x66, 0x18, {0x904}}, @nested_amd_stgi={0x17e, 0x10}, @wrmsr={0x65, 0x20, {0xa55, 0x6}}, @nested_load_syzos={0x136, 0x20, {0x3}}, @nested_load_code={0x12e, 0x82, {0x2, "410f01d10f20c035200000000f22c0b9c90b0000b801000000ba000000000f300f56210f61a600380000c744240028770000c74424026eb7b6c1c7442406000000000f011c24b9800000c00f3235001000000f30b805000000b9008000000f01c136f2420f076767f3a5"}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @wr_drn={0x68, 0x20, {0x1, 0x4}}]}}, @wrmsr={0x65, 0x20, {0x216, 0xffffffffffffffff}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0xae, 0x8, 0x8, 0x5}}, @nested_set_state_pages={0x140, 0x28, {0x2, 0x0, @unmapped=0xfffffffffffff000}}, @cpuid={0x64, 0x18, {0x60, 0x3}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @control32=0x400c, 0x6bfacf2, 0x4, 0x7}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x81, 0x6, 0x1}}, @wr_drn={0x68, 0x20, {0x2, 0x26}}, @nested_amd_invlpga={0x17d, 0x20, {0x26000, 0x9fae}}], 0x4c2}) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, r4, 0x2000001, 0x10, r5, 0x0) shutdown(0xffffffffffffffff, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$getregs(0xe, r6, 0x100000001, &(0x7f0000000a40)=""/242) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x100000000000000) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x18, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b4000000000b00007910000000000000c310000401000000950074000000000031fb0d3a42319fa204399d17d34e075fdcda533ab1aa71ab1d764152e63925789381db3fe455e8dadc7dcf81189517730bed5d8036168bd2e27cc611027d29066927603deb92de3141e8ed7ac5b8902070213cdfdc506c4890cdeb50347c32060581172b94c6ba22a2b58eb6cbad46ed6e7964a2ba103b0b36f790bb41931f9a3d4dd127c1b4e49f7468f5e623950c4f67581c92ef9e7e8ece17d566c93a114d68c577d694b9844e0d9e306404cfc3bfbead9e1b96c6a6cb639bca6d"], &(0x7f0000000b40)='syzkaller\x00', 0x2, 0xc8, &(0x7f0000000100)=""/200, 0x41000}, 0x94) 16.068726652s ago: executing program 2 (id=280): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, 0x0}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x208080) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000100)={0xb3, @time={0xe2, 0x5}, 0xb3, {0x35, 0x9}, 0xa7, 0x2, 0x6}) 15.947525139s ago: executing program 2 (id=282): r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x2040, 0x121) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) fcntl$setlease(r0, 0x400, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000080)={0x2c, 0x0, 0x1, 0x70bd25, 0xfffffffc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xc2}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x25e2906596869c9d}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a0000140002"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/ieee80211/phy0/netdev:wlan0/active_links\x00', 0x1, 0x0) lseek(r1, 0x8002000000006, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000070000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="14000280060001000100000006"], 0x2c}}, 0x0) 15.900656687s ago: executing program 2 (id=283): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f0000000100)='270', 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000200)={0x30, 0x0, 0x8, 0x801, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x890d}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x2000c800) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) capset(&(0x7f0000000800)={0x20080522}, &(0x7f0000000840)={0x0, 0x0, 0x1, 0x46a, 0xffdfffff, 0x5}) openat(0xffffffffffffff9c, &(0x7f00000008c0)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0) read$FUSE(r2, &(0x7f0000000900)={0x2020}, 0x2020) read$FUSE(r2, 0x0, 0x0) syz_clone(0x80100, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000280), 0x0) socket$vsock_stream(0x28, 0x1, 0x0) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000340)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r3, 0x0) (async) listen(r3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000380)={0x28, 0x0, 0x2710}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000003c0)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x41, &(0x7f0000000480)={0x0, 0xc8a1, 0xc000, 0x3, 0x400c1}) (async) r5 = io_uring_setup(0x41, &(0x7f0000000480)={0x0, 0xc8a1, 0xc000, 0x3, 0x400c1}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1600000004"], 0x50) sendmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000600)="1b", 0x1}], 0x1}}], 0x1, 0x0) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_open_dev$mtd(&(0x7f00000002c0), 0x0, 0x2) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) mount$9p_virtio(&(0x7f0000000700), &(0x7f0000000740)='./file0\x00', &(0x7f0000000780), 0x2210088, 0x0) setxattr$system_posix_acl(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000880)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) 15.808898306s ago: executing program 2 (id=284): r0 = socket(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa8, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1bb}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff31}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private2}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x66f1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x4000045) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r3, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) socket(0x10, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa8, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1bb}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff31}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private2}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x66f1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x4000045) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r3, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) (async) 10.284459073s ago: executing program 33 (id=207): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e23, 0xfffffffe, @mcast1, 0x87}}, 0x0, 0x0, 0x3a, 0x0, "276148cd1259e41d8f0ffd4be8b6d180a19ecb3e60c92e9fe908c95534a69b91fe9e2770ba387440609895d7fbb1c08bdfd96493f4fc1810d150cc3f2bbd548044dcec63bc8b2168c59e27175814071e"}, 0xd8) syz_emit_ethernet(0x5e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa95000a11000086ca604df34200280600fc01000000008cae147f6c9d00000000000000000002fe80116300"/58, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a00604009078000013126d84a22012be73afefa596f1a731aeae0000"], 0x0) 8.090126868s ago: executing program 1 (id=330): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001240), 0x8082, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000001280)={0x79}) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x614) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000001300)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_unix(&(0x7f00000018c0)='./file0/file0\x00', &(0x7f0000001b00)='./file0\x00', &(0x7f0000001940), 0x800, &(0x7f0000001980)=ANY=[@ANYBLOB="7072616e733d756e69782c6d6d65702c66736d616769633d3078303030303030300e303030301d58e612b930"]) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001840)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffff689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x2}, @IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x3}]}}}]}, 0x48}}, 0x404c010) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000180)={[{@redirect_dir_nofollow}, {@nfs_export_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) syz_open_dev$sndctrl(&(0x7f0000001a40), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB='\t\x00'], 0x48) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bind$x25(r4, &(0x7f0000001ac0)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x1}}, 0x12) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') preadv(r5, &(0x7f0000000200)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0x15f, 0x0) r6 = fsopen(&(0x7f00000019c0)='erofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r6, 0x5, &(0x7f0000001a00)='source', 0x0, r6) open_by_handle_at(0xffffffffffffffff, &(0x7f0000001ec0)=ANY=[@ANYBLOB="9000000024b9e807d5dbd91a8a020000050000008000ef6d3ecc9077ce8397d8219a44f9622d928ac4b6d4ffd1a49cdc5aa0c83500d5c6ed973654a6d576c0aa5f8407a377db2a6e84e54a2524819ab44e3c412660824d697aa9611690e75d64daed51ca2da54d835d5907c5729c14a1afc76184ded6f7e39645aef32c66d4c775afb613810c4ec5204fa51f43e593487dbcc5473f8a0000"], 0x4802) r7 = socket(0x200000000000011, 0x2, 0x10) bind$packet(r7, &(0x7f0000001900)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000001b40)={0x0, 0x8000}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001b80)={0x6, 0x3, &(0x7f0000001c40)=ANY=[@ANYBLOB="18000000020000000000000095"], 0x0, 0x81, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) syz_emit_ethernet(0x6a, &(0x7f0000001700)={@random, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xe000, 0x0, 0x11, 0x0, @private=0xa010100, @empty}, {0x4e21, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "177cea52e623f8c92b64515bb800f09a613a69340c171d69", "84366ef5bdfb613190bf673b9cc9f74723ab9e4f7fb7c8ada9a6dfb319a4727d"}}}}}}, 0x0) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001cc0)={0x6, 0x3, &(0x7f0000001d80)=ANY=[], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x26}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001e00)={r8, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000001e80)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) 7.760427517s ago: executing program 1 (id=331): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000180)=0x200000, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_RTT={0x8, 0x7, 0x101}, @TCA_CAKE_FWMARK={0x8, 0x12, 0xf}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4004040}, 0x24040) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x20008844) 7.536478527s ago: executing program 1 (id=334): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) close(r0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000014c0)={{r0}, &(0x7f0000001440), &(0x7f0000001480)=r3}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000500)={r2, &(0x7f0000000280)="275fbb93eb0d205b92a35426f5b66577a2500a82459385ffea2cfb991a458b41ee51cc4d71412e0230a80d976608083b800f7fd6ed2ef082f4560cd98843be1d5ed040750a592e17dabb62447abaaeca4586898261dc78da99c675c10750a588e61dc9fa3168282c8b76b8409a4c12c0b3688a76409106d3016c151970c0f1e971b24e4fab1cea11c8e9f59b8b35d750884f3ea3f7a3e74425d5907cf5b81f1fa00a9425a58953d792832d07794e59b54aa2bea7d9934dce9698e6decf926f0ea3b09bbb9975a5c1064cdfed3adb10f45bf763ae373e062db230e63db81762181f0c2571a6f331", &(0x7f0000000380)=""/110}, 0x20) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 7.533829715s ago: executing program 1 (id=336): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r1, &(0x7f0000000200)='7', 0x1) read$FUSE(r1, &(0x7f0000000240)={0x2020}, 0x2020) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002300)={&(0x7f0000002340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x8, [@struct={0x7, 0x1, 0x0, 0x7, 0x0, 0x0, [{0x3, 0x4, 0x1}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}, 0x0, 0x38, 0x0, 0x1}, 0x28) mount$tmpfs(0x0, 0x0, 0x0, 0x181c22, &(0x7f0000002280)) r2 = fsopen(&(0x7f0000000000)='affs\x00', 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r2, 0x6628) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@flushpolicy={0x18, 0x12, 0x105, 0x6, 0x25dfdbff, "", [@proto={0x5, 0x19, 0xff}]}, 0x18}, 0x1, 0xff80}, 0x20040840) write$binfmt_format(r1, &(0x7f00000022c0)='1\x00', 0x2) 7.397837516s ago: executing program 1 (id=339): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0xfffffff7, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x5}, 0x50) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000012c0)=ANY=[@ANYBLOB="1b00000000000000000000000100000000000000", @ANYRES16=r0, @ANYBLOB="040000000000000000000000000000d32b6cf200", @ANYRES32=0x0, @ANYRES16=r1, @ANYBLOB="05020000010000000500000000000000000000000000ae253cffff00000000"], 0x50) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000b00)={'tunl0\x00', &(0x7f0000000a80)={'syztnl0\x00', 0x0, 0x40, 0x10, 0x1, 0x8, {{0xd, 0x4, 0x2, 0x10, 0x34, 0x66, 0x0, 0x7f, 0x2f, 0x0, @multicast2, @empty, {[@end, @ssrr={0x89, 0x17, 0x75, [@multicast1, @remote, @multicast1, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x29}]}, @ra={0x94, 0x4}, @noop]}}}}}) r4 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f80)={0x6, 0x16, &(0x7f0000001400)=ANY=[@ANYBLOB="18000000cabe000000000000010000803b6280000400000018000000ff0000000000000025050000bf66c0ffe1ffffff18110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000000000000850000008600000085100000fdffffff8520000003000000181100004a1372e002d929e261364115ac88e3e8ec7c4f4582b8fd47d8137c2b189b18806bf23c2a54db0c6e0041834faf0d04221b9a53d78f2b90efa82ae60b3d20", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000d00)='GPL\x00', 0x1ff, 0xb8, &(0x7f0000000d40)=""/184, 0x40f00, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000e00)={0x1, 0x5}, 0x8, 0x10, &(0x7f0000000e40)={0x2, 0x10, 0x8ea1, 0x9}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000e80)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1], &(0x7f0000000ec0)=[{0x0, 0x1, 0xa}, {0x1, 0x4, 0x4, 0x4}, {0x3, 0x2, 0xd, 0x8}, {0x1, 0x1, 0x7, 0xc}, {0x0, 0x3, 0x10, 0xb}, {0x2, 0x1, 0x8}, {0x0, 0x2, 0xa, 0x3}, {0x2, 0x5, 0xf, 0xa}, {0x2, 0x3, 0x2, 0x3}], 0x10, 0xfffffff8}, 0x94) r6 = creat(&(0x7f0000001040)='./file0\x00', 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000001080)={0x900}) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001100)=@bpf_tracing={0x1a, 0x25, &(0x7f0000001500)=ANY=[@ANYBLOB="18000000e38d000000000000cb00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000c3ec00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085e5000082000000bf91000000000000b7070000000000000040000084000000b700000000000000950002000000000073c210a9dd5c81c67abea20a9d555b61bcea457480996ff8a22c13cad7c2d3f40e4c6f5819885f8ea7afe241db0ab794d9c57b28c7066991cc016d636dbdcb617270a4bb921765eb76a4b2d7eee1f6dafdb8013004623f6a418b6609d6ad20b4d9b65ce81c95241c9171bb07754971c8c8b0dd249a353d42beb9d9897c12bd71341f723f5cb8ae4f6c741d2167bbcdd2ed10297b051c73b676188d081245af31a2ebb172bbef25a1a83c7d9cb056c172e0f2498e885e20810dc8256ec138b1b665a864d09252129578b70bee30aa101b6227c7f3f7a5a8f77e4b70dee7f2d447623fc23c71c728a8253d30024d65941e7de73c5f20114ea631e36673408c8bc0078a03493a447df601b6b2ef7ab551eef314e29de54a988307bf57979321fbeb8fdcefb8e24f294945f9d7f492ee40cdb29709f283b1cdd55dbad8d6ca14fedc6bef5b3678b7b977f7f42ed084ce296e88e04fe916518bd9abbf8e8b4d65227ac6ebdba6c38c03ec5bc12e95fe3b4ef963e3b615f9bfc28cacf1553fa69d53a59349ccb845883590e06f371451e4f9e3c554dd545773e51389c0062643225e4db6b554a84cb5d7971c39f0e7edfe0f08b02218bab3d3626d7f7c7cf5f539636a7ade28e58d93102a74827f80"], &(0x7f0000000940)='syzkaller\x00', 0xffffffff, 0xf5, &(0x7f0000000980)=""/245, 0x40f00, 0x5, '\x00', r3, 0x19, r4, 0x8, &(0x7f0000000bc0)={0x2, 0x4}, 0x8, 0x10, &(0x7f0000000c00)={0x3, 0xf, 0x82fb, 0x1ff}, 0x10, 0x24875, r5, 0x0, &(0x7f00000010c0)=[r6], 0x0, 0x10, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000300)={r7, 0x10, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') preadv(r8, &(0x7f00000002c0)=[{&(0x7f00000011c0)=""/205, 0xcd}], 0x1, 0x5c, 0x25c) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001340)=@bpf_lsm={0x6, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000580)='GPL\x00'}, 0x94) r10 = bpf$ITER_CREATE(0xb, &(0x7f00000005c0)={r9}, 0x8) close(r10) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000600)={r9, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000680)={r10, r7, 0x4, r9}, 0x10) capset(&(0x7f0000000b40)={0x20071026}, &(0x7f0000000b80)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0600000004000000040000000800000000000000", @ANYRES32, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000040000060ee0000000800"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) exit(0x8000) r12 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r12) ptrace$setsig(0x4203, r12, 0x80, 0x0) ptrace$PTRACE_GETSIGMASK(0x420a, r12, 0x8, &(0x7f0000000000)) syz_open_procfs(r12, &(0x7f0000000040)='net/dev_snmp6\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 6.467398999s ago: executing program 1 (id=344): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) listen(0xffffffffffffffff, 0x1) unshare(0x6020400) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x4}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000140)=[@in={0x2, 0x4e21, @empty}], 0x10) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000180)={0x0, 0x5}, 0x8) sendmsg$inet_sctp(r2, &(0x7f00000001c0)={&(0x7f0000000200)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000280)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x4000891) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="0b0002"], 0xc) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='ip6_vti0\x00', 0x10) sendmmsg$inet(r1, &(0x7f0000000080)=[{{&(0x7f00000000c0)={0x2, 0x4e21, @loopback}, 0x10, 0x0}}], 0x1, 0x0) tkill(r0, 0xf) 1.050134619s ago: executing program 4 (id=370): r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) write$6lowpan_enable(r0, &(0x7f0000000740)='1', 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./tracefs_dir\x00', &(0x7f0000000880)='tracefs\x00', 0x200802, 0x0) openat(0xffffffffffffff9c, &(0x7f00000008c0)='./tracefs_dir/trace_marker\x00', 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001400010000000000000000002d00000002000000050002"], 0x20}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f00000006c0)=0xd3a0, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="bf16000000000000b707000001f1f0ff5070000000000000200000002c41000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d32872c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff010011d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcebc7586186fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35eff00006b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f58fa48f61071f548d411353965615c24c1860fd0dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8bb07ebf6e3f16584e95607e319b2ea9778289c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba17a647a171c2fc73a8c7541c7ffaafba62195fce77382ae962f30d4a377d760040975a44aa73a4e687d06f96f0987b980f6f883534dfc71ace539eeeb08cff54e0e05d5e0563660a3664c67d0eb9cdf4eab93ab4bf1972a2acc5c5d43dc2f2b66d7493c390d042d896a1ad772f6d4c2cf38ba0"], &(0x7f0000001400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001440), 0x57, 0x10, &(0x7f0000001480), 0xffffffffffffffc9}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000014c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000001500)=r3, 0x4) sendmsg$sock(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000015c0)="67f1", 0xfdef}], 0x1}, 0x40840) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="e000000013000100000000000000000078636861636861323000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af97910fa570f87f98918355a7d82946009aa53f69f22cc930a2e6dfc0147bebe21704d07af36c90a801e58336c951bb05e8774ea0c48af5adc169586ee98cb874da08ff562eb32a0ac5aec90796006d07ef7b71ae3529580aa24ceb5e555005b27da821e41d664c35e5a8bf15d40fb16bad16f99bcaa42fb94d8834cf1d73efc3332a600822cbac482233136bfacb6346143f7a2fd8d940146115e8c9bea0825a7bd8fd7d4be32f090c7d228f2f3f0372c0973c284a23f2410b9872926ba6cc72cc612fd508312ba8b82034fad3ecb30ebb57b8c98c32dee21481ad691e1a36aed0f3a677d5f0766bccb47d65bc5568a21d253cb01bc04fcd2131b96a4c78b8ef8a62e8a181cb097458972edd471f6b368063e9c92399"], 0xe0}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000001680)={0x14, 0x0, 0x300, 0x0, 0x0, {{0x2}, {@void, @void}}}, 0x14}, 0x1, 0x6c00}, 0x4014800) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000016c0)={'wlan1\x00'}) ioctl(r7, 0x8b32, &(0x7f0000001700)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="2800000010000104fffffffffedbdf2500000020", @ANYRES32=0x0, @ANYBLOB="42280200aa0006000800250000000000"], 0x28}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'macvlan1\x00', @local}) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c00000002060108000000000000000001000000050005000a000000050001000700040005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000001c00078008001340000000020800124000000b3108000840", @ANYRESOCT=r8], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r10 = socket$tipc(0x1e, 0x4, 0x0) getsockopt$TIPC_IMPORTANCE(r10, 0x10f, 0x7f, &(0x7f0000000440), &(0x7f0000000480)=0x4) getsockopt$TIPC_IMPORTANCE(r10, 0x10f, 0x83, &(0x7f0000000140), &(0x7f00000001c0)=0x4) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000180), 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000009c0)={'dvmrp0\x00'}) 900.401375ms ago: executing program 4 (id=374): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) socketpair(0x28, 0x80000, 0xb, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r4, 0x84, 0x23, &(0x7f00000001c0)={r5, 0x14e8}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000200)={0x6, 0x5, 0x6, 0x9, r5}, 0x10) r6 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_set_state_pages={0x140, 0x28, {0x0, 0x14, @arbitrary=0x8}}, @nested_vmlaunch={0x12f, 0x18}], 0x70}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 745.780029ms ago: executing program 34 (id=284): r0 = socket(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa8, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1bb}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff31}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private2}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x66f1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x4000045) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r3, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) socket(0x10, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa8, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1bb}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff31}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private2}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x66f1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x4000045) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r3, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) (async) 698.142405ms ago: executing program 4 (id=378): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002300)={&(0x7f0000002340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x8, [@struct={0x7, 0x1, 0x0, 0x7, 0x0, 0x0, [{0x3, 0x4, 0x1}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}, 0x0, 0x38, 0x0, 0x1}, 0x28) 615.993732ms ago: executing program 4 (id=380): set_mempolicy(0x6005, &(0x7f0000000140)=0xfffffffffffffffd, 0x4) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = memfd_create(&(0x7f0000000800)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r1 = dup(r0) write$binfmt_elf64(r1, &(0x7f0000000900)=ANY=[@ANYBLOB="7f454c46f2092da32a0200000400000002003e00ffffffffb80100000000000040000000000d00000002000000000010f9001a2d0800380001"], 0x78) execveat(r1, &(0x7f0000000940)='\x00', 0x0, 0x0, 0x1000) syz_clone3(&(0x7f0000000180)={0x22001500, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89ff, &(0x7f0000000200)={'bridge0\x00', &(0x7f0000000240)=@ethtool_coalesce={0xf, 0x0, 0x1000, 0x7, 0x40, 0x10, 0xffff, 0x5, 0x2, 0xfffff800, 0x8001, 0x9, 0x81, 0x12804b33, 0xc, 0x4d22, 0x80000000, 0x5b7, 0xffffffc0, 0x2000d527, 0x6, 0xb, 0x4}}) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/v4_end_grace\x00', 0x2, 0x0) io_submit(0x0, 0x0, 0x0) r4 = fanotify_init(0x2, 0x100000) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000500)={@local, 0x2, 0x2, 0xff, 0x0, 0x9, 0x3}, 0x20) r6 = socket$inet6(0xa, 0x1, 0x3) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f00000002c0)={0x0, {{0xa, 0xffff, 0x0, @mcast1}}}, 0x88) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000006c0)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f00000003c0)=ANY=[@ANYRESDEC=r2, @ANYRES32=r6, @ANYRES64=r6, @ANYRES32=r4], 0x110) syz_emit_ethernet(0x3e, &(0x7f0000000a00)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaa3aaaaaa2686dd60011c4e01083a00fe800094d855f4acc9ae64000000000000000000000000bbff020000000000000000fe00000000018f00907801000000"], 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r8 = io_uring_setup(0x6688, &(0x7f0000000400)={0x0, 0xf753, 0x3800, 0x1}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r8, 0x20, &(0x7f0000000600)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000680)={&(0x7f00000004c0)="9ddec95b43b7ebec2f94f30aca28400056d62b64bbbec5a93d5c0d67cdb1516fea009acd72372659f98290640f016ba5b1c4a28f9890e6c5baddc787", 0x3c, 0x0, 0x0, 0x80000000}, &(0x7f0000000700)={&(0x7f0000000740), 0x0, 0x1}, {}, 0x0, 0xfffffffd}, 0x1) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r8, 0x24, &(0x7f0000000780)={0x0, 0x1}, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$dri(&(0x7f0000000740), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r9, 0xc01864c6, &(0x7f0000000980)={0x0, 0x0, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r10, 0xc01864c6, &(0x7f00000009c0)={0x0, 0x0, 0x800}) write(r3, &(0x7f0000000100)='1\n', 0x2) 418.908669ms ago: executing program 4 (id=381): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000740)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x1}, @cpuid={0x64, 0x18, {0x0, 0x6}}, @nested_set_state_pages={0x140, 0x28, {0x3, 0x36, @unmapped=0xdddd0000}}], 0x58}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 32) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x3, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa402}) (async, rerun: 32) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r1, 0x8008ae9d, &(0x7f0000000100)) 418.643796ms ago: executing program 5 (id=382): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x80) ioctl$FE_GET_INFO(r0, 0x80a86f3d, &(0x7f00000000c0)) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x7, 0x4, &(0x7f0000000080)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}]}, &(0x7f0000000040)='GPL\x00', 0x5}, 0x90) 316.174145ms ago: executing program 5 (id=383): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000100)={0x1, 0x100, 0x659}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r1, 0x401}, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000009c0)='./sys\x00', &(0x7f0000000a00)='sysfs\x00', 0x210008, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000000201010200000000000000000a000009100002800c000280050001003a0000000c001980080002000808"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4050) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1c0) syz_open_dev$vcsu(&(0x7f00000003c0), 0x4, 0x101100) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/ttyUSB0\x00', 0x102, 0x700) openat(0xffffffffffffff9c, &(0x7f0000000a40)='./sys/class/net/bridge0/bridge/multicast_router\x00', 0x42, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0000, 0x0) copy_file_range(0xffffffffffffffff, 0x0, r3, &(0x7f0000000240)=0x41, 0x7, 0x0) 270.479688ms ago: executing program 5 (id=384): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$video(&(0x7f0000000040), 0x1, 0x181000) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0x4020565b, &(0x7f00000000c0)={0x5, 0x7, 0x3}) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r1, 0xc0305616, &(0x7f0000000100)={0x0, {0x4}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000c80)={0x1d, r3, 0x0, {0x2, 0xf0, 0x4}, 0xfe}, 0x18) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r4 = socket(0x28, 0x5, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000000)={0x1, 0x5}, 0x8) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000cc0)=0x1, 0x4) sendmmsg(r2, 0x0, 0x0, 0x4000041) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000dc0)=[{0x1, 0x1, {0x1, 0x1, 0x4}, {0x2, 0xff, 0x4}, 0xff, 0x106}, {0x1, 0x3, {0x0, 0xf0, 0x6}, {0x2, 0xff, 0x4}, 0x3, 0xff}], 0x40) sendmsg$nl_route_sched(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e80)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r3, {0xffff, 0xe}, {0xf, 0xa}, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x2004c016}, 0x20000050) 208.406887ms ago: executing program 5 (id=385): r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) (async) mkdir(&(0x7f0000000000)='./file0\x00', 0x1) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000001e00)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r2, 0x3, 0x5004) (async) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001d80)=@broute={'broute\x00', 0x20, 0x2, 0xa38, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000180], 0x11, 0x0, &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{0x11, 0x20, 0x88a2, 'veth0_to_bridge\x00', 'sit0\x00', 'bridge_slave_0\x00', 'veth0_vlan\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @random="df0921f6558b", [0xff, 0xff, 0xff, 0xff], 0x0, 0x8b8, 0x8b8, 0x908, [@among={{'among\x00', 0x0, 0x418}, {{@offset=0xc, @zero, 0x2, {[0x8, 0x7, 0x200, 0x7, 0x2c0, 0x5564, 0x6, 0x7f, 0x6, 0x0, 0x6ff8, 0x8, 0x1ff, 0x4e, 0xb, 0x3, 0x6, 0x10000, 0x9, 0xfffffff8, 0x9, 0xa, 0x9, 0x19e, 0x7, 0x3, 0x2, 0xffff1255, 0x4, 0xfffffff7, 0x7fff, 0x7, 0x6, 0x83, 0x7, 0x6, 0x5, 0x7, 0x8, 0xb, 0x7, 0x54d, 0x1, 0xf23, 0x1, 0x8, 0x6, 0x40, 0x9, 0x0, 0x6, 0x200, 0x0, 0x5, 0x30000, 0x6, 0x1364, 0x1, 0x8, 0xf871, 0x5, 0x7, 0x5ee, 0x7, 0x6, 0xe9, 0x5, 0x5, 0x101, 0xfff, 0x8000, 0x7e20, 0x2, 0x5d6, 0x9, 0xf, 0x6, 0x8, 0x1, 0x622a, 0x7486, 0x6, 0xffffffff, 0x77cc2895, 0x7fffffff, 0x7, 0x3, 0x4, 0x6, 0xe0000000, 0x9, 0x8, 0x8, 0x8, 0x3, 0x8, 0x2, 0x64c0c08d, 0xaaf, 0x5, 0xba87, 0x81, 0x1df, 0x3, 0xa22, 0x9b, 0x9, 0x49ff, 0x9, 0x4, 0xc5, 0x5, 0x2, 0x0, 0x3, 0x54c57863, 0x8, 0xf5, 0xdcca, 0xb683, 0x9, 0x5, 0xff, 0x3, 0x0, 0x2, 0x6, 0x5, 0x7, 0x7, 0x3, 0x5, 0xc000000, 0x5, 0xc4, 0x2, 0x3, 0x7, 0xb, 0x3e8, 0x5, 0x8, 0xee, 0x1000, 0xea, 0x6aa, 0x10, 0x6, 0x3, 0x8, 0x6, 0x5, 0x10001, 0x1, 0x9, 0x1, 0x0, 0x3e, 0xba920, 0x2, 0x5b4, 0x7fff, 0x2118, 0x5, 0x1151, 0x4, 0x1, 0x2, 0x400, 0xb9, 0xff, 0x2, 0x9, 0x7, 0xfffffffc, 0x40, 0x1, 0x5, 0x2, 0x38a, 0x3, 0xa, 0x4, 0x0, 0x17d, 0x39c6, 0x8, 0xff, 0x7, 0x3, 0x40, 0x3, 0x6, 0x4, 0x6, 0x6, 0x200, 0x2000, 0x8, 0x7, 0x2, 0x4c, 0xf7a, 0x0, 0x1, 0x80000001, 0x6, 0x2, 0xb56, 0xff, 0x6, 0x4, 0x8001, 0x10001, 0x3, 0x0, 0x7, 0xffff, 0x7, 0x2, 0x800, 0x4, 0xd, 0x7fffffff, 0x2, 0x5f, 0xffffffff, 0x10, 0x0, 0xb, 0x4, 0x4, 0x1, 0x3464, 0x2, 0x0, 0x1, 0x0, 0x401, 0x5, 0x2c9, 0xfffffffc, 0xe, 0x43, 0x1540, 0x4, 0x80, 0x6, 0x4, 0x3ff, 0x464, 0x6a, 0x6, 0x9, 0x2, 0x9, 0x8000]}, {[0x5, 0x4, 0x0, 0x7ff, 0x4, 0x9, 0x55dca6e2, 0x5a, 0xc, 0x51, 0xb, 0x2, 0x9, 0x1, 0x7, 0xffffffff, 0x7, 0x7, 0x4, 0x6348, 0xffff, 0x7, 0x4, 0x1bb1, 0x4, 0x7, 0x2, 0x9, 0x2, 0x5, 0x10000, 0x7f, 0x9, 0xdd9, 0xffffffff, 0x1, 0x1e6, 0x8, 0x4f1, 0x4, 0xfffffff7, 0x9, 0x4, 0x8c, 0x5, 0x0, 0x8, 0x10001, 0x2, 0x76, 0x6, 0x40, 0x1000, 0x1, 0x9, 0x6, 0x7, 0x3, 0x7, 0x2, 0xfff, 0x8, 0x0, 0x1, 0x9, 0x800, 0x8b41, 0x8, 0xa50a, 0x3ff, 0xffffff52, 0x7, 0x0, 0x4, 0x9, 0x3e000, 0x40, 0x45, 0x0, 0x9, 0x4, 0x9, 0x2, 0x5, 0xaa, 0x7fffffff, 0x10001, 0x94, 0x9, 0x4, 0x2, 0x80, 0xc, 0x5, 0x3, 0x2d85, 0x4, 0x7, 0x7, 0x7, 0xa, 0x1, 0x9, 0xd98, 0xc, 0x4c, 0x3, 0x9, 0x6, 0xfff, 0x1000, 0x0, 0xfff, 0x4, 0x1, 0x80, 0x7fffffff, 0x1ff, 0x401, 0x3, 0x1a, 0x10000, 0x2, 0x5, 0xfffffff8, 0x1, 0xda0, 0x2, 0xc33, 0x4, 0x4, 0x50000, 0x9, 0x2, 0x0, 0x6, 0x4, 0x9, 0x0, 0x80000001, 0x4707, 0x2, 0x6, 0x8, 0x4, 0x8, 0x0, 0x5, 0xe25, 0x9, 0x6, 0xfb, 0x3ff, 0x9, 0x5, 0x1, 0xe3a, 0x49f, 0xc, 0x401, 0x773c0cea, 0xffffffff, 0x4, 0x9, 0x82, 0x9, 0x8, 0x401, 0x2, 0x7, 0x9a, 0x7, 0x0, 0x80000001, 0x3, 0x1, 0xa663, 0x2, 0xd3f, 0x7, 0x1, 0xa, 0x42b3, 0x0, 0x7, 0xc33, 0x1000, 0x5, 0x0, 0x8, 0x6a, 0x81, 0x2, 0x8d3, 0x1000, 0x9, 0xfffffe00, 0x5, 0x3, 0x6f62, 0xc, 0x0, 0x6, 0x3, 0x0, 0x5, 0x80200000, 0x5, 0x7, 0x0, 0xffffff7f, 0xa6f, 0xc13, 0x0, 0x91, 0x4, 0x7, 0x10001, 0x7, 0x739, 0x7, 0x3, 0x7, 0xa4d0, 0x3, 0x2, 0x4cc5, 0x3, 0x1, 0x0, 0x7, 0x8, 0x7, 0xf, 0xf85, 0x7, 0x3, 0x40000, 0x9, 0x8, 0xa, 0x4, 0x9, 0x4, 0x4, 0x3ff, 0x3, 0x4, 0xbd3, 0x6, 0x6a98, 0x9, 0x2, 0xd35, 0x299, 0x401, 0x1]}}}}], [], @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0xf46, 'syz1\x00', {0x7}}}}}, {0x11, 0x20, 0xcdcf60ba08825cd4, 'veth0_to_hsr\x00', 'nicvf0\x00', 'dummy0\x00', 'macsec0\x00', @empty, [0xff, 0xff, 0x0, 0xff, 0xff], @remote, [0x0, 0xff, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}]}, 0xab0) 139.06785ms ago: executing program 5 (id=386): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400001, 0x0) ioctl$VHOST_VDPA_GET_STATUS(r1, 0x8001af71, &(0x7f0000000040)) preadv2(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/247, 0xf7}, {&(0x7f0000000180)}], 0x2, 0x4, 0x4, 0x5) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00000002c0)={r3, r1, 0x62, 0x63, &(0x7f0000000240)="2cdc50e4511c2d61e9694c025c3d4790e824b1ec7faae099357a03f09042af50923442e9d0b4e3d647e3840a94589068c0c08aef2fd4d9f239509634b75e57ce40b49fa3c9adc2427978796002e335b41c7ab8c6994c7ec03c24cd08f5a25c8e6b59e3", 0xf7, 0x22, 0xff99, 0x49, 0x6, 0x2, 0xcd4, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r1) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, r4, 0x300, 0x70bd25, 0x25dfdbff, {{}, {}, {0x10, 0x13, @l2={'eth', 0x3a, 'bond0\x00'}}}, ["", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) r5 = open$dir(&(0x7f00000004c0)='./file0\x00', 0x200200, 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x2010, r1, 0x140000000) bind$802154_dgram(r1, &(0x7f0000000500)={0x24, @none={0x0, 0x1}}, 0x14) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000640)={&(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0, 0x0], &(0x7f0000000600)=[0x0], 0x6, 0x5, 0x2, 0x1}) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000680)=0xffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={r1, 0xe0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x1, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0], 0x0, 0x92, &(0x7f0000000800)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000880), &(0x7f00000008c0), 0x8, 0xb9, 0x8, 0x8, &(0x7f0000000900)}}, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r6, &(0x7f0000000b00)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x3c, r2, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c005}, 0x840) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000b80), r0) sendmsg$DEVLINK_CMD_GET(r6, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x50, r8, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20004084}, 0x20040800) ioctl$sock_netdev_private(r3, 0x89f9, &(0x7f0000000cc0)="795628821d59c4a264235be2c7e6bab10fd004c5972d0f82012edcf30aa738dcbd620ab7b5ed8acae858ab2aa2c88d08c3fc80f822c22736dc8bcbcab28392361516b8fd541eda4cbe25b4acb118d8de0a2fcaf66c434460a7e55cba39baead7c132feb024a068b55da4e2a93f5579879f5408a86b27692faecb8569da67c46c052ee3e69454b837473ee4dbf932f8c92b8086749a202876609f5e606af780b2770e958ed38f3f100d4b70a1659c25ca4e9257ee2c4e0cd9d36eafff7f2c4b6b153c8c6d579471df1ce045") ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f0000000dc0)={0x7, 'wg1\x00', {0x3e75}, 0x7}) write$binfmt_script(r1, &(0x7f0000000e00)={'#! ', '.', [{0x20, 'eth'}, {0x20, '..'}], 0xa, "84b065"}, 0xf) getsockopt$inet_sctp_SCTP_EXPOSE_POTENTIALLY_FAILED_STATE(r1, 0x84, 0x83, &(0x7f0000000e40)={0x0, 0x2}, &(0x7f0000000e80)=0x8) getsockopt$inet_sctp6_SCTP_ECN_SUPPORTED(r1, 0x84, 0x82, &(0x7f0000000ec0)={r9, 0x7}, &(0x7f0000000f00)=0x8) r10 = fcntl$dupfd(r5, 0x0, r0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r10, 0x84, 0x75, &(0x7f0000000f40)={r9, 0x8}, &(0x7f0000000f80)=0x8) ioctl$TIOCCBRK(r10, 0x5428) recvfrom$inet_nvme(r10, &(0x7f0000000fc0)=""/177, 0xb1, 0x40010000, &(0x7f0000001080)=@x25={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}}, 0x80) sendmsg$MPTCP_PM_CMD_GET_ADDR(r6, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x74, 0x0, 0x300, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}]}, 0x74}, 0x1, 0x0, 0x0, 0x80}, 0x80) socket$nl_xfrm(0x10, 0x3, 0x6) 138.612837ms ago: executing program 4 (id=387): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000680)=0xc, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @link_local}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d1}, 0x4084) ioctl$TUNSETOFFLOAD(r3, 0x400454c9, 0xba98575a95aeb70d) write(r3, &(0x7f00000003c0)="e04a7e1923f6c88ae95d5337b18b2d7966ab57537bb791899b19", 0x1a) ioctl$TUNSETLINK(r3, 0x400454cd, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x180) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001500010300000000000000010a"], 0x14}}, 0x0) recvmsg(r6, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x10002) write(r6, &(0x7f0000000540)="69add3a9172f87c5ef7d6263f8ba525e057cb76137d518d2ebe6e18ac989d13056f0b437db62e6a707caac628d81a239b1b460be1e618d88b0e0d7c28cdb602a71971a1c19c9a900"/84, 0xffffff5e) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x30, 0x1410, 0x20, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x2400c0d0) write(r7, &(0x7f0000000300)='1', 0x1) 0s ago: executing program 5 (id=388): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000001040)='./dev\x00', &(0x7f0000001080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000001100)=@filename='./dev/sda1\x00', &(0x7f0000001140)='./mnt\x00', &(0x7f0000001180)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000011c0)='./mnt/fillfile\x00', 0x42, 0x1ff) write$9p(r0, &(0x7f0000000380)="2369ee774e2f9eb35f84bcf781b84f56de53723ec19c5f435ea4f9ffffff00000000000000", 0x25) kernel console output (not intermixed with test programs): an1: encryption failed: -22 [ 378.411345][ T6116] Dev loop5: unable to read RDB block 7 [ 378.411384][ T6116] loop5: unable to read partition table [ 378.411546][ T6116] loop5: partition table beyond EOD, truncated [ 378.415347][ T6116] loop_reread_partitions: partition scan of loop5 (Äë¥ÖÛ¬£bñ2úævÒ i…L@U)óËÿ{õÁA§¥¥MÈS¾b•qÇ ¤â<ŸÀÛÖ1ðä83) failed (rc=-5) [ 378.430718][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430774][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 378.430790][ C0] I/O error, dev loop5, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430814][ C0] Buffer I/O error on dev loop5, logical block 1, async page read [ 378.430824][ C0] I/O error, dev loop5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430848][ C0] Buffer I/O error on dev loop5, logical block 2, async page read [ 378.430858][ C0] I/O error, dev loop5, sector 3 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430883][ C0] Buffer I/O error on dev loop5, logical block 3, async page read [ 378.430892][ C0] I/O error, dev loop5, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430917][ C0] Buffer I/O error on dev loop5, logical block 4, async page read [ 378.430927][ C0] I/O error, dev loop5, sector 5 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430951][ C0] Buffer I/O error on dev loop5, logical block 5, async page read [ 378.430960][ C0] I/O error, dev loop5, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.430984][ C0] Buffer I/O error on dev loop5, logical block 6, async page read [ 378.431175][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.431202][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 378.431212][ C0] I/O error, dev loop5, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.431280][ C0] Buffer I/O error on dev loop5, logical block 1, async page read [ 378.431292][ C0] I/O error, dev loop5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 378.431317][ C0] Buffer I/O error on dev loop5, logical block 2, async page read [ 378.432930][ T5191] ldm_validate_partition_table(): Disk read failed. [ 378.434106][ T5191] Dev loop5: unable to read RDB block 0 [ 378.436859][ T5191] loop5: unable to read partition table [ 378.436953][ T5191] loop5: partition table beyond EOD, truncated [ 378.470251][ T6120] ipt_REJECT: ECHOREPLY no longer supported. [ 378.515524][ T6006] usb 7-1: new low-speed USB device number 5 using dummy_hcd [ 378.535630][ T6006] usb 7-1: Invalid ep0 maxpacket: 64 [ 378.535830][ T6006] usb usb7-port1: unable to enumerate USB device [ 378.849783][ T6140] capability: warning: `syz.1.38' uses 32-bit capabilities (legacy support in use) [ 378.944090][ T6145] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 378.987318][ T6148] netlink: 'syz.1.42': attribute type 17 has an invalid length. [ 379.115698][ T5845] Bluetooth: hci2: command tx timeout [ 379.115730][ T5845] Bluetooth: hci0: command tx timeout [ 379.115750][ T5845] Bluetooth: hci3: command tx timeout [ 379.115770][ T5845] Bluetooth: hci1: command tx timeout [ 379.159350][ T6154] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3360270339 (6720540678 ns) > initial count (994822890 ns). Using initial count to start timer. [ 379.162740][ T6156] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3360270339 (6720540678 ns) > initial count (994822890 ns). Using initial count to start timer. [ 379.504917][ T6162] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 379.505070][ T6162] block device autoloading is deprecated and will be removed. [ 379.566960][ T6162] FAULT_INJECTION: forcing a failure. [ 379.566960][ T6162] name failslab, interval 1, probability 0, space 0, times 1 [ 379.566988][ T6162] CPU: 2 UID: 0 PID: 6162 Comm: syz.1.44 Not tainted syzkaller #0 PREEMPT(full) [ 379.567001][ T6162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 379.567008][ T6162] Call Trace: [ 379.567013][ T6162] [ 379.567018][ T6162] dump_stack_lvl+0x100/0x190 [ 379.567072][ T6162] should_fail_ex.cold+0x5/0xa [ 379.567092][ T6162] should_failslab+0xc2/0x120 [ 379.567107][ T6162] __kmalloc_cache_noprof+0x91/0x6d0 [ 379.567122][ T6162] ? sget_fc+0x117/0x1f60 [ 379.567140][ T6162] ? sget_fc+0x1ba/0x1f60 [ 379.567160][ T6162] sget_fc+0x1ba/0x1f60 [ 379.567197][ T6162] ? __pfx_set_anon_super_fc+0x10/0x10 [ 379.567218][ T6162] ? __pfx_sget_fc+0x10/0x10 [ 379.567236][ T6162] ? refcount_dec_not_one+0x136/0x1b0 [ 379.567251][ T6162] ? __pfx_refcount_dec_not_one+0x10/0x10 [ 379.567265][ T6162] ? __kasan_kmalloc+0xaa/0xb0 [ 379.567284][ T6162] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 379.567300][ T6162] ? __kasan_kmalloc+0xaa/0xb0 [ 379.567322][ T6162] ? __pfx_mqueue_fill_super+0x10/0x10 [ 379.567335][ T6162] get_tree_nodev+0x28/0x190 [ 379.567347][ T6162] mqueue_get_tree+0xf1/0x130 [ 379.567360][ T6162] vfs_get_tree+0x92/0x320 [ 379.567376][ T6162] fc_mount_longterm+0x1a/0x270 [ 379.567390][ T6162] mq_init_ns+0x482/0x820 [ 379.567407][ T6162] copy_ipcs+0x3d8/0x7e0 [ 379.567424][ T6162] create_new_namespaces+0x20a/0xac0 [ 379.567441][ T6162] ? security_capable+0x80/0x260 [ 379.567458][ T6162] unshare_nsproxy_namespaces+0xf6/0x210 [ 379.567478][ T6162] ksys_unshare+0x44f/0x980 [ 379.567493][ T6162] ? __pfx_ksys_unshare+0x10/0x10 [ 379.567515][ T6162] __x64_sys_unshare+0x31/0x40 [ 379.567530][ T6162] do_syscall_64+0x123/0x790 [ 379.567558][ T6162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.567572][ T6162] RIP: 0033:0x7f6e5e99f559 [ 379.567582][ T6162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.567594][ T6162] RSP: 002b:00007f6e5f905028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 379.567614][ T6162] RAX: ffffffffffffffda RBX: 00007f6e5ec25fa0 RCX: 00007f6e5e99f559 [ 379.567622][ T6162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 379.567630][ T6162] RBP: 00007f6e5ea36b20 R08: 0000000000000000 R09: 0000000000000000 [ 379.567637][ T6162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 379.567644][ T6162] R13: 00007f6e5ec26038 R14: 00007f6e5ec25fa0 R15: 00007ffc77dc5158 [ 379.567660][ T6162] [ 379.868563][ T6169] xt_l2tp: v2 doesn't support IP mode [ 380.449823][ T6173] netlink: 4 bytes leftover after parsing attributes in process `syz.2.48'. [ 380.712684][ T6188] netlink: 28 bytes leftover after parsing attributes in process `syz.2.52'. [ 380.719252][ T6188] netlink: 'syz.2.52': attribute type 34 has an invalid length. [ 380.719269][ T6188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.52'. [ 380.757712][ T34] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 380.808696][ T6191] raw_sendmsg: syz.2.53 forgot to set AF_INET. Fix it! [ 380.905500][ T34] usb 6-1: Using ep0 maxpacket: 16 [ 380.907007][ T34] usb 6-1: New USB device found: idVendor=046d, idProduct=c53a, bcdDevice=0.00 [ 380.908017][ T34] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 380.908052][ T34] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 380.908074][ T34] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 380.908093][ T34] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 380.908114][ T34] usb 6-1: config 0 interface 0 has no altsetting 0 [ 380.908141][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.911059][ T34] usb 6-1: config 0 descriptor?? [ 381.196058][ T5856] Bluetooth: hci1: command tx timeout [ 381.205346][ T5856] Bluetooth: hci3: command tx timeout [ 381.205373][ T5856] Bluetooth: hci2: command tx timeout [ 381.359825][ T34] logitech-djreceiver 0003:046D:C53A.0002: hiddev0,hidraw1: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.1-1/input0 [ 382.540243][ T34] usb 6-1: reset high-speed USB device number 2 using dummy_hcd [ 382.555496][ T6229] netlink: 36 bytes leftover after parsing attributes in process `syz.2.61'. [ 382.927246][ T6246] netlink: 'syz.0.67': attribute type 4 has an invalid length. [ 383.181174][ T42] kauditd_printk_skb: 86 callbacks suppressed [ 383.181926][ T42] audit: type=1400 audit(1793289611.926:352): avc: denied { write } for pid=6248 comm="syz.0.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 383.181958][ T42] audit: type=1400 audit(1793289611.926:353): avc: denied { ioctl } for pid=6248 comm="syz.0.68" path="socket:[12413]" dev="sockfs" ino=12413 ioctlcmd=0x8921 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 383.196042][ T42] audit: type=1400 audit(1793289611.946:354): avc: denied { ioctl } for pid=6248 comm="syz.0.68" path="socket:[11725]" dev="sockfs" ino=11725 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 383.198997][ T42] audit: type=1400 audit(1793289611.946:355): avc: denied { ioctl } for pid=6248 comm="syz.0.68" path="/dev/video7" dev="devtmpfs" ino=971 ioctlcmd=0xc0d05605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 383.200587][ T42] audit: type=1400 audit(1793289611.946:356): avc: denied { create } for pid=6248 comm="syz.0.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 383.201611][ T42] audit: type=1400 audit(1793289611.946:357): avc: denied { write } for pid=6248 comm="syz.0.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 383.532054][ T42] audit: type=1400 audit(1793289612.276:358): avc: denied { create } for pid=6258 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 383.538119][ T6259] Bluetooth: MGMT ver 1.23 [ 383.541325][ T42] audit: type=1400 audit(1793289612.286:359): avc: denied { ioctl } for pid=6258 comm="syz.2.70" path="socket:[12416]" dev="sockfs" ino=12416 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 383.542355][ T42] audit: type=1400 audit(1793289612.286:360): avc: denied { bind } for pid=6258 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 383.545006][ T6259] vxcan0: tx drop: invalid da for name 0x0000000400000003 [ 383.545087][ T42] audit: type=1400 audit(1793289612.286:361): avc: denied { write } for pid=6258 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 383.686987][ T6272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.73'. [ 384.085313][ T34] usb 6-1: device descriptor read/64, error -71 [ 384.115260][ T5929] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 384.278612][ T5929] usb 7-1: New USB device found: idVendor=06cd, idProduct=0107, bcdDevice=1b.3e [ 384.279722][ T5929] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.279761][ T5929] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 384.279784][ T5929] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 384.279803][ T5929] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 384.279824][ T5929] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 384.279864][ T5929] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 384.279885][ T5929] usb 7-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 384.281866][ T5929] usb 7-1: New USB device strings: Mfr=234, Product=28, SerialNumber=3 [ 384.281885][ T5929] usb 7-1: Product: syz [ 384.281896][ T5929] usb 7-1: Manufacturer: syz [ 384.281907][ T5929] usb 7-1: SerialNumber: syz [ 384.284543][ T6287] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 384.284695][ T6287] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 384.284778][ T6287] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 384.286879][ T5929] keyspan 7-1:1.0: Keyspan 1 port adapter converter detected [ 384.287330][ T5929] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 84 [ 384.289202][ T5929] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 82 [ 384.289291][ T5929] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 384.293183][ T5929] usb 7-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 384.327705][ T34] usb 6-1: reset high-speed USB device number 2 using dummy_hcd [ 384.328315][ T34] usb 6-1: device reset changed ep0 maxpacket size! [ 384.333661][ T5789] usb 6-1: USB disconnect, device number 2 [ 384.485300][ T5789] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 384.611862][ T5929] usb 7-1: USB disconnect, device number 6 [ 384.621159][ T5929] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 384.621709][ T5929] keyspan 7-1:1.0: device disconnected [ 384.655572][ T5789] usb 6-1: New USB device found: idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 384.656521][ T5789] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 384.656536][ T5789] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 384.656548][ T5789] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 384.658909][ T5789] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.658922][ T5789] usb 6-1: Product: syz [ 384.658930][ T5789] usb 6-1: Manufacturer: syz [ 384.658937][ T5789] usb 6-1: SerialNumber: syz [ 384.661962][ T5789] usb 6-1: config 0 descriptor?? [ 384.872001][ T5789] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 385.135581][ T6302] fuse-io-uring is disabled by module parameter [ 385.166633][ T6306] netlink: 'syz.2.82': attribute type 1 has an invalid length. [ 385.193965][ T6306] bond2: (slave veth0_to_bond): making interface the new active one [ 385.198533][ T6306] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 385.208419][ T6306] macvlan2: entered promiscuous mode [ 385.208437][ T6306] macvlan2: entered allmulticast mode [ 385.209216][ T6306] bond2: entered promiscuous mode [ 385.209229][ T6306] veth0_to_bond: entered promiscuous mode [ 385.211115][ T6306] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 385.220209][ T6306] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 385.234040][ T6306] bond2: left promiscuous mode [ 385.234054][ T6306] veth0_to_bond: left promiscuous mode [ 385.255267][ T6313] netlink: 'syz.2.82': attribute type 1 has an invalid length. [ 385.262704][ T6316] macvlan2: entered promiscuous mode [ 385.262718][ T6316] macvlan2: entered allmulticast mode [ 385.263134][ T6316] bond2: entered promiscuous mode [ 385.263143][ T6316] veth0_to_bond: entered promiscuous mode [ 385.264015][ T6316] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 385.268808][ T6316] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 385.273087][ T6316] bond2: left promiscuous mode [ 385.273098][ T6316] veth0_to_bond: left promiscuous mode [ 385.337074][ T5852] rxe_eth0 speed is unknown, defaulting to 1000 [ 385.561752][ T6342] capability: warning: `syz.0.84' uses deprecated v2 capabilities in a way that may be insecure [ 386.785750][ T3414] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 386.832989][ T34] usb 6-1: USB disconnect, device number 3 [ 386.911719][ T6368] Bluetooth: MGMT ver 1.23 [ 386.911928][ T6368] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 386.911938][ T6368] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 386.915747][ T6374] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 386.915758][ T6374] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 386.946441][ T3414] usb 5-1: not running at top speed; connect to a high speed hub [ 386.946470][ T3414] usb 5-1: New USB device found: idVendor=0ea0, idProduct=6858, bcdDevice=0.40 [ 386.947255][ T3414] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 40613, setting to 64 [ 386.948746][ T3414] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.948759][ T3414] usb 5-1: Product: syz [ 386.948767][ T3414] usb 5-1: Manufacturer: syz [ 386.948774][ T3414] usb 5-1: SerialNumber: syz [ 386.952880][ T6362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 386.968573][ T6376] bond1: entered allmulticast mode [ 386.968950][ T6376] 8021q: adding VLAN 0 to HW filter on device bond1 [ 386.982690][ T3414] oti6858 5-1:1.0: oti6858 converter detected [ 386.988574][ T3414] usb 5-1: oti6858 converter now attached to ttyUSB0 [ 387.039298][ T6378] ip6gretap1: entered allmulticast mode [ 387.039873][ T6378] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 387.043116][ T6376] netlink: 14 bytes leftover after parsing attributes in process `syz.1.94'. [ 387.054628][ T6376] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 387.059278][ T6376] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 387.060892][ T6376] bond0 (unregistering): Released all slaves [ 387.075796][ T5894] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 387.195372][ T5942] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 387.389532][ T3414] usb 5-1: USB disconnect, device number 2 [ 387.402228][ T3414] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 387.402849][ T3414] oti6858 5-1:1.0: device disconnected [ 387.691294][ T6405] Bluetooth: hci0: unsupported parameter 5135 [ 387.691314][ T6405] Bluetooth: hci0: invalid length 3, exp 2 for type 18 [ 387.693730][ T6405] usb 1-1: USB disconnect, device number 2 [ 387.936963][ T6412] mmap: syz.0.104 (6412) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 388.535573][ T42] kauditd_printk_skb: 71 callbacks suppressed [ 388.535594][ T42] audit: type=1400 audit(1793289617.276:433): avc: denied { map } for pid=6435 comm="syz.2.112" path="socket:[12072]" dev="sockfs" ino=12072 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 388.536703][ T42] audit: type=1400 audit(1793289617.286:434): avc: denied { read } for pid=6435 comm="syz.2.112" name="autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 388.537009][ T42] audit: type=1400 audit(1793289617.286:435): avc: denied { open } for pid=6435 comm="syz.2.112" path="/dev/autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 388.537463][ T42] audit: type=1400 audit(1793289617.286:436): avc: denied { ioctl } for pid=6435 comm="syz.2.112" path="/dev/autofs" dev="devtmpfs" ino=104 ioctlcmd=0xc0189374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 388.593937][ T6442] mmap: syz.1.113 (6442): VmData 37462016 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 388.649886][ T42] audit: type=1400 audit(1793289617.396:437): avc: denied { remount } for pid=6443 comm="syz.1.115" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 389.143839][ T42] audit: type=1400 audit(1793289617.886:438): avc: denied { unmount } for pid=5842 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 389.392010][ T42] audit: type=1400 audit(1793289618.136:439): avc: denied { read } for pid=6463 comm="syz.1.119" name="hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 389.392061][ T42] audit: type=1400 audit(1793289618.136:440): avc: denied { open } for pid=6463 comm="syz.1.119" path="/dev/hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 389.394695][ T42] audit: type=1400 audit(1793289618.136:441): avc: denied { read } for pid=6463 comm="syz.1.119" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 389.394766][ T42] audit: type=1400 audit(1793289618.136:442): avc: denied { open } for pid=6463 comm="syz.1.119" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 389.447886][ T6466] vim2m vim2m.0: vidioc_s_fmt queue busy [ 389.448193][ T6466] netlink: 'syz.1.120': attribute type 1 has an invalid length. [ 389.488683][ T6471] dlm: no local IP address has been set [ 389.488695][ T6471] dlm: cannot start dlm midcomms -107 [ 389.489923][ T6471] jffs2: notice: (6471) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 389.512674][ T6466] netlink: 11 bytes leftover after parsing attributes in process `syz.1.120'. [ 389.513808][ T6466] netlink: 28 bytes leftover after parsing attributes in process `syz.1.120'. [ 389.594991][ T6479] netlink: 12 bytes leftover after parsing attributes in process `syz.2.122'. [ 389.706915][ T6490] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 389.721478][ T6491] ipt_REJECT: TCP_RESET invalid for non-tcp [ 389.759511][ T6491] bridge_slave_0: left allmulticast mode [ 389.759536][ T6491] bridge_slave_0: left promiscuous mode [ 389.759871][ T6491] bridge0: port 1(bridge_slave_0) entered disabled state [ 389.768390][ T6491] bridge_slave_1: left allmulticast mode [ 389.768412][ T6491] bridge_slave_1: left promiscuous mode [ 389.768586][ T6491] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.783084][ T6491] bond0: (slave bond_slave_0): Releasing backup interface [ 389.797073][ T6491] bond0: (slave bond_slave_1): Releasing backup interface [ 389.809651][ T6491] team0: Port device team_slave_0 removed [ 389.813638][ T6491] team0: Port device team_slave_1 removed [ 389.814352][ T6491] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 389.814369][ T6491] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 389.817338][ T6491] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 389.817354][ T6491] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 389.822292][ T6491] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 389.853138][ T6498] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6498 comm=syz.2.129 [ 389.855653][ T5816] IPVS: starting estimator thread 0... [ 389.943093][ T6505] bond0: option ad_select: unable to set because the bond device is up [ 389.945590][ T6499] IPVS: using max 21 ests per chain, 50400 per kthread [ 390.402262][ T6522] ftl_cs: FTL header not found. [ 390.447568][ T6522] block2mtd: mtd1: [/dev/zram0] erase_size = 0KiB [65] [ 390.546752][ T6532] FAULT_INJECTION: forcing a failure. [ 390.546752][ T6532] name failslab, interval 1, probability 0, space 0, times 0 [ 390.546771][ T6532] CPU: 3 UID: 0 PID: 6532 Comm: syz.0.140 Not tainted syzkaller #0 PREEMPT(full) [ 390.546785][ T6532] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 390.546795][ T6532] Call Trace: [ 390.546799][ T6532] [ 390.546804][ T6532] dump_stack_lvl+0x100/0x190 [ 390.546837][ T6532] should_fail_ex.cold+0x5/0xa [ 390.546855][ T6532] should_failslab+0xc2/0x120 [ 390.546872][ T6532] __kmalloc_noprof+0xfc/0x840 [ 390.546890][ T6532] ? __register_sysctl_table+0xac/0x1650 [ 390.546914][ T6532] __register_sysctl_table+0xac/0x1650 [ 390.546933][ T6532] ? trace_kmalloc+0xeb/0x110 [ 390.546944][ T6532] ? __kasan_kmalloc+0xaa/0xb0 [ 390.546963][ T6532] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 390.546982][ T6532] ? __pfx___register_sysctl_table+0x10/0x10 [ 390.547000][ T6532] ? register_pidns_sysctls+0x48/0x1c0 [ 390.547016][ T6532] ? __asan_memcpy+0x3c/0x60 [ 390.547033][ T6532] register_pidns_sysctls+0x11d/0x1c0 [ 390.547045][ T6532] ? __ns_common_init+0x30f/0x550 [ 390.547064][ T6532] copy_pid_ns+0x67b/0x10a0 [ 390.547078][ T6532] ? __pfx_copy_pid_ns+0x10/0x10 [ 390.547091][ T6532] ? rcu_is_watching+0x13/0xc0 [ 390.547104][ T6532] ? __pfx_copy_mnt_ns+0x10/0x10 [ 390.547125][ T6532] ? create_new_namespaces+0x30/0xac0 [ 390.547144][ T6532] create_new_namespaces+0x2aa/0xac0 [ 390.547163][ T6532] unshare_nsproxy_namespaces+0xf6/0x210 [ 390.547181][ T6532] ksys_unshare+0x44f/0x980 [ 390.547197][ T6532] ? __pfx_ksys_unshare+0x10/0x10 [ 390.547218][ T6532] __x64_sys_unshare+0x31/0x40 [ 390.547233][ T6532] do_syscall_64+0x123/0x790 [ 390.547250][ T6532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.547264][ T6532] RIP: 0033:0x7f4332f9f559 [ 390.547274][ T6532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.547285][ T6532] RSP: 002b:00007f4333ee0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 390.547298][ T6532] RAX: ffffffffffffffda RBX: 00007f4333225fa0 RCX: 00007f4332f9f559 [ 390.547306][ T6532] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200 [ 390.547313][ T6532] RBP: 00007f4333036b20 R08: 0000000000000000 R09: 0000000000000000 [ 390.547321][ T6532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 390.547328][ T6532] R13: 00007f4333226038 R14: 00007f4333225fa0 R15: 00007ffe9441faa8 [ 390.547344][ T6532] [ 391.316608][ T6566] netlink: 'syz.1.150': attribute type 1 has an invalid length. [ 391.329198][ T6566] 8021q: adding VLAN 0 to HW filter on device bond0 [ 391.354851][ T6566] bond0: (slave veth3): Enslaving as an active interface with a down link [ 391.372227][ T6566] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 391.430870][ T6575] PKCS7: Unknown OID: [4] 5.25.43183(bad) [ 391.430881][ T6575] PKCS7: Only support pkcs7_signedData type [ 391.433997][ T6575] kvm: user requested TSC rate below hardware speed [ 391.657551][ T6590] netlink: 48 bytes leftover after parsing attributes in process `syz.2.157'. [ 391.683094][ T6590] ip_tables: iptables: counters copy to user failed while replacing table [ 391.694920][ T6590] syz.2.157 uses obsolete (PF_INET,SOCK_PACKET) [ 391.805224][ T5929] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 391.834599][ T6602] syz.2.159 (6602) used greatest stack depth: 18504 bytes left [ 391.878911][ T6604] ip_tables: iptables: counters copy to user failed while replacing table [ 391.967278][ T5929] usb 6-1: New USB device found: idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 391.968136][ T5929] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 391.968159][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.968173][ T5929] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.968186][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.968199][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.972847][ T5929] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 391.972871][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.972885][ T5929] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.972897][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.972910][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.973734][ T5929] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 391.973755][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.973769][ T5929] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.973781][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.973794][ T5929] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.991834][ T5929] usb 6-1: string descriptor 0 read error: -22 [ 391.991896][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.053562][ T5929] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 392.145038][ T6621] i2c i2c-0: new_device: Can't parse I2C address qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 392.468953][ T6645] netlink: 8 bytes leftover after parsing attributes in process `syz.0.172'. [ 392.468974][ T6645] netlink: 24 bytes leftover after parsing attributes in process `syz.0.172'. [ 392.543050][ T6647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.171'. [ 393.554571][ T42] kauditd_printk_skb: 33 callbacks suppressed [ 393.554585][ T42] audit: type=1400 audit(1793289622.296:476): avc: denied { read append } for pid=6662 comm="syz.2.177" name="mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 393.554712][ T42] audit: type=1400 audit(1793289622.296:477): avc: denied { open } for pid=6662 comm="syz.2.177" path="/dev/input/mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 393.573751][ T42] audit: type=1400 audit(1793289622.316:478): avc: denied { ioctl } for pid=6662 comm="syz.2.177" path="/dev/input/mice" dev="devtmpfs" ino=938 ioctlcmd=0xc0086420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 393.574935][ T42] audit: type=1400 audit(1793289622.316:479): avc: denied { write } for pid=6662 comm="syz.2.177" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 393.933653][ T42] audit: type=1400 audit(1793289622.676:480): avc: denied { execute } for pid=6691 comm="syz-executor" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 393.934176][ T42] audit: type=1400 audit(1793289622.676:481): avc: denied { execute_no_trans } for pid=6691 comm="syz-executor" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 394.005905][ T5856] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 394.008765][ T5856] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 394.010540][ T5856] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 394.010936][ T5856] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 394.011197][ T5856] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 394.031529][ T42] audit: type=1400 audit(1793289622.776:482): avc: denied { write } for pid=6694 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 394.031647][ T6702] tmpfs: Bad value for 'mpol' [ 394.050303][ T6702] FAULT_INJECTION: forcing a failure. [ 394.050303][ T6702] name failslab, interval 1, probability 0, space 0, times 0 [ 394.050330][ T6702] CPU: 1 UID: 0 PID: 6702 Comm: syz.2.184 Not tainted syzkaller #0 PREEMPT(full) [ 394.050354][ T6702] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 394.050365][ T6702] Call Trace: [ 394.050373][ T6702] [ 394.050381][ T6702] dump_stack_lvl+0x100/0x190 [ 394.050431][ T6702] should_fail_ex.cold+0x5/0xa [ 394.050468][ T6702] should_failslab+0xc2/0x120 [ 394.050496][ T6702] __kmalloc_cache_noprof+0x91/0x6d0 [ 394.050522][ T6702] ? pty_common_install+0xdf/0xb30 [ 394.050569][ T6702] pty_common_install+0xdf/0xb30 [ 394.050602][ T6702] ? __pfx_pty_unix98_install+0x10/0x10 [ 394.050632][ T6702] tty_init_dev.part.0+0x9e/0x470 [ 394.050657][ T6702] tty_init_dev+0x60/0x80 [ 394.050677][ T6702] ? __pfx_ptmx_open+0x10/0x10 [ 394.050722][ T6702] ptmx_open+0x128/0x360 [ 394.050750][ T6702] ? __pfx_ptmx_open+0x10/0x10 [ 394.050777][ T6702] chrdev_open+0x234/0x6a0 [ 394.050801][ T6702] ? __pfx_chrdev_open+0x10/0x10 [ 394.050825][ T6702] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 394.050860][ T6702] do_dentry_open+0x674/0x1470 [ 394.050880][ T6702] ? __pfx_chrdev_open+0x10/0x10 [ 394.050907][ T6702] vfs_open_consume+0xcc/0x460 [ 394.050937][ T6702] path_openat+0x1547/0x23f0 [ 394.050964][ T6702] ? __pfx_path_openat+0x10/0x10 [ 394.050996][ T6702] do_file_open+0x20e/0x430 [ 394.051022][ T6702] ? __pfx_do_file_open+0x10/0x10 [ 394.051066][ T6702] ? _raw_spin_unlock+0x28/0x50 [ 394.051101][ T6702] ? alloc_fd+0x471/0x7a0 [ 394.051135][ T6702] do_sys_openat2+0x163/0x1d0 [ 394.051161][ T6702] ? __pfx_do_sys_openat2+0x10/0x10 [ 394.051195][ T6702] __x64_sys_openat+0x12d/0x210 [ 394.051221][ T6702] ? __pfx___x64_sys_openat+0x10/0x10 [ 394.051258][ T6702] do_syscall_64+0x123/0x790 [ 394.051281][ T6702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.051303][ T6702] RIP: 0033:0x7f7d3239f559 [ 394.051320][ T6702] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.051338][ T6702] RSP: 002b:00007f7d331d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 394.051357][ T6702] RAX: ffffffffffffffda RBX: 00007f7d32625fa0 RCX: 00007f7d3239f559 [ 394.051390][ T6702] RDX: 0000000000121301 RSI: 0000200000000440 RDI: ffffffffffffff9c [ 394.051402][ T6702] RBP: 00007f7d32436b20 R08: 0000000000000000 R09: 0000000000000000 [ 394.051414][ T6702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 394.051425][ T6702] R13: 00007f7d32626038 R14: 00007f7d32625fa0 R15: 00007ffee7573c38 [ 394.051460][ T6702] [ 394.053851][ T6702] netlink: 24 bytes leftover after parsing attributes in process `syz.2.184'. [ 394.102178][ T42] audit: type=1400 audit(1793289622.846:483): avc: denied { write } for pid=6706 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 394.105631][ T6710] rxe_eth0 speed is unknown, defaulting to 1000 [ 394.201432][ T42] audit: type=1400 audit(1793289622.946:484): avc: denied { write } for pid=6719 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 394.249382][ T42] audit: type=1400 audit(1793289622.996:485): avc: denied { write } for pid=6723 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 394.265192][ T6698] rxe_eth0 speed is unknown, defaulting to 1000 [ 394.477671][ T855] usb 6-1: USB disconnect, device number 4 [ 394.740977][ T6698] bridge0: port 1(bridge_slave_0) entered blocking state [ 394.741064][ T6698] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.741123][ T6698] bridge_slave_0: entered allmulticast mode [ 394.741897][ T6698] bridge_slave_0: entered promiscuous mode [ 394.743655][ T6698] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.743723][ T6698] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.743781][ T6698] bridge_slave_1: entered allmulticast mode [ 394.744488][ T6698] bridge_slave_1: entered promiscuous mode [ 394.759440][ T6698] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.760930][ T6698] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.773364][ T6698] team0: Port device team_slave_0 added [ 394.774596][ T6698] team0: Port device team_slave_1 added [ 394.786882][ T6698] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 394.786893][ T6698] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.786907][ T6698] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 394.787762][ T6698] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 394.787769][ T6698] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.787783][ T6698] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 394.824114][ T6698] hsr_slave_0: entered promiscuous mode [ 394.824587][ T6698] hsr_slave_1: entered promiscuous mode [ 394.824929][ T6698] debugfs: 'hsr0' already exists in 'hsr' [ 394.824941][ T6698] Cannot create hsr debugfs directory [ 394.853157][ T5894] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 394.924384][ T6757] loop7: detected capacity change from 0 to 7 [ 394.928156][ C3] blk_print_req_error: 131 callbacks suppressed [ 394.928168][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.928213][ C3] buffer_io_error: 130 callbacks suppressed [ 394.928220][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.928701][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.928734][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930320][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930358][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930425][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930453][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930514][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930544][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930599][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930626][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930697][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930725][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930743][ T6757] ldm_validate_partition_table(): Disk read failed. [ 394.930783][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930809][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930867][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930894][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.930954][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 394.930981][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 394.931073][ T6757] Dev loop7: unable to read RDB block 0 [ 394.931473][ T6757] loop7: unable to read partition table [ 394.931569][ T6757] loop7: partition table beyond EOD, truncated [ 394.932479][ T6757] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 394.991629][ T5894] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.010327][ T6767] program syz.0.195 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 395.013165][ T6698] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 395.018344][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 395.018791][ T6698] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 395.021779][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 395.022628][ T6698] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 395.024618][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 395.028124][ T6698] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 395.034161][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 395.048859][ T5894] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.078869][ T6698] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.078916][ T6698] bridge0: port 2(bridge_slave_1) entered forwarding state [ 395.079024][ T6698] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.079071][ T6698] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.108961][ T6698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.121017][ T5894] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.134980][ T6698] 8021q: adding VLAN 0 to HW filter on device team0 [ 395.137676][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.138121][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.149951][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.150047][ T5864] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.158281][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.158340][ T5864] bridge0: port 2(bridge_slave_1) entered forwarding state [ 395.218423][ T6799] nbd: socks must be embedded in a SOCK_ITEM attr [ 395.219102][ T6799] block nbd0: shutting down sockets [ 395.290474][ T6806] netlink: 8 bytes leftover after parsing attributes in process `syz.2.203'. [ 395.294755][ T5894] bridge_slave_1: left allmulticast mode [ 395.294782][ T5894] bridge_slave_1: left promiscuous mode [ 395.295477][ T5894] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.313321][ T5894] bridge_slave_0: left allmulticast mode [ 395.313345][ T5894] bridge_slave_0: left promiscuous mode [ 395.313535][ T5894] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.373873][ T6812] CUSE: unknown device info "" [ 395.373887][ T6812] CUSE: unknown device info "" [ 395.373893][ T6812] CUSE: unknown device info "ÿ" [ 395.373899][ T6812] CUSE: unknown device info "" [ 395.373904][ T6812] CUSE: unknown device info "ý" [ 395.373910][ T6812] CUSE: unknown device info "" [ 395.373916][ T6812] CUSE: unknown device info "" [ 395.373922][ T6812] CUSE: DEVNAME unspecified [ 395.410346][ T6820] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6820 comm=syz.2.203 [ 395.426712][ T5789] hid (null): unknown global tag 0xd5 [ 395.426763][ T5789] hid (null): invalid report_size -662770737 [ 395.428527][ T5789] hid (null): report_id 43525 is invalid [ 395.428545][ T5789] hid (null): invalid report_count 52625 [ 395.428576][ T5789] hid (null): unknown global tag 0xc [ 395.428619][ T5789] hid (null): unknown global tag 0xd [ 395.428643][ T5789] hid (null): invalid report_size 23509 [ 395.430092][ T5789] hid (null): unknown global tag 0xd [ 395.430108][ T5789] hid (null): report_id 16640 is invalid [ 395.430142][ T5789] hid (null): invalid report_size 55787 [ 395.430155][ T5789] hid (null): unknown global tag 0xe [ 395.430178][ T5789] hid (null): unknown global tag 0xd [ 395.430221][ T5789] hid (null): unknown global tag 0xd [ 395.430241][ T5789] hid (null): unknown global tag 0xc [ 395.430253][ T5789] hid (null): unknown global tag 0x40 [ 395.430277][ T5789] hid (null): bogus close delimiter [ 395.430295][ T5789] hid (null): unknown global tag 0xd [ 395.430336][ T5789] hid (null): unknown global tag 0xd [ 395.430376][ T5789] hid (null): invalid report_count 48294 [ 395.430390][ T5789] hid (null): unknown global tag 0x60 [ 395.430426][ T5789] hid (null): unknown global tag 0xe [ 395.430437][ T5789] hid (null): unknown global tag 0xc [ 395.430483][ T5789] hid (null): bogus close delimiter [ 395.430499][ T5789] hid (null): unknown global tag 0xd [ 395.430527][ T5789] hid (null): invalid report_size 60122 [ 395.430540][ T5789] hid (null): unknown global tag 0xc [ 395.430589][ T5789] hid (null): unknown global tag 0xe9 [ 395.430607][ T5789] hid (null): unknown global tag 0xc [ 395.430653][ T5789] hid (null): global environment stack underflow [ 395.430682][ T5789] hid (null): global environment stack underflow [ 395.430700][ T5789] hid (null): global environment stack underflow [ 395.430711][ T5789] hid (null): global environment stack underflow [ 395.431198][ T5789] hid (null): unknown global tag 0xce [ 395.431232][ T5789] hid (null): unknown global tag 0xe [ 395.431262][ T5789] hid (null): invalid report_size 1701606249 [ 395.431281][ T5789] hid (null): global environment stack underflow [ 395.432172][ T5789] hid (null): unknown global tag 0x2c [ 395.432188][ T5789] hid (null): unknown global tag 0xd [ 395.432206][ T5789] hid (null): unknown global tag 0xe [ 395.433128][ T5789] hid (null): global environment stack underflow [ 395.433143][ T5789] hid (null): unknown global tag 0xd [ 395.433172][ T5789] hid (null): unknown global tag 0x11 [ 395.433186][ T5789] hid (null): unknown global tag 0xc [ 395.433241][ T5789] hid (null): unknown global tag 0xe [ 395.433266][ T5789] hid (null): unknown global tag 0xc [ 395.433302][ T5789] hid (null): invalid report_size -836046467 [ 395.433320][ T5789] hid (null): report_id 0 is invalid [ 395.453087][ T6823] unchecked MSR access error: WRMSR to 0x404 (tried to write 0x0000000000000003) at rIP: 0xffffffff81b4aeba (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 395.453175][ T6823] Call Trace: [ 395.453181][ T6823] [ 395.453190][ T6823] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 395.453223][ T6823] ? native_send_call_func_ipi+0xcb/0x1b0 [ 395.453251][ T6823] mce_cpu_restart+0xd5/0x1f0 [ 395.453275][ T6823] ? __pfx_mce_cpu_restart+0x10/0x10 [ 395.453302][ T6823] ? set_bank+0x240/0x3a0 [ 395.453324][ T6823] smp_call_function_many_cond+0x1449/0x18c0 [ 395.453364][ T6823] ? __pfx_mce_cpu_restart+0x10/0x10 [ 395.453394][ T6823] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 395.453429][ T6823] ? __timer_delete_sync+0x10f/0x1c0 [ 395.453465][ T6823] set_bank+0x240/0x3a0 [ 395.453489][ T6823] ? __pfx_set_bank+0x10/0x10 [ 395.453514][ T6823] ? find_held_lock+0x2b/0x80 [ 395.453530][ T6823] ? sysfs_file_kobj+0xe4/0x290 [ 395.453561][ T6823] ? sysfs_file_kobj+0xe4/0x290 [ 395.453586][ T6823] ? __pfx_set_bank+0x10/0x10 [ 395.453609][ T6823] dev_attr_store+0x58/0x80 [ 395.453649][ T6823] ? __pfx_dev_attr_store+0x10/0x10 [ 395.453675][ T6823] sysfs_kf_write+0xf2/0x150 [ 395.453699][ T6823] kernfs_fop_write_iter+0x3e0/0x5f0 [ 395.453721][ T6823] ? __pfx_sysfs_kf_write+0x10/0x10 [ 395.453747][ T6823] vfs_write+0x6af/0x1050 [ 395.453769][ T6823] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 395.453793][ T6823] ? __pfx_vfs_write+0x10/0x10 [ 395.453815][ T6823] ? find_held_lock+0x2b/0x80 [ 395.453869][ T6823] ksys_write+0x12a/0x250 [ 395.453885][ T6823] ? __pfx_ksys_write+0x10/0x10 [ 395.453911][ T6823] do_syscall_64+0x123/0x790 [ 395.453950][ T6823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.453972][ T6823] RIP: 0033:0x7f4332f9f559 [ 395.453989][ T6823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.454007][ T6823] RSP: 002b:00007f4333ee0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 395.454037][ T6823] RAX: ffffffffffffffda RBX: 00007f4333225fa0 RCX: 00007f4332f9f559 [ 395.454050][ T6823] RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000008 [ 395.454061][ T6823] RBP: 00007f4333036b20 R08: 0000000000000000 R09: 0000000000000000 [ 395.454071][ T6823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 395.454084][ T6823] R13: 00007f4333226038 R14: 00007f4333225fa0 R15: 00007ffe9441faa8 [ 395.454112][ T6823] [ 395.465811][ T5789] hid-generic 0009:0005:000F.0003: unknown main item tag 0x3 [ 395.465848][ T5789] hid-generic 0009:0005:000F.0003: unknown main item tag 0x7 [ 395.465861][ T5789] hid-generic 0009:0005:000F.0003: unexpected long global item [ 395.466368][ T5789] hid-generic 0009:0005:000F.0003: probe with driver hid-generic failed with error -22 [ 395.491523][ T6823] CIFS: VFS: UNC: path must begin with // or \\ [ 395.491533][ T6823] Malformed UNC in devname [ 395.491533][ T6823] [ 395.491577][ T6823] CIFS: VFS: Malformed UNC in devname [ 395.602935][ T5894] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 395.641875][ T5894] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 395.649655][ T5894] bond0 (unregistering): Released all slaves [ 395.666317][ T5494] 8021q: adding VLAN 0 to HW filter on device eth2 [ 395.843638][ T5958] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 395.866548][ T5958] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 395.892371][ T6843] netlink: 8 bytes leftover after parsing attributes in process `syz.1.209'. [ 395.927612][ T6698] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 395.933043][ T5494] 8021q: adding VLAN 0 to HW filter on device eth3 [ 395.981577][ T6852] 0x000000000000-0x000000010000 : "" [ 395.997750][ T6852] ftl_cs: FTL header not found. [ 396.017824][ T6852] FAULT_INJECTION: forcing a failure. [ 396.017824][ T6852] name failslab, interval 1, probability 0, space 0, times 0 [ 396.017854][ T6852] CPU: 2 UID: 0 PID: 6852 Comm: syz.1.210 Not tainted syzkaller #0 PREEMPT(full) [ 396.017878][ T6852] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 396.017891][ T6852] Call Trace: [ 396.017904][ T6852] [ 396.017912][ T6852] dump_stack_lvl+0x100/0x190 [ 396.017973][ T6852] should_fail_ex.cold+0x5/0xa [ 396.018005][ T6852] should_failslab+0xc2/0x120 [ 396.018025][ T6852] kmem_cache_alloc_noprof+0x92/0x6a0 [ 396.018058][ T6852] ? __kernfs_new_node+0xd2/0xa10 [ 396.018091][ T6852] __kernfs_new_node+0xd2/0xa10 [ 396.018125][ T6852] ? __pfx___kernfs_new_node+0x10/0x10 [ 396.018155][ T6852] ? lock_acquire+0x1d1/0x380 [ 396.018180][ T6852] ? kernfs_root+0x23/0x2a0 [ 396.018204][ T6852] ? find_held_lock+0x2b/0x80 [ 396.018221][ T6852] ? kernfs_root+0xee/0x2a0 [ 396.018244][ T6852] ? kernfs_root+0xee/0x2a0 [ 396.018274][ T6852] kernfs_new_node+0x194/0x200 [ 396.018303][ T6852] ? __pfx_kernfs_new_node+0x10/0x10 [ 396.018333][ T6852] ? kernfs_add_one+0x213/0xb40 [ 396.018365][ T6852] __kernfs_create_file+0x53/0x350 [ 396.018389][ T6852] sysfs_add_file_mode_ns+0x207/0x3c0 [ 396.018417][ T6852] internal_create_group+0x593/0xfb0 [ 396.018447][ T6852] ? kernfs_create_dir_ns+0x16d/0x2b0 [ 396.018465][ T6852] ? __pfx_internal_create_group+0x10/0x10 [ 396.018491][ T6852] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 396.018514][ T6852] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 396.018537][ T6852] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 396.018562][ T6852] internal_create_groups+0x9d/0x150 [ 396.018589][ T6852] kobject_add_internal+0x317/0x930 [ 396.018619][ T6852] kobject_add+0x16a/0x1e0 [ 396.018642][ T6852] ? __pfx_kobject_add+0x10/0x10 [ 396.018667][ T6852] ? __pfx_kobject_add+0x10/0x10 [ 396.018696][ T6852] blk_register_queue+0x8d/0x640 [ 396.018729][ T6852] __add_disk+0x7dd/0xf10 [ 396.018758][ T6852] add_disk_fwnode+0x118/0x480 [ 396.018785][ T6852] add_mtd_blktrans_dev+0xd0b/0x1520 [ 396.018813][ T6852] ? __pfx_add_mtd_blktrans_dev+0x10/0x10 [ 396.018851][ T6852] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 396.018880][ T6852] ? mtdblock_add_mtd+0x4a/0x270 [ 396.018916][ T6852] mtdblock_add_mtd+0x1cc/0x270 [ 396.018940][ T6852] blktrans_notify_add+0xa2/0xf0 [ 396.018963][ T6852] add_mtd_device+0xb6d/0x1820 [ 396.019000][ T6852] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 396.019022][ T6852] ? __pfx_add_mtd_device+0x10/0x10 [ 396.019059][ T6852] mtd_add_partition+0x376/0x6a0 [ 396.019083][ T6852] ? __pfx_mtd_add_partition+0x10/0x10 [ 396.019101][ T6852] ? __might_fault+0xc5/0x140 [ 396.019121][ T6852] ? __might_fault+0xc5/0x140 [ 396.019152][ T6852] mtdchar_blkpg_ioctl+0x207/0x250 [ 396.019172][ T6852] ? __pfx_mtdchar_blkpg_ioctl+0x10/0x10 [ 396.019216][ T6852] mtdchar_ioctl+0x1670/0x1fd0 [ 396.019240][ T6852] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 396.019263][ T6852] ? lock_acquire+0x1d1/0x380 [ 396.019288][ T6852] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 396.019332][ T6852] ? rcu_is_watching+0x13/0xc0 [ 396.019355][ T6852] ? trace_contention_end+0x126/0x160 [ 396.019387][ T6852] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 396.019410][ T6852] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 396.019439][ T6852] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 396.019476][ T6852] ? __pfx___mutex_lock+0x10/0x10 [ 396.019496][ T6852] ? __fget_files+0x34/0x3d0 [ 396.019536][ T6852] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 396.019557][ T6852] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 396.019582][ T6852] __x64_sys_ioctl+0x18e/0x210 [ 396.019614][ T6852] do_syscall_64+0x123/0x790 [ 396.019637][ T6852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.019657][ T6852] RIP: 0033:0x7f6e5e99f559 [ 396.019674][ T6852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.019693][ T6852] RSP: 002b:00007f6e5f905028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 396.019713][ T6852] RAX: ffffffffffffffda RBX: 00007f6e5ec25fa0 RCX: 00007f6e5e99f559 [ 396.019725][ T6852] RDX: 0000200000000240 RSI: 0000000000001269 RDI: 0000000000000004 [ 396.019737][ T6852] RBP: 00007f6e5ea36b20 R08: 0000000000000000 R09: 0000000000000000 [ 396.019750][ T6852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 396.019761][ T6852] R13: 00007f6e5ec26038 R14: 00007f6e5ec25fa0 R15: 00007ffc77dc5158 [ 396.019836][ T6852] [ 396.026637][ T6852] kobject: kobject_add_internal failed for queue (error: -12 parent: mtdblock2) [ 396.085854][ T5141] Bluetooth: hci4: command tx timeout [ 396.134127][ T34] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 396.213518][ T6698] veth0_vlan: entered promiscuous mode [ 396.219728][ T6698] veth1_vlan: entered promiscuous mode [ 396.241629][ T6698] veth0_macvtap: entered promiscuous mode [ 396.243675][ T6698] veth1_macvtap: entered promiscuous mode [ 396.256408][ T6698] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 396.263777][ T6698] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 396.274808][ T5494] 8021q: adding VLAN 0 to HW filter on device eth4 [ 396.321879][ T5942] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.322283][ T5942] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.323299][ T5942] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.323906][ T5942] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.363308][ T5894] hsr_slave_0: left promiscuous mode [ 396.364195][ T5894] hsr_slave_1: left promiscuous mode [ 396.368119][ T5894] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 396.368158][ T5894] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 396.378251][ T5894] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 396.378272][ T5894] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 396.392442][ T5894] veth1_macvtap: left promiscuous mode [ 396.392488][ T5894] veth0_macvtap: left promiscuous mode [ 396.392603][ T5894] veth1_vlan: left promiscuous mode [ 396.392674][ T5894] veth0_vlan: left promiscuous mode [ 396.477620][ T5929] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 396.591737][ T5894] team0 (unregistering): Port device team_slave_1 removed [ 396.607246][ T5894] team0 (unregistering): Port device team_slave_0 removed [ 396.635960][ T5929] usb 6-1: Using ep0 maxpacket: 8 [ 396.639131][ T5929] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 396.640072][ T5929] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 396.640111][ T5929] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 396.640130][ T5929] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 396.640151][ T5929] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12320, setting to 1024 [ 396.640172][ T5929] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 396.640193][ T5929] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 396.640226][ T5929] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.641437][ T5958] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 396.717965][ T5494] 8021q: adding VLAN 0 to HW filter on device eth5 [ 396.749489][ T5816] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.749510][ T5816] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.804185][ T1175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.804205][ T1175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.858236][ T5929] usb 6-1: usb_control_msg returned -71 [ 396.858279][ T5929] usbtmc 6-1:16.0: can't read capabilities [ 396.888095][ T5929] usb 6-1: USB disconnect, device number 5 [ 396.994313][ T6885] ip_tables: iptables: counters copy to user failed while replacing table [ 397.596456][ T5958] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 397.888815][ T6908] program syz.1.218 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 398.155263][ T5141] Bluetooth: hci4: command tx timeout [ 398.206421][ T6914] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 398.273074][ T6918] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6918 comm=syz.1.224 [ 398.303267][ T6924] netlink: 116 bytes leftover after parsing attributes in process `syz.1.225'. [ 398.367626][ T6931] jffs2: notice: (6931) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 398.386648][ T6931] FAULT_INJECTION: forcing a failure. [ 398.386648][ T6931] name failslab, interval 1, probability 0, space 0, times 0 [ 398.386675][ T6931] CPU: 2 UID: 0 PID: 6931 Comm: syz.1.227 Not tainted syzkaller #0 PREEMPT(full) [ 398.386699][ T6931] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 398.386711][ T6931] Call Trace: [ 398.386718][ T6931] [ 398.386727][ T6931] dump_stack_lvl+0x100/0x190 [ 398.386782][ T6931] should_fail_ex.cold+0x5/0xa [ 398.386825][ T6931] should_failslab+0xc2/0x120 [ 398.386845][ T6931] __kvmalloc_node_noprof+0x113/0x9b0 [ 398.386875][ T6931] ? stack_trace_save+0x8e/0xc0 [ 398.386900][ T6931] ? v4l2_ctrl_new+0x4a6/0x23a0 [ 398.386934][ T6931] v4l2_ctrl_new+0x4a6/0x23a0 [ 398.386964][ T6931] ? entry_SYSCALL_64_after_hwframe+0x47/0x7f [ 398.386989][ T6931] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 398.387028][ T6931] v4l2_ctrl_new_std+0x1bb/0x290 [ 398.387063][ T6931] ? __pfx_v4l2_ctrl_new_std+0x10/0x10 [ 398.387089][ T6931] ? rcu_is_watching+0x13/0xc0 [ 398.387118][ T6931] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 398.387157][ T6931] ? media_request_object_init+0x105/0x180 [ 398.387188][ T6931] vicodec_open+0x1b2/0xf70 [ 398.387217][ T6931] ? kobject_get_unless_zero+0x156/0x200 [ 398.387250][ T6931] v4l2_open+0x1d2/0x490 [ 398.387276][ T6931] ? __pfx_v4l2_open+0x10/0x10 [ 398.387301][ T6931] chrdev_open+0x234/0x6a0 [ 398.387327][ T6931] ? __pfx_chrdev_open+0x10/0x10 [ 398.387353][ T6931] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 398.387389][ T6931] do_dentry_open+0x674/0x1470 [ 398.387413][ T6931] ? __pfx_chrdev_open+0x10/0x10 [ 398.387441][ T6931] vfs_open_consume+0xcc/0x460 [ 398.387470][ T6931] path_openat+0x1547/0x23f0 [ 398.387498][ T6931] ? __pfx_path_openat+0x10/0x10 [ 398.387529][ T6931] do_file_open+0x20e/0x430 [ 398.387557][ T6931] ? __pfx_do_file_open+0x10/0x10 [ 398.387601][ T6931] ? _raw_spin_unlock+0x28/0x50 [ 398.387630][ T6931] ? alloc_fd+0x471/0x7a0 [ 398.387662][ T6931] do_sys_openat2+0x163/0x1d0 [ 398.387688][ T6931] ? __pfx_do_sys_openat2+0x10/0x10 [ 398.387713][ T6931] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 398.387752][ T6931] __x64_sys_openat+0x12d/0x210 [ 398.387804][ T6931] ? __pfx___x64_sys_openat+0x10/0x10 [ 398.387844][ T6931] do_syscall_64+0x123/0x790 [ 398.387867][ T6931] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.387889][ T6931] RIP: 0033:0x7f6e5e95fd8e [ 398.387906][ T6931] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 398.387924][ T6931] RSP: 002b:00007f6e5f904b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 398.387945][ T6931] RAX: ffffffffffffffda RBX: 00007f6e5f9056c0 RCX: 00007f6e5e95fd8e [ 398.387958][ T6931] RDX: 0000000000000002 RSI: 00007f6e5f904c00 RDI: ffffffffffffff9c [ 398.387971][ T6931] RBP: 00007f6e5f904c00 R08: 0000000000000000 R09: 0000000000000000 [ 398.387983][ T6931] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 398.387995][ T6931] R13: 00007f6e5ec26038 R14: 00007f6e5ec25fa0 R15: 00007ffc77dc5158 [ 398.388023][ T6931] [ 398.680404][ T6941] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 398.701355][ T6944] iommufd_mock iommufd_mock1: Adding to iommu group 11 [ 398.709616][ T42] kauditd_printk_skb: 44 callbacks suppressed [ 398.709628][ T42] audit: type=1400 audit(1793289627.456:530): avc: denied { accept } for pid=6940 comm="syz.4.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 398.741390][ T6834] ceph: No mds server is up or the cluster is laggy [ 399.550451][ T6942] warning: `syz.4.230' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 399.659262][ T6964] syzkaller1: entered promiscuous mode [ 399.659277][ T6964] syzkaller1: entered allmulticast mode [ 399.660511][ T42] audit: type=1400 audit(1793289628.406:531): avc: denied { read write } for pid=6963 comm="syz.4.236" name="rdma_cm" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 399.660733][ T42] audit: type=1400 audit(1793289628.406:532): avc: denied { open } for pid=6963 comm="syz.4.236" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 399.661267][ T6964] 9pnet_fd: p9_fd_create_tcp (6964): problem binding to privport [ 399.700550][ T6962] nvme_fabrics: unknown parameter or missing value 'ra' in ctrl creation request [ 399.737109][ T6964] ucma_write: process 30 (syz.4.236) changed security contexts after opening file descriptor, this is not allowed. [ 399.770317][ T42] audit: type=1400 audit(1793289628.516:533): avc: denied { read write } for pid=6968 comm="syz.2.237" name="nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 399.776226][ T42] audit: type=1400 audit(1793289628.526:534): avc: denied { open } for pid=6968 comm="syz.2.237" path="/dev/nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 399.783791][ T42] audit: type=1400 audit(1793289628.526:535): avc: denied { listen } for pid=6970 comm="syz.1.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 399.786903][ T42] audit: type=1400 audit(1793289628.526:536): avc: denied { read } for pid=6970 comm="syz.1.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 399.827288][ T42] audit: type=1400 audit(1793289628.576:537): avc: denied { write } for pid=6973 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 399.887233][ T42] audit: type=1400 audit(1793289628.636:538): avc: denied { write } for pid=6985 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 399.977567][ T42] audit: type=1400 audit(1793289628.726:539): avc: denied { write } for pid=6993 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 400.045207][ T3414] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 400.209775][ T3414] usb 6-1: unable to get BOS descriptor or descriptor too short [ 400.209804][ T3414] usb 6-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 400.211032][ T3414] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 400.211045][ T3414] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 400.213714][ T3414] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.213729][ T3414] usb 6-1: Product: syz [ 400.213737][ T3414] usb 6-1: Manufacturer: syz [ 400.213746][ T3414] usb 6-1: SerialNumber: syz [ 400.235910][ T5141] Bluetooth: hci4: command tx timeout [ 400.489024][ T7028] netlink: 6024 bytes leftover after parsing attributes in process `syz.2.246'. [ 400.528948][ T7030] Need at least one configuration in g1. [ 400.530664][ T7030] udc usbip-vudc.0: failed to start g1: -22 [ 400.530680][ T7030] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 400.531956][ T7030] UDC core: g1: couldn't find an available UDC or it's busy [ 400.536169][ T7030] netlink: 8 bytes leftover after parsing attributes in process `syz.2.247'. [ 400.631805][ T7033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.248'. [ 402.325274][ T5141] Bluetooth: hci4: command tx timeout [ 402.770581][ T3414] usb 6-1: USB disconnect, device number 6 [ 402.795634][ T5141] Bluetooth: hci1: command 0x0c1a tx timeout [ 402.797637][ T7036] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 402.925761][ T7055] fuse: Bad value for 'fd' [ 402.925983][ T7055] fuse: Bad value for 'fd' [ 402.926208][ T7055] fuse: Bad value for 'fd' [ 402.926438][ T7055] fuse: Bad value for 'fd' [ 402.926661][ T7055] fuse: Bad value for 'fd' [ 402.926866][ T7055] fuse: Bad value for 'fd' [ 402.927093][ T7055] fuse: Bad value for 'fd' [ 402.927294][ T7055] fuse: Bad value for 'fd' [ 402.927577][ T7055] fuse: Bad value for 'fd' [ 402.927933][ T7055] fuse: Bad value for 'fd' [ 402.928159][ T7055] fuse: Bad value for 'fd' [ 402.928362][ T7055] fuse: Bad value for 'fd' [ 402.929624][ T7055] fuse: Unknown parameter 'overlay' [ 402.929814][ T7055] fuse: Unknown parameter 'overlay' [ 402.930005][ T7055] fuse: Unknown parameter 'overlay' [ 402.930190][ T7055] fuse: Unknown parameter 'overlay' [ 402.930373][ T7055] fuse: Unknown parameter 'overlay' [ 402.930561][ T7055] fuse: Unknown parameter 'overlay' [ 402.930744][ T7055] fuse: Unknown parameter 'overlay' [ 402.930932][ T7055] fuse: Unknown parameter 'overlay' [ 402.931119][ T7055] fuse: Unknown parameter 'overlay' [ 402.931307][ T7055] fuse: Unknown parameter 'overlay' [ 402.931490][ T7055] fuse: Unknown parameter 'overlay' [ 402.931678][ T7055] fuse: Unknown parameter 'overlay' [ 402.931902][ T7055] fuse: Unknown parameter 'overlay' [ 402.932087][ T7055] fuse: Unknown parameter 'overlay' [ 402.932272][ T7055] fuse: Unknown parameter 'overlay' [ 402.932454][ T7055] fuse: Unknown parameter 'overlay' [ 402.932642][ T7055] fuse: Unknown parameter 'overlay' [ 402.932824][ T7055] fuse: Unknown parameter 'overlay' [ 402.933013][ T7055] fuse: Unknown parameter 'overlay' [ 402.933200][ T7055] fuse: Unknown parameter 'overlay' [ 402.933384][ T7055] fuse: Unknown parameter 'overlay' [ 402.933578][ T7055] fuse: Unknown parameter 'overlay' [ 402.933760][ T7055] fuse: Unknown parameter 'overlay' [ 402.933948][ T7055] fuse: Unknown parameter 'overlay' [ 402.934130][ T7055] fuse: Unknown parameter 'overlay' [ 402.934315][ T7055] fuse: Unknown parameter 'overlay' [ 402.934496][ T7055] fuse: Unknown parameter 'overlay' [ 402.934683][ T7055] fuse: Unknown parameter 'overlay' [ 402.934863][ T7055] fuse: Unknown parameter 'overlay' [ 402.935053][ T7055] fuse: Unknown parameter 'overlay' [ 402.935952][ T7055] fuse: Unknown parameter 'overlay' [ 402.936156][ T7055] fuse: Unknown parameter 'overlay' [ 402.936338][ T7055] fuse: Unknown parameter 'overlay' [ 402.936538][ T7055] fuse: Unknown parameter 'overlay' [ 402.936719][ T7055] fuse: Unknown parameter 'overlay' [ 402.936924][ T7055] fuse: Unknown parameter 'overlay' [ 402.937107][ T7055] fuse: Unknown parameter 'overlay' [ 402.937304][ T7055] fuse: Unknown parameter 'overlay' [ 402.937533][ T7055] fuse: Unknown parameter 'overlay' [ 402.937736][ T7055] fuse: Unknown parameter 'overlay' [ 402.937924][ T7055] fuse: Unknown parameter 'overlay' [ 402.938173][ T7055] fuse: Unknown parameter 'overlay' [ 402.938371][ T7055] fuse: Unknown parameter 'overlay' [ 402.938572][ T7055] fuse: Unknown parameter 'overlay' [ 402.938758][ T7055] fuse: Unknown parameter 'overlay' [ 402.938962][ T7055] fuse: Unknown parameter 'overlay' [ 402.939143][ T7055] fuse: Unknown parameter 'overlay' [ 402.939359][ T7055] fuse: Unknown parameter 'overlay' [ 402.939542][ T7055] fuse: Unknown parameter 'overlay' [ 402.939746][ T7055] fuse: Unknown parameter 'overlay' [ 403.676391][ T7036] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 403.689665][ T7036] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 403.695845][ T7036] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 403.695943][ T7036] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 403.701619][ T7036] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 403.702652][ T7036] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 403.702898][ T7036] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 403.705071][ T7036] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 403.745815][ T42] kauditd_printk_skb: 14 callbacks suppressed [ 403.745833][ T42] audit: type=1400 audit(1793289632.496:554): avc: denied { ioctl } for pid=7062 comm="syz.1.255" path="/dev/nvram" dev="devtmpfs" ino=631 ioctlcmd=0xc138fd05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 403.826848][ T42] audit: type=1400 audit(1793289632.576:555): avc: denied { read } for pid=5494 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 403.857966][ T42] audit: type=1400 audit(1793289632.606:556): avc: denied { accept } for pid=7068 comm="syz.4.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 403.939929][ T42] audit: type=1400 audit(1793289632.676:557): avc: denied { write } for pid=7081 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 404.015433][ T42] audit: type=1400 audit(1793289632.766:558): avc: denied { write } for pid=7090 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 404.090400][ T42] audit: type=1400 audit(1793289632.836:559): avc: denied { write } for pid=7092 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 404.160672][ T42] audit: type=1400 audit(1793289632.906:560): avc: denied { write } for pid=7098 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 404.238868][ T7102] ip_tables: iptables: counters copy to user failed while replacing table [ 404.778299][ T42] audit: type=1400 audit(1793289633.526:561): avc: denied { write } for pid=7106 comm="syz.2.265" name="rtc0" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 404.779989][ T42] audit: type=1400 audit(1793289633.526:562): avc: denied { ioctl } for pid=7106 comm="syz.2.265" path="/dev/rtc0" dev="devtmpfs" ino=943 ioctlcmd=0x7006 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 404.885906][ T5141] Bluetooth: hci1: command 0x0c1a tx timeout [ 405.107632][ T7112] i2c i2c-0: delete_device: Can't parse I2C address [ 405.111459][ T7112] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 405.156166][ T42] audit: type=1400 audit(1793289633.906:563): avc: denied { create } for pid=7113 comm="syz.1.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 405.261667][ T7120] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 405.261694][ T7120] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 405.261828][ T7120] overlayfs: failed to set uuid (98/file2, err=-13); falling back to uuid=null. [ 405.417894][ T7132] netlink: 4 bytes leftover after parsing attributes in process `syz.4.273'. [ 405.512919][ T7141] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 405.514172][ T7144] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 405.622535][ T7154] netlink: 20 bytes leftover after parsing attributes in process `syz.4.279'. [ 405.623962][ T7154] ipvlan1: entered allmulticast mode [ 405.623974][ T7154] veth0_vlan: entered allmulticast mode [ 405.765783][ T5141] Bluetooth: hci4: command 0x0c1a tx timeout [ 405.765817][ T5141] Bluetooth: hci3: command 0x0c1a tx timeout [ 405.846991][ T7167] FAULT_INJECTION: forcing a failure. [ 405.846991][ T7167] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 405.847018][ T7167] CPU: 3 UID: 0 PID: 7167 Comm: syz.2.283 Not tainted syzkaller #0 PREEMPT(full) [ 405.847038][ T7167] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 405.847049][ T7167] Call Trace: [ 405.847056][ T7167] [ 405.847063][ T7167] dump_stack_lvl+0x100/0x190 [ 405.847128][ T7167] should_fail_ex.cold+0x5/0xa [ 405.847156][ T7167] _copy_from_user+0x2e/0xd0 [ 405.847179][ T7167] __sys_bpf+0x2f5/0x4b60 [ 405.847214][ T7167] ? __pfx___sys_bpf+0x10/0x10 [ 405.847239][ T7167] ? find_held_lock+0x2b/0x80 [ 405.847257][ T7167] ? futex_wake+0x4ea/0x5e0 [ 405.847281][ T7167] ? futex_wake+0x4ea/0x5e0 [ 405.847318][ T7167] ? rcu_is_watching+0x13/0xc0 [ 405.847337][ T7167] ? trace_sched_exit_tp+0x120/0x160 [ 405.847366][ T7167] ? __schedule+0x1270/0x6990 [ 405.847420][ T7167] ? __x64_sys_futex+0x34f/0x4d0 [ 405.847440][ T7167] ? __x64_sys_futex+0x358/0x4d0 [ 405.847463][ T7167] ? xfd_validate_state+0x129/0x190 [ 405.847489][ T7167] ? __x64_sys_bpf+0xce/0x140 [ 405.847505][ T7167] __x64_sys_bpf+0xce/0x140 [ 405.847522][ T7167] ? do_syscall_64+0xae/0x790 [ 405.847541][ T7167] do_syscall_64+0x123/0x790 [ 405.847560][ T7167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.847579][ T7167] RIP: 0033:0x7f7d3239f559 [ 405.847594][ T7167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.847612][ T7167] RSP: 002b:00007f7d331d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.847639][ T7167] RAX: ffffffffffffffda RBX: 00007f7d32625fa0 RCX: 00007f7d3239f559 [ 405.847651][ T7167] RDX: 0000000000000048 RSI: 0000200000000300 RDI: 0000000000000000 [ 405.847662][ T7167] RBP: 00007f7d32436b20 R08: 0000000000000000 R09: 0000000000000000 [ 405.847673][ T7167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 405.847684][ T7167] R13: 00007f7d32626038 R14: 00007f7d32625fa0 R15: 00007ffee7573c38 [ 405.847709][ T7167] [ 406.334339][ T7176] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 406.821667][ T7178] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input7 [ 406.955404][ T5856] Bluetooth: hci1: command 0x0c1a tx timeout [ 406.957476][ T7205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.292'. [ 406.986677][ T7200] fuse: root generation should be zero [ 407.107814][ T7217] netlink: 8 bytes leftover after parsing attributes in process `syz.4.295'. [ 407.107837][ T7217] netlink: 8 bytes leftover after parsing attributes in process `syz.4.295'. [ 407.171992][ T7219] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 407.835700][ T5856] Bluetooth: hci4: command 0x0c1a tx timeout [ 407.846487][ T5856] Bluetooth: hci3: command 0x0c1a tx timeout [ 408.075383][ T7242] netlink: 24 bytes leftover after parsing attributes in process `syz.1.300'. [ 408.852320][ T7260] ip6t_srh: unknown srh invflags 51E8 [ 408.939113][ T42] kauditd_printk_skb: 29 callbacks suppressed [ 408.939127][ T42] audit: type=1400 audit(1793289637.686:593): avc: denied { mount } for pid=7265 comm="syz.4.304" name="/" dev="autofs" ino=17119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 409.011183][ T7270] nvme_fcloop: unknown parameter or missing value 'ww' [ 409.027290][ T42] audit: type=1400 audit(1793289637.776:594): avc: denied { append } for pid=7271 comm="syz.4.307" name="loop5" dev="devtmpfs" ino=661 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 409.029458][ C3] blk_print_req_error: 10 callbacks suppressed [ 409.029475][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 409.029788][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.029910][ C3] buffer_io_error: 10 callbacks suppressed [ 409.029923][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 409.030072][ C3] I/O error, dev loop5, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.030128][ C3] Buffer I/O error on dev loop5, logical block 1, async page read [ 409.030238][ C3] I/O error, dev loop5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.030288][ C3] Buffer I/O error on dev loop5, logical block 2, async page read [ 409.030388][ C3] I/O error, dev loop5, sector 3 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.030438][ C3] Buffer I/O error on dev loop5, logical block 3, async page read [ 409.030557][ C3] I/O error, dev loop5, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.030608][ C3] Buffer I/O error on dev loop5, logical block 4, async page read [ 409.030829][ C3] I/O error, dev loop5, sector 5 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.030940][ C3] Buffer I/O error on dev loop5, logical block 5, async page read [ 409.031022][ C3] I/O error, dev loop5, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.031077][ C3] Buffer I/O error on dev loop5, logical block 6, async page read [ 409.033649][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.033729][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 409.035302][ C3] I/O error, dev loop5, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 409.035427][ C3] Buffer I/O error on dev loop5, logical block 1, async page read [ 409.035502][ C3] Buffer I/O error on dev loop5, logical block 2, async page read [ 409.039838][ T5191] ldm_validate_partition_table(): Disk read failed. [ 409.043298][ T5191] Dev loop5: unable to read RDB block 0 [ 409.044644][ T5191] loop5: unable to read partition table [ 409.044754][ T5191] loop5: partition table beyond EOD, truncated [ 409.100170][ T42] audit: type=1400 audit(1793289637.846:595): avc: denied { write } for pid=7272 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 409.129890][ T42] audit: type=1400 audit(1793289637.876:596): avc: denied { create } for pid=7276 comm="syz.4.308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 409.130688][ T42] audit: type=1400 audit(1793289637.876:597): avc: denied { write } for pid=7276 comm="syz.4.308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 409.175375][ T42] audit: type=1400 audit(1793289637.926:598): avc: denied { write } for pid=7279 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 409.275257][ T5958] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 409.436050][ T5958] usb 6-1: New USB device found: idVendor=0b48, idProduct=1005, bcdDevice=1.00 [ 409.437268][ T5958] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.438792][ T5958] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 409.438819][ T5958] usb 6-1: Product: syz [ 409.438831][ T5958] usb 6-1: Manufacturer: syz [ 409.455008][ T5958] usb 6-1: selecting invalid altsetting 1 [ 409.456161][ T5958] dvb_ttusb_budget: ttusb_init_controller: error [ 409.456238][ T5958] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 409.506269][ T5958] DVB: Unable to find symbol cx22700_attach() [ 409.534661][ T5958] DVB: Unable to find symbol tda10046_attach() [ 409.534672][ T5958] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 409.648137][ T7270] dvb_ttusb_budget: failed urb submission (0: err = -2)! [ 409.654859][ T42] audit: type=1400 audit(1793289638.396:599): avc: denied { listen } for pid=7269 comm="syz.1.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 409.655152][ T42] audit: type=1400 audit(1793289638.396:600): avc: denied { shutdown } for pid=7269 comm="syz.1.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 409.760688][ T7311] dvb_ttusb_budget: failed urb submission (0: err = -2)! [ 409.763137][ T42] audit: type=1400 audit(1793289638.506:601): avc: denied { create } for pid=7269 comm="syz.1.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 409.763886][ T42] audit: type=1400 audit(1793289638.506:602): avc: denied { bind } for pid=7269 comm="syz.1.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 409.892694][ T7311] dvb_ttusb_budget: failed urb submission (0: err = -2)! [ 409.915274][ T5141] Bluetooth: hci4: command 0x0c1a tx timeout [ 409.915323][ T5856] Bluetooth: hci3: command 0x0c1a tx timeout [ 410.108127][ T7325] MINIX-fs: unable to read superblock [ 410.259109][ T7327] netlink: zone id is out of range [ 410.259261][ T7327] netlink: set zone limit has 8 unknown bytes [ 410.685216][ T41] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 410.845658][ T41] usb 9-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 410.847280][ T41] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 410.847304][ T41] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 410.847335][ T41] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.850232][ T7337] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 410.858379][ T41] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 411.053938][ T5958] usb 9-1: USB disconnect, device number 2 [ 411.516992][ T5141] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 411.518161][ T5141] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 411.521803][ T5141] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 411.522911][ T5141] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 411.523408][ T5141] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 411.737432][ T7340] rxe_eth0 speed is unknown, defaulting to 1000 [ 411.821860][ T5942] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.926696][ T5942] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.009437][ T5942] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.038786][ T41] usb 6-1: USB disconnect, device number 7 [ 412.041092][ T7340] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.041227][ T7340] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.041333][ T7340] bridge_slave_0: entered allmulticast mode [ 412.042690][ T7340] bridge_slave_0: entered promiscuous mode [ 412.045032][ T7340] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.045153][ T7340] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.045214][ T7340] bridge_slave_1: entered allmulticast mode [ 412.060036][ T7340] bridge_slave_1: entered promiscuous mode [ 412.124110][ T7359] gfs2: error -5 reading superblock [ 412.131343][ T5942] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.133904][ T7360] FAULT_INJECTION: forcing a failure. [ 412.133904][ T7360] name failslab, interval 1, probability 0, space 0, times 0 [ 412.133928][ T7360] CPU: 2 UID: 0 PID: 7360 Comm: syz.1.316 Not tainted syzkaller #0 PREEMPT(full) [ 412.133944][ T7360] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 412.133952][ T7360] Call Trace: [ 412.133957][ T7360] [ 412.133962][ T7360] dump_stack_lvl+0x100/0x190 [ 412.134009][ T7360] should_fail_ex.cold+0x5/0xa [ 412.134029][ T7360] should_failslab+0xc2/0x120 [ 412.134047][ T7360] __kvmalloc_node_noprof+0x113/0x9b0 [ 412.134067][ T7360] ? trace_kmem_cache_alloc+0xdd/0x100 [ 412.134079][ T7360] ? p9_fcall_init+0x227/0x420 [ 412.134101][ T7360] p9_fcall_init+0x227/0x420 [ 412.134115][ T7360] p9_tag_alloc+0x16c/0x860 [ 412.134130][ T7360] ? __pfx_p9_tag_alloc+0x10/0x10 [ 412.134144][ T7360] ? rcu_is_watching+0x13/0xc0 [ 412.134158][ T7360] ? trace_kmem_cache_alloc+0xdd/0x100 [ 412.134170][ T7360] ? __kasan_slab_alloc+0x89/0x90 [ 412.134184][ T7360] p9_client_prepare_req+0x19b/0x4d0 [ 412.134200][ T7360] ? __pfx_p9_client_prepare_req+0x10/0x10 [ 412.134217][ T7360] ? radix_tree_node_alloc.constprop.0+0x1bd/0x360 [ 412.134242][ T7360] p9_client_rpc+0x1c4/0xdc0 [ 412.134258][ T7360] ? __pfx_p9_client_rpc+0x10/0x10 [ 412.134272][ T7360] ? idr_alloc_u32+0x22b/0x320 [ 412.134287][ T7360] ? find_held_lock+0x2b/0x80 [ 412.134300][ T7360] ? find_held_lock+0x2b/0x80 [ 412.134312][ T7360] ? p9_fid_create+0x268/0x460 [ 412.134325][ T7360] ? rcu_is_watching+0x13/0xc0 [ 412.134341][ T7360] p9_client_attach+0x153/0x2b0 [ 412.134357][ T7360] ? __pfx_p9_client_attach+0x10/0x10 [ 412.134373][ T7360] ? __raw_spin_lock_init+0x3a/0x110 [ 412.134395][ T7360] v9fs_session_init+0x6ef/0xdd0 [ 412.134418][ T7360] v9fs_get_tree+0xb8/0xb50 [ 412.134430][ T7360] ? rcu_is_watching+0x13/0xc0 [ 412.134443][ T7360] ? __pfx_v9fs_get_tree+0x10/0x10 [ 412.134458][ T7360] ? bpf_lsm_capable+0x9/0x10 [ 412.134469][ T7360] ? security_capable+0x80/0x260 [ 412.134486][ T7360] vfs_get_tree+0x92/0x320 [ 412.134502][ T7360] path_mount+0x7d0/0x2850 [ 412.134523][ T7360] ? __pfx_path_mount+0x10/0x10 [ 412.134539][ T7360] ? lockdep_hardirqs_on+0x7d/0x110 [ 412.134560][ T7360] ? putname+0xb1/0x110 [ 412.134573][ T7360] ? kmem_cache_free+0x127/0x6c0 [ 412.134593][ T7360] ? __x64_sys_mount+0x293/0x310 [ 412.134609][ T7360] __x64_sys_mount+0x293/0x310 [ 412.134626][ T7360] ? __pfx___x64_sys_mount+0x10/0x10 [ 412.134647][ T7360] do_syscall_64+0x123/0x790 [ 412.134660][ T7360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.134673][ T7360] RIP: 0033:0x7f6e5e99f559 [ 412.134684][ T7360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.134696][ T7360] RSP: 002b:00007f6e5f905028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 412.134708][ T7360] RAX: ffffffffffffffda RBX: 00007f6e5ec25fa0 RCX: 00007f6e5e99f559 [ 412.134716][ T7360] RDX: 00002000000014c0 RSI: 0000200000001480 RDI: 0000000000000000 [ 412.134724][ T7360] RBP: 00007f6e5ea36b20 R08: 0000200000001500 R09: 0000000000000000 [ 412.134731][ T7360] R10: 0000000002204803 R11: 0000000000000246 R12: 0000000000000000 [ 412.134743][ T7360] R13: 00007f6e5ec26038 R14: 00007f6e5ec25fa0 R15: 00007ffc77dc5158 [ 412.134760][ T7360] [ 412.156447][ T7340] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 412.157731][ T5929] logitech-hidpp-device 0005:046D:B012.0004: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 412.161527][ T7340] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 412.174923][ T7340] team0: Port device team_slave_0 added [ 412.176897][ T7340] team0: Port device team_slave_1 added [ 412.198909][ T7340] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 412.198925][ T7340] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 412.198948][ T7340] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 412.207841][ T7340] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 412.207855][ T7340] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 412.207878][ T7340] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 412.226063][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.227888][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228126][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228277][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228412][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228556][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228701][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228828][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.228956][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.229084][ T7366] netlink: 'syz.4.318': attribute type 4 has an invalid length. [ 412.270321][ T7340] hsr_slave_0: entered promiscuous mode [ 412.270767][ T7340] hsr_slave_1: entered promiscuous mode [ 412.271070][ T7340] debugfs: 'hsr0' already exists in 'hsr' [ 412.271083][ T7340] Cannot create hsr debugfs directory [ 412.453268][ T5942] bond0 (unregistering): Released all slaves [ 412.457977][ T7372] syzkaller0: entered promiscuous mode [ 412.457990][ T7372] syzkaller0: entered allmulticast mode [ 412.569530][ T7380] gadgetfs: bound to dummy_udc driver [ 412.804976][ T7340] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 412.820812][ T7340] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 412.825925][ T7340] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 412.838596][ T7340] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 412.839377][ T7340] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 412.846876][ T7340] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 412.854466][ T7340] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 412.867303][ T7340] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 412.878982][ T5494] 8021q: adding VLAN 0 to HW filter on device eth6 [ 412.931990][ T7340] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.953036][ T7340] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.959618][ T1171] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.959688][ T1171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.969618][ T1171] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.969695][ T1171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.018796][ T5942] hsr_slave_0: left promiscuous mode [ 413.019539][ T5942] hsr_slave_1: left promiscuous mode [ 413.024244][ T5942] veth1_macvtap: left promiscuous mode [ 413.024275][ T5942] veth0_macvtap: left promiscuous mode [ 413.024458][ T5942] veth1_vlan: left promiscuous mode [ 413.024515][ T5942] veth0_vlan: left promiscuous mode [ 413.136161][ T7415] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(9) [ 413.208714][ T7416] device-mapper: ioctl: device has been removed from the dev hash table. [ 413.346873][ T7429] netlink: 16 bytes leftover after parsing attributes in process `syz.1.328'. [ 413.346896][ T7429] netlink: 16 bytes leftover after parsing attributes in process `syz.1.328'. [ 413.346907][ T7429] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Info Ack ret = -22) [ 413.347493][ T7429] netlink: 24 bytes leftover after parsing attributes in process `syz.1.328'. [ 413.381906][ T5494] 8021q: adding VLAN 0 to HW filter on device eth7 [ 413.571516][ T7441] netlink: 56 bytes leftover after parsing attributes in process `syz.1.329'. [ 413.595667][ T5141] Bluetooth: hci2: command tx timeout [ 413.627969][ T5494] 8021q: adding VLAN 0 to HW filter on device eth8 [ 413.663504][ T7448] kvm: user requested TSC rate below hardware speed [ 413.667688][ T7448] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 413.670231][ T7448] 9pnet_virtio: no channels available for device ./file0/file0 [ 413.682366][ T7448] bridge22: entered allmulticast mode [ 413.730846][ T7340] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.907566][ T5494] 8021q: adding VLAN 0 to HW filter on device eth9 [ 413.947544][ T7340] veth0_vlan: entered promiscuous mode [ 413.958532][ T7340] veth1_vlan: entered promiscuous mode [ 413.975688][ T7340] veth0_macvtap: entered promiscuous mode [ 413.980421][ T7340] veth1_macvtap: entered promiscuous mode [ 413.996924][ T7340] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.003397][ T7467] netlink: 8 bytes leftover after parsing attributes in process `syz.1.331'. [ 414.003411][ T7467] netlink: 4 bytes leftover after parsing attributes in process `syz.1.331'. [ 414.013188][ T7340] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.075617][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.075827][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.075999][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.076019][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.093504][ T5866] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.093521][ T5866] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.103285][ T5866] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.103297][ T5866] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.121982][ T42] kauditd_printk_skb: 21 callbacks suppressed [ 414.122001][ T42] audit: type=1400 audit(1793289642.866:624): avc: denied { write } for pid=7472 comm="syz.4.332" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 414.124681][ T7474] virtio-pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 414.211344][ T42] audit: type=1400 audit(1793289642.956:625): avc: denied { mount } for pid=7484 comm="syz.4.335" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 414.211400][ T42] audit: type=1400 audit(1793289642.956:626): avc: denied { mounton } for pid=7484 comm="syz.4.335" path="/57/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 414.228548][ T7485] input: syz1 as /devices/virtual/input/input9 [ 414.234758][ T7490] Cannot find set identified by id 4 to match [ 414.243259][ T42] audit: type=1400 audit(1793289642.986:627): avc: denied { watch watch_reads } for pid=7484 comm="syz.4.335" path="/57/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 414.245044][ T42] audit: type=1400 audit(1793289642.986:628): avc: denied { nlmsg_read } for pid=7488 comm="syz.1.336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 414.256244][ T7491] FAULT_INJECTION: forcing a failure. [ 414.256244][ T7491] name fail_futex, interval 1, probability 0, space 0, times 1 [ 414.256269][ T7491] CPU: 3 UID: 0 PID: 7491 Comm: syz.1.336 Not tainted syzkaller #0 PREEMPT(full) [ 414.256284][ T7491] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.256291][ T7491] Call Trace: [ 414.256296][ T7491] [ 414.256301][ T7491] dump_stack_lvl+0x100/0x190 [ 414.256353][ T7491] should_fail_ex.cold+0x5/0xa [ 414.256374][ T7491] get_futex_key+0x1c9/0x13e0 [ 414.256390][ T7491] ? __pfx_get_futex_key+0x10/0x10 [ 414.256401][ T7491] ? find_held_lock+0x2b/0x80 [ 414.256414][ T7491] ? get_pid_task+0xfc/0x250 [ 414.256425][ T7491] ? get_pid_task+0xfc/0x250 [ 414.256439][ T7491] futex_wake+0xf4/0x5e0 [ 414.256456][ T7491] ? find_held_lock+0x2b/0x80 [ 414.256468][ T7491] ? __pfx_futex_wake+0x10/0x10 [ 414.256486][ T7491] ? rcu_read_lock_any_held+0x6a/0x90 [ 414.256500][ T7491] ? find_held_lock+0x2b/0x80 [ 414.256513][ T7491] ? ksys_write+0x190/0x250 [ 414.256524][ T7491] ? ksys_write+0x190/0x250 [ 414.256535][ T7491] do_futex+0x2b2/0x440 [ 414.256550][ T7491] ? __pfx_do_futex+0x10/0x10 [ 414.256564][ T7491] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 414.256609][ T7491] __x64_sys_futex+0x34f/0x4d0 [ 414.256625][ T7491] ? fput+0x7c/0x100 [ 414.256640][ T7491] ? __pfx___x64_sys_futex+0x10/0x10 [ 414.256654][ T7491] ? ksys_write+0x1ac/0x250 [ 414.256664][ T7491] ? __pfx_ksys_write+0x10/0x10 [ 414.256680][ T7491] do_syscall_64+0x123/0x790 [ 414.256694][ T7491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.256707][ T7491] RIP: 0033:0x7f6e5e99f559 [ 414.256718][ T7491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.256730][ T7491] RSP: 002b:00007f6e5f9050e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 414.256748][ T7491] RAX: ffffffffffffffda RBX: 00007f6e5ec25fa8 RCX: 00007f6e5e99f559 [ 414.256756][ T7491] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6e5ec25fac [ 414.256765][ T7491] RBP: 00007f6e5ec25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 414.256774][ T7491] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 414.256782][ T7491] R13: 00007f6e5ec26038 R14: 00007ffc77dc5070 R15: 00007ffc77dc5158 [ 414.256799][ T7491] [ 414.257954][ T7486] futex_wake_op: syz.4.335 tries to shift op by 144; fix this program [ 414.258033][ T7486] futex_wake_op: syz.4.335 tries to shift op by 144; fix this program [ 414.294295][ T42] audit: type=1400 audit(1793289643.036:629): avc: denied { unmount } for pid=6698 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 414.356602][ T7499] FAULT_INJECTION: forcing a failure. [ 414.356602][ T7499] name failslab, interval 1, probability 0, space 0, times 0 [ 414.356630][ T7499] CPU: 1 UID: 0 PID: 7499 Comm: syz.4.340 Not tainted syzkaller #0 PREEMPT(full) [ 414.356652][ T7499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.356665][ T7499] Call Trace: [ 414.356672][ T7499] [ 414.356680][ T7499] dump_stack_lvl+0x100/0x190 [ 414.356720][ T7499] should_fail_ex.cold+0x5/0xa [ 414.356754][ T7499] should_failslab+0xc2/0x120 [ 414.356778][ T7499] kmem_cache_alloc_noprof+0x92/0x6a0 [ 414.356809][ T7499] ? security_file_alloc+0x34/0x2c0 [ 414.356840][ T7499] security_file_alloc+0x34/0x2c0 [ 414.356860][ T7499] init_file+0x95/0x480 [ 414.356885][ T7499] alloc_empty_file+0x79/0x1c0 [ 414.356913][ T7499] alloc_file_pseudo+0x17e/0x290 [ 414.356943][ T7499] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 414.356970][ T7499] ? alloc_fd+0x471/0x7a0 [ 414.357000][ T7499] sock_alloc_file+0x50/0x210 [ 414.357043][ T7499] __sys_socket+0x1c0/0x260 [ 414.357076][ T7499] ? __pfx___sys_socket+0x10/0x10 [ 414.357116][ T7499] __x64_sys_socket+0x72/0xb0 [ 414.357144][ T7499] ? lockdep_hardirqs_on+0x7d/0x110 [ 414.357178][ T7499] do_syscall_64+0x123/0x790 [ 414.357202][ T7499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.357225][ T7499] RIP: 0033:0x7f9f54d9f559 [ 414.357242][ T7499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.357260][ T7499] RSP: 002b:00007f9f55cee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 414.357281][ T7499] RAX: ffffffffffffffda RBX: 00007f9f55025fa0 RCX: 00007f9f54d9f559 [ 414.357297][ T7499] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000015 [ 414.357308][ T7499] RBP: 00007f9f54e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 414.357319][ T7499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 414.357331][ T7499] R13: 00007f9f55026038 R14: 00007f9f55025fa0 R15: 00007fff1e4a99e8 [ 414.357357][ T7499] [ 414.477965][ T42] audit: type=1400 audit(1793289643.226:630): avc: denied { map } for pid=7509 comm="syz.4.342" path="/61/proc/206/task/207/fail-nth" dev="proc" ino=19781 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 414.498984][ T7511] FAULT_INJECTION: forcing a failure. [ 414.498984][ T7511] name failslab, interval 1, probability 0, space 0, times 0 [ 414.499010][ T7511] CPU: 2 UID: 0 PID: 7511 Comm: syz.4.342 Not tainted syzkaller #0 PREEMPT(full) [ 414.499032][ T7511] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.499044][ T7511] Call Trace: [ 414.499050][ T7511] [ 414.499058][ T7511] dump_stack_lvl+0x100/0x190 [ 414.499094][ T7511] should_fail_ex.cold+0x5/0xa [ 414.499123][ T7511] should_failslab+0xc2/0x120 [ 414.499145][ T7511] __kmalloc_cache_noprof+0x91/0x6d0 [ 414.499171][ T7511] ? kvm_init_irq_routing+0x43/0xf0 [ 414.499197][ T7511] kvm_init_irq_routing+0x43/0xf0 [ 414.499218][ T7511] kvm_dev_ioctl+0x771/0x1ac0 [ 414.499265][ T7511] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 414.499294][ T7511] ? selinux_file_ioctl+0x1e0/0x290 [ 414.499324][ T7511] ? selinux_file_ioctl+0x1e7/0x290 [ 414.499354][ T7511] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 414.499381][ T7511] __x64_sys_ioctl+0x18e/0x210 [ 414.499417][ T7511] do_syscall_64+0x123/0x790 [ 414.499439][ T7511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.499460][ T7511] RIP: 0033:0x7f9f54d9f559 [ 414.499476][ T7511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.499494][ T7511] RSP: 002b:00007f9f55cee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 414.499514][ T7511] RAX: ffffffffffffffda RBX: 00007f9f55025fa0 RCX: 00007f9f54d9f559 [ 414.499527][ T7511] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 414.499538][ T7511] RBP: 00007f9f54e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 414.499550][ T7511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 414.499561][ T7511] R13: 00007f9f55026038 R14: 00007f9f55025fa0 R15: 00007fff1e4a99e8 [ 414.499588][ T7511] [ 414.575551][ T6871] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 414.607018][ T7517] netlink: 4 bytes leftover after parsing attributes in process `syz.4.343'. [ 414.613320][ T42] audit: type=1400 audit(1793289643.356:631): avc: denied { mount } for pid=7516 comm="syz.4.343" name="/" dev="overlay" ino=376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 414.725399][ T6871] usb 10-1: Using ep0 maxpacket: 32 [ 414.727676][ T6871] usb 10-1: unable to get BOS descriptor or descriptor too short [ 414.727722][ T6871] usb 10-1: New USB device found: idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 414.732721][ T6871] usb 10-1: string descriptor 0 read error: -22 [ 414.732779][ T6871] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.740893][ T6871] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 414.740914][ T6871] dw2102: su3000_power_ctrl: 1, initialized 0 [ 414.741156][ T6871] dvb-usb: bulk message failed: -22 (2/0) [ 414.751581][ T6871] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 414.752138][ T6871] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 414.752162][ T6871] usb 10-1: media controller created [ 414.752434][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752444][ T6871] dw2102: i2c transfer failed. [ 414.752459][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752468][ T6871] dw2102: i2c transfer failed. [ 414.752477][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752486][ T6871] dw2102: i2c transfer failed. [ 414.752494][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752504][ T6871] dw2102: i2c transfer failed. [ 414.752512][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752522][ T6871] dw2102: i2c transfer failed. [ 414.752530][ T6871] dvb-usb: bulk message failed: -22 (6/0) [ 414.752540][ T6871] dw2102: i2c transfer failed. [ 414.752546][ T6871] dvb-usb: MAC address: 02:02:02:02:02:02 [ 414.778966][ T6871] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 414.799600][ T6871] dvb-usb: bulk message failed: -22 (3/0) [ 414.799619][ T6871] dw2102: command 0x0e transfer failed. [ 414.799626][ T6871] dvb-usb: bulk message failed: -22 (3/0) [ 414.799638][ T6871] dw2102: command 0x0e transfer failed. [ 415.107194][ T6871] dvb-usb: bulk message failed: -22 (3/0) [ 415.107215][ T6871] dw2102: command 0x0e transfer failed. [ 415.107223][ T6871] dvb-usb: bulk message failed: -22 (3/0) [ 415.107233][ T6871] dw2102: command 0x0e transfer failed. [ 415.107239][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 415.107249][ T6871] dw2102: command 0x51 transfer failed. [ 415.112039][ T7497] dvb-usb: bulk message failed: -22 (7/0) [ 415.112059][ T7497] dw2102: i2c transfer failed. [ 415.132853][ T6871] DVB: Unable to find symbol ds3000_attach() [ 415.132867][ T6871] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 415.197050][ T6871] rc_core: IR keymap rc-su3000 not found [ 415.197071][ T6871] Registered IR keymap rc-empty [ 415.198535][ T6871] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0 [ 415.204357][ T6871] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0/input10 [ 415.229541][ T6871] dvb-usb: schedule remote query interval to 150 msecs. [ 415.229572][ T6871] dw2102: su3000_power_ctrl: 0, initialized 1 [ 415.229584][ T6871] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 415.387806][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 415.387821][ T6871] dw2102: i2c transfer failed. [ 415.545222][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 415.545243][ T5929] dw2102: i2c transfer failed. [ 415.681076][ T7528] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 415.685710][ T5141] Bluetooth: hci2: command tx timeout [ 415.705217][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 415.705239][ T5929] dw2102: i2c transfer failed. [ 415.865297][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 415.865317][ T5929] dw2102: i2c transfer failed. [ 415.930879][ T7532] IPv6: sit1: Disabled Multicast RS [ 415.931858][ T7532] sit1: entered allmulticast mode [ 416.026744][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 416.026765][ T5929] dw2102: i2c transfer failed. [ 416.185189][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 416.185203][ T6871] dw2102: i2c transfer failed. [ 416.345246][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 416.345266][ T6871] dw2102: i2c transfer failed. [ 416.515213][ T3414] dvb-usb: bulk message failed: -22 (1/0) [ 416.515229][ T3414] dw2102: i2c transfer failed. [ 416.685247][ T3414] dvb-usb: bulk message failed: -22 (1/0) [ 416.685268][ T3414] dw2102: i2c transfer failed. [ 416.845587][ T3414] dvb-usb: bulk message failed: -22 (1/0) [ 416.845606][ T3414] dw2102: i2c transfer failed. [ 417.016362][ T3414] dvb-usb: bulk message failed: -22 (1/0) [ 417.016378][ T3414] dw2102: i2c transfer failed. [ 417.175288][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 417.175302][ T6871] dw2102: i2c transfer failed. [ 417.346370][ T6871] dvb-usb: bulk message failed: -22 (1/0) [ 417.346388][ T6871] dw2102: i2c transfer failed. [ 417.376332][ T6871] usb 10-1: USB disconnect, device number 2 [ 417.448573][ T6871] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 417.577638][ T7542] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 417.755233][ T5141] Bluetooth: hci2: command tx timeout [ 418.005238][ T41] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 418.158191][ T41] usb 9-1: New USB device found: idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 418.162269][ T41] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.162291][ T41] usb 9-1: Product: syz [ 418.162304][ T41] usb 9-1: Manufacturer: syz [ 418.162317][ T41] usb 9-1: SerialNumber: syz [ 418.166724][ T41] usb 9-1: config 0 descriptor?? [ 418.643896][ T41] usb 9-1: USB disconnect, device number 3 [ 418.823648][ T42] audit: type=1400 audit(1793289647.566:632): avc: denied { setopt } for pid=7603 comm="syz.5.354" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 418.824099][ T42] audit: type=1400 audit(1793289647.566:633): avc: denied { append } for pid=7603 comm="syz.5.354" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 418.834662][ T7604] FAULT_INJECTION: forcing a failure. [ 418.834662][ T7604] name fail_futex, interval 1, probability 0, space 0, times 0 [ 418.834687][ T7604] CPU: 0 UID: 0 PID: 7604 Comm: syz.5.354 Not tainted syzkaller #0 PREEMPT(full) [ 418.834710][ T7604] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.834723][ T7604] Call Trace: [ 418.834730][ T7604] [ 418.834738][ T7604] dump_stack_lvl+0x100/0x190 [ 418.834815][ T7604] should_fail_ex.cold+0x5/0xa [ 418.834848][ T7604] get_futex_key+0x1c9/0x13e0 [ 418.834881][ T7604] ? __pfx_get_futex_key+0x10/0x10 [ 418.834904][ T7604] ? up_write+0x2dc/0x5b0 [ 418.834940][ T7604] futex_wake+0xf4/0x5e0 [ 418.834973][ T7604] ? __pfx_futex_wake+0x10/0x10 [ 418.835024][ T7604] ? vm_mmap_pgoff+0x101/0x490 [ 418.835058][ T7604] do_futex+0x2b2/0x440 [ 418.835084][ T7604] ? __pfx_do_futex+0x10/0x10 [ 418.835116][ T7604] __x64_sys_futex+0x34f/0x4d0 [ 418.835142][ T7604] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 418.835173][ T7604] ? __pfx___x64_sys_futex+0x10/0x10 [ 418.835208][ T7604] do_syscall_64+0x123/0x790 [ 418.835250][ T7604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.835273][ T7604] RIP: 0033:0x7f1de119f559 [ 418.835290][ T7604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.835311][ T7604] RSP: 002b:00007f1de20e10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 418.835342][ T7604] RAX: ffffffffffffffda RBX: 00007f1de1425fa8 RCX: 00007f1de119f559 [ 418.835357][ T7604] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1de1425fac [ 418.835369][ T7604] RBP: 00007f1de1425fa0 R08: 0000000000000001 R09: 0000000000000000 [ 418.835382][ T7604] R10: 0000200000ff6000 R11: 0000000000000246 R12: 0000000000000000 [ 418.835394][ T7604] R13: 00007f1de1426038 R14: 00007ffdff6dd420 R15: 00007ffdff6dd508 [ 418.835422][ T7604] [ 419.018765][ T7608] FAT-fs (nullb0): bogus number of reserved sectors [ 419.018781][ T7608] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 419.078949][ T7613] bridge_slave_0: left allmulticast mode [ 419.078968][ T7613] bridge_slave_0: left promiscuous mode [ 419.079064][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.081052][ T7613] bridge_slave_1: left allmulticast mode [ 419.081064][ T7613] bridge_slave_1: left promiscuous mode [ 419.081156][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.092866][ T7613] bond0: (slave bond_slave_0): Releasing backup interface [ 419.100647][ T7613] bond0: (slave bond_slave_1): Releasing backup interface [ 419.104165][ T7613] team0: Port device team_slave_0 removed [ 419.107273][ T7613] team0: Port device team_slave_1 removed [ 419.107711][ T7613] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 419.107727][ T7613] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.108858][ T7613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 419.108868][ T7613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.111232][ T7613] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 419.185862][ T7621] netlink: 68 bytes leftover after parsing attributes in process `syz.5.358'. [ 419.186140][ T7621] veth1: entered promiscuous mode [ 419.428376][ T42] audit: type=1400 audit(1793289648.176:634): avc: denied { sqpoll } for pid=7634 comm="syz.4.361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 419.465588][ T7635] validate_nla: 25 callbacks suppressed [ 419.465602][ T7635] netlink: 'syz.4.361': attribute type 2 has an invalid length. [ 419.484087][ T7635] atomic_op ffff8880596309e0 conn xmit_atomic 0000000000000000 [ 419.630820][ T7641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.362'. [ 419.630841][ T7641] netlink: 24 bytes leftover after parsing attributes in process `syz.4.362'. [ 419.781755][ T7645] syzkaller1: entered promiscuous mode [ 419.781777][ T7645] syzkaller1: entered allmulticast mode [ 419.836088][ T5141] Bluetooth: hci2: command tx timeout [ 419.850366][ T42] audit: type=1400 audit(1793289648.596:635): avc: denied { map } for pid=7644 comm="syz.4.363" path="socket:[19025]" dev="sockfs" ino=19025 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 419.851543][ T7647] netlink: 'syz.4.363': attribute type 1 has an invalid length. [ 419.856762][ T7646] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 420.079800][ T42] audit: type=1400 audit(1793289648.826:636): avc: denied { write } for pid=7648 comm="syz.5.364" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 420.083144][ T42] audit: type=1400 audit(1793289648.826:637): avc: denied { write } for pid=7648 comm="syz.5.364" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 420.256955][ T7653] uhci_hcd 0000:00:1d.0: remove, state 4 [ 420.257035][ T7653] usb usb2: USB disconnect, device number 1 [ 420.307743][ T7653] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 420.322200][ T7653] FAULT_INJECTION: forcing a failure. [ 420.322200][ T7653] name failslab, interval 1, probability 0, space 0, times 0 [ 420.322226][ T7653] CPU: 3 UID: 0 PID: 7653 Comm: syz.5.365 Not tainted syzkaller #0 PREEMPT(full) [ 420.322241][ T7653] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 420.322250][ T7653] Call Trace: [ 420.322255][ T7653] [ 420.322260][ T7653] dump_stack_lvl+0x100/0x190 [ 420.322308][ T7653] should_fail_ex.cold+0x5/0xa [ 420.322329][ T7653] should_failslab+0xc2/0x120 [ 420.322343][ T7653] kmem_cache_alloc_noprof+0x92/0x6a0 [ 420.322362][ T7653] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 420.322385][ T7653] ? acpi_ut_create_update_state+0x72/0x130 [ 420.322405][ T7653] acpi_ut_create_update_state+0x72/0x130 [ 420.322420][ T7653] acpi_ut_create_update_state_and_push+0x2f/0x70 [ 420.322442][ T7653] acpi_ut_update_object_reference+0x32f/0x800 [ 420.322462][ T7653] ? __pfx_acpi_ut_update_object_reference+0x10/0x10 [ 420.322479][ T7653] ? __pfx_acpi_ut_trace+0x10/0x10 [ 420.322493][ T7653] ? __pfx_acpi_ut_trace+0x10/0x10 [ 420.322509][ T7653] ? acpi_ut_status_exit+0x111/0x1c0 [ 420.322528][ T7653] acpi_ut_add_reference+0x80/0x170 [ 420.322555][ T7653] acpi_ex_resolve_node_to_value+0x7e1/0x9a0 [ 420.322577][ T7653] ? __pfx_acpi_ex_resolve_node_to_value+0x10/0x10 [ 420.322599][ T7653] ? acpi_ds_create_operand+0x267/0xc20 [ 420.322616][ T7653] acpi_ex_resolve_to_value+0x3da/0xcd0 [ 420.322636][ T7653] ? __pfx_acpi_ex_resolve_to_value+0x10/0x10 [ 420.322653][ T7653] ? __pfx_acpi_ns_lookup+0x10/0x10 [ 420.322669][ T7653] ? __asan_memset+0x23/0x50 [ 420.322687][ T7653] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 420.322706][ T7653] acpi_ds_evaluate_name_path+0x30d/0x4a0 [ 420.322721][ T7653] ? __pfx_acpi_ds_evaluate_name_path+0x10/0x10 [ 420.322736][ T7653] ? acpi_ps_get_next_namepath+0x1f6/0xa10 [ 420.322750][ T7653] ? acpi_ut_trace_ptr+0x141/0x2a0 [ 420.322767][ T7653] acpi_ds_exec_end_op+0xb78/0x1e60 [ 420.322782][ T7653] ? __pfx_acpi_ds_exec_end_op+0x10/0x10 [ 420.322796][ T7653] acpi_ps_parse_loop+0x5e1/0x26e0 [ 420.322814][ T7653] ? __pfx_acpi_ps_parse_loop+0x10/0x10 [ 420.322827][ T7653] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 420.322844][ T7653] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 420.322860][ T7653] ? acpi_ut_create_thread_state+0x6d/0x170 [ 420.322879][ T7653] acpi_ps_parse_aml+0x81e/0x1120 [ 420.322896][ T7653] acpi_ps_execute_method+0x5c4/0xe90 [ 420.322920][ T7653] acpi_ns_evaluate+0x640/0x1670 [ 420.322940][ T7653] acpi_ut_evaluate_object+0xf7/0x610 [ 420.322963][ T7653] acpi_rs_get_prt_method_data+0xa0/0x150 [ 420.322982][ T7653] ? __pfx_acpi_rs_get_prt_method_data+0x10/0x10 [ 420.322999][ T7653] ? acpi_ut_status_exit+0x111/0x1c0 [ 420.323016][ T7653] ? acpi_rs_validate_parameters+0x104/0x210 [ 420.323036][ T7653] acpi_get_irq_routing_table+0xb8/0x140 [ 420.323055][ T7653] ? __pfx_acpi_get_irq_routing_table+0x10/0x10 [ 420.323075][ T7653] ? do_raw_spin_lock+0x128/0x260 [ 420.323089][ T7653] acpi_pci_irq_find_prt_entry+0x178/0xdd0 [ 420.323109][ T7653] ? do_raw_spin_lock+0x128/0x260 [ 420.323122][ T7653] ? __pfx_acpi_pci_irq_find_prt_entry+0x10/0x10 [ 420.323141][ T7653] ? mark_held_locks+0x40/0x70 [ 420.323158][ T7653] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 420.323192][ T7653] acpi_pci_irq_lookup+0x8e/0x6b0 [ 420.323212][ T7653] ? __pfx_acpi_pci_irq_lookup+0x10/0x10 [ 420.323236][ T7653] acpi_pci_irq_disable+0x1a8/0x360 [ 420.323254][ T7653] ? __pfx_acpi_pci_irq_disable+0x10/0x10 [ 420.323273][ T7653] pcibios_disable_device+0x89/0xb0 [ 420.323292][ T7653] do_pci_disable_device+0x9f/0x100 [ 420.323309][ T7653] ? __pfx_do_pci_disable_device+0x10/0x10 [ 420.323325][ T7653] ? hub_event+0x17a3/0x4420 [ 420.323340][ T7653] ? kfree+0x22b/0x6d0 [ 420.323356][ T7653] pci_disable_device+0x130/0x270 [ 420.323373][ T7653] usb_hcd_pci_remove+0x1ed/0x300 [ 420.323390][ T7653] pci_device_remove+0xb2/0x1d0 [ 420.323404][ T7653] ? __pfx_pci_device_remove+0x10/0x10 [ 420.323418][ T7653] device_remove+0xcb/0x180 [ 420.323432][ T7653] device_release_driver_internal+0x441/0x610 [ 420.323451][ T7653] pci_stop_bus_device+0x120/0x160 [ 420.323469][ T7653] pci_stop_and_remove_bus_device+0x58/0xa0 [ 420.323486][ T7653] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 420.323503][ T7653] remove_store+0x123/0x140 [ 420.323521][ T7653] ? __pfx_remove_store+0x10/0x10 [ 420.323539][ T7653] ? find_held_lock+0x2b/0x80 [ 420.323552][ T7653] ? sysfs_file_kobj+0xe4/0x290 [ 420.323567][ T7653] ? sysfs_file_kobj+0xe4/0x290 [ 420.323584][ T7653] ? __pfx_remove_store+0x10/0x10 [ 420.323601][ T7653] dev_attr_store+0x58/0x80 [ 420.323617][ T7653] ? __pfx_dev_attr_store+0x10/0x10 [ 420.323633][ T7653] sysfs_kf_write+0xf2/0x150 [ 420.323649][ T7653] kernfs_fop_write_iter+0x3e0/0x5f0 [ 420.323662][ T7653] ? __pfx_sysfs_kf_write+0x10/0x10 [ 420.323711][ T7653] vfs_write+0x6af/0x1050 [ 420.323732][ T7653] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 420.323754][ T7653] ? __pfx_vfs_write+0x10/0x10 [ 420.323775][ T7653] ? find_held_lock+0x2b/0x80 [ 420.323798][ T7653] ksys_write+0x12a/0x250 [ 420.323809][ T7653] ? __pfx_ksys_write+0x10/0x10 [ 420.323825][ T7653] do_syscall_64+0x123/0x790 [ 420.323839][ T7653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.323851][ T7653] RIP: 0033:0x7f1de119f559 [ 420.323862][ T7653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 420.323874][ T7653] RSP: 002b:00007f1de20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 420.323895][ T7653] RAX: ffffffffffffffda RBX: 00007f1de1425fa0 RCX: 00007f1de119f559 [ 420.323903][ T7653] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000004 [ 420.323915][ T7653] RBP: 00007f1de1236b20 R08: 0000000000000000 R09: 0000000000000000 [ 420.323923][ T7653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 420.323931][ T7653] R13: 00007f1de1426038 R14: 00007f1de1425fa0 R15: 00007ffdff6dd508 [ 420.323948][ T7653] [ 420.323955][ T7653] ACPI Error: AE_NO_MEMORY, Could not update object reference count (20260408/utdelete-651) [ 420.359115][ T7657] rxe_eth0 speed is unknown, defaulting to 1000 [ 420.589219][ T42] audit: type=1400 audit(1793289649.336:638): avc: denied { read } for pid=7661 comm="syz.5.369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 420.589967][ T7662] process 'syz.5.369' launched '/dev/fd/5' with NULL argv: empty string added [ 420.591153][ T42] audit: type=1400 audit(1793289649.336:639): avc: denied { execute_no_trans } for pid=7661 comm="syz.5.369" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 420.659892][ T42] audit: type=1400 audit(1793289649.406:640): avc: denied { write } for pid=7668 comm="syz.4.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 421.088856][ T42] audit: type=1400 audit(1793289649.836:641): avc: denied { mount } for pid=7698 comm="syz.4.380" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 421.103619][ T42] audit: type=1400 audit(1793289649.846:642): avc: denied { search } for pid=7698 comm="syz.4.380" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 421.103651][ T42] audit: type=1400 audit(1793289649.846:643): avc: denied { read write } for pid=7698 comm="syz.4.380" name="v4_end_grace" dev="nfsd" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 421.146808][ T5856] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 421.152002][ T5856] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 421.157554][ T5856] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 421.167221][ T5856] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 421.171849][ T5856] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 421.252722][ T5894] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.350343][ T5894] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.447496][ T5894] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.514727][ T7703] rxe_eth0 speed is unknown, defaulting to 1000 [ 421.529638][ T7731] ebt_among: dst integrity fail: 100 [ 421.548660][ T5894] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.669640][ T7738] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 421.669660][ T7738] syzkaller0: Linktype set failed because interface is up [ 421.675505][ T3414] syzkaller0: tun_net_xmit 76 [ 421.722973][ T7738] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 421.728116][ T7738] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 421.734755][ T7738] pci 0000:00:1d.0: Adding to iommu group 8 [ 421.742431][ T7738] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 421.747147][ T7738] ================================================================== [ 421.747159][ ** replaying previous printk message ** [ 421.747159][ T7738] BUG: KASAN: slab-use-after-free in acpi_ns_get_attached_object+0x148/0x1b0 [ 421.747212][ T7738] Read of size 1 at addr ffff888023d2d480 by task syz.4.387/7738 [ 421.747229][ T7738] [ 421.747238][ T7738] CPU: 3 UID: 0 PID: 7738 Comm: syz.4.387 Not tainted syzkaller #0 PREEMPT(full) [ 421.747261][ T7738] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 421.747273][ T7738] Call Trace: [ 421.747280][ T7738] [ 421.747288][ T7738] dump_stack_lvl+0x100/0x190 [ 421.747321][ T7738] print_report+0x13d/0x4b0 [ 421.747372][ T7738] ? __virt_addr_valid+0x239/0x430 [ 421.747416][ T7738] ? acpi_ns_get_attached_object+0x148/0x1b0 [ 421.747446][ T7738] kasan_report+0xdf/0x1c0 [ 421.747467][ T7738] ? acpi_ns_get_attached_object+0x148/0x1b0 [ 421.747501][ T7738] acpi_ns_get_attached_object+0x148/0x1b0 [ 421.747531][ T7738] acpi_ex_resolve_node_to_value+0xb7/0x9a0 [ 421.747561][ T7738] ? acpi_ut_trace_ptr+0x1d2/0x2a0 [ 421.747587][ T7738] ? __pfx_acpi_ex_resolve_node_to_value+0x10/0x10 [ 421.747618][ T7738] ? acpi_ds_create_operand+0x267/0xc20 [ 421.747641][ T7738] acpi_ex_resolve_to_value+0x3da/0xcd0 [ 421.747690][ T7738] ? __pfx_acpi_ex_resolve_to_value+0x10/0x10 [ 421.747720][ T7738] ? __pfx_acpi_ns_lookup+0x10/0x10 [ 421.747749][ T7738] ? __asan_memset+0x23/0x50 [ 421.747776][ T7738] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 421.747802][ T7738] acpi_ds_evaluate_name_path+0x30d/0x4a0 [ 421.747826][ T7738] ? __pfx_acpi_ds_evaluate_name_path+0x10/0x10 [ 421.747850][ T7738] ? acpi_ps_get_next_namepath+0x1f6/0xa10 [ 421.747873][ T7738] ? acpi_ut_trace_ptr+0x141/0x2a0 [ 421.747900][ T7738] acpi_ds_exec_end_op+0xb78/0x1e60 [ 421.747924][ T7738] ? __pfx_acpi_ds_exec_end_op+0x10/0x10 [ 421.747946][ T7738] acpi_ps_parse_loop+0x5e1/0x26e0 [ 421.747973][ T7738] ? __pfx_acpi_ps_parse_loop+0x10/0x10 [ 421.747995][ T7738] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 421.748024][ T7738] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 421.748049][ T7738] ? acpi_ut_create_thread_state+0x6d/0x170 [ 421.748075][ T7738] acpi_ps_parse_aml+0x81e/0x1120 [ 421.748100][ T7738] acpi_ps_execute_method+0x5c4/0xe90 [ 421.748128][ T7738] acpi_ns_evaluate+0x640/0x1670 [ 421.748156][ T7738] acpi_ut_evaluate_object+0xf7/0x610 [ 421.748186][ T7738] acpi_rs_get_prt_method_data+0xa0/0x150 [ 421.748214][ T7738] ? __pfx_acpi_rs_get_prt_method_data+0x10/0x10 [ 421.748241][ T7738] ? acpi_ut_status_exit+0x111/0x1c0 [ 421.748266][ T7738] ? acpi_rs_validate_parameters+0x104/0x210 [ 421.748295][ T7738] acpi_get_irq_routing_table+0xb8/0x140 [ 421.748324][ T7738] ? __pfx_acpi_get_irq_routing_table+0x10/0x10 [ 421.748354][ T7738] ? do_raw_spin_lock+0x128/0x260 [ 421.748373][ T7738] acpi_pci_irq_find_prt_entry+0x178/0xdd0 [ 421.748402][ T7738] ? mark_held_locks+0x40/0x70 [ 421.748430][ T7738] ? __pfx_acpi_pci_irq_find_prt_entry+0x10/0x10 [ 421.748458][ T7738] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 421.748488][ T7738] ? pci_conf1_read+0x138/0x240 [ 421.748520][ T7738] acpi_pci_irq_lookup+0x8e/0x6b0 [ 421.748548][ T7738] ? __pfx_acpi_pci_irq_lookup+0x10/0x10 [ 421.748577][ T7738] ? __pfx_pci_bus_read_config_word+0x10/0x10 [ 421.748607][ T7738] acpi_pci_irq_enable+0x1f5/0x6f0 [ 421.748635][ T7738] ? __pfx_acpi_pci_irq_enable+0x10/0x10 [ 421.748668][ T7738] ? __pfx_pci_enable_resources+0x10/0x10 [ 421.748698][ T7738] ? __pfx___pci_set_power_state+0x10/0x10 [ 421.748726][ T7738] pcibios_enable_device+0xb6/0xe0 [ 421.748759][ T7738] do_pci_enable_device+0x21f/0x4a0 [ 421.748785][ T7738] ? __pfx_do_pci_enable_device+0x10/0x10 [ 421.748812][ T7738] ? pci_update_current_state+0x102/0x240 [ 421.748838][ T7738] ? __pfx_pci_update_current_state+0x10/0x10 [ 421.748864][ T7738] ? __lock_acquire+0x5c0/0x1f40 [ 421.748893][ T7738] pci_enable_device_flags+0x27c/0x370 [ 421.748927][ T7738] quirk_usb_early_handoff+0x17f/0x1360 [ 421.748948][ T7738] ? lock_acquire+0x1d1/0x380 [ 421.748974][ T7738] ? pci_fixup_device+0x328/0x4d0 [ 421.749004][ T7738] ? __pfx_quirk_usb_early_handoff+0x10/0x10 [ 421.749026][ T7738] ? ktime_get+0x22c/0x320 [ 421.749055][ T7738] ? lockdep_hardirqs_on+0x7d/0x110 [ 421.749087][ T7738] ? ktime_get+0x23e/0x320 [ 421.749120][ T7738] ? __pfx_quirk_usb_early_handoff+0x10/0x10 [ 421.749140][ T7738] pci_fixup_device+0x334/0x4d0 [ 421.749172][ T7738] pci_bus_add_device+0x55/0x100 [ 421.749192][ T7738] pci_bus_add_devices+0x9a/0x1f0 [ 421.749212][ T7738] pci_rescan_bus+0x2a/0x40 [ 421.749234][ T7738] rescan_store+0xfb/0x130 [ 421.749258][ T7738] ? __pfx_rescan_store+0x10/0x10 [ 421.749283][ T7738] ? sysfs_file_kobj+0xe4/0x290 [ 421.749307][ T7738] ? __pfx_rescan_store+0x10/0x10 [ 421.749332][ T7738] bus_attr_store+0x74/0xb0 [ 421.749360][ T7738] ? __pfx_bus_attr_store+0x10/0x10 [ 421.749386][ T7738] sysfs_kf_write+0xf2/0x150 [ 421.749410][ T7738] kernfs_fop_write_iter+0x3e0/0x5f0 [ 421.749431][ T7738] ? __pfx_sysfs_kf_write+0x10/0x10 [ 421.749457][ T7738] vfs_write+0x6af/0x1050 [ 421.749475][ T7738] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 421.749497][ T7738] ? __pfx_vfs_write+0x10/0x10 [ 421.749526][ T7738] ? find_held_lock+0x2b/0x80 [ 421.749554][ T7738] ksys_write+0x12a/0x250 [ 421.749571][ T7738] ? __pfx_ksys_write+0x10/0x10 [ 421.749593][ T7738] do_syscall_64+0x123/0x790 [ 421.749612][ T7738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.749632][ T7738] RIP: 0033:0x7f9f54d9f559 [ 421.749648][ T7738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.749667][ T7738] RSP: 002b:00007f9f55cee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 421.749687][ T7738] RAX: ffffffffffffffda RBX: 00007f9f55025fa0 RCX: 00007f9f54d9f559 [ 421.749701][ T7738] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 000000000000000b [ 421.749714][ T7738] RBP: 00007f9f54e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 421.749726][ T7738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 421.749746][ T7738] R13: 00007f9f55026038 R14: 00007f9f55025fa0 R15: 00007fff1e4a99e8 [ 421.749768][ T7738] [ 421.749775][ T7738] [ 421.749780][ T7738] Allocated by task 1: [ 421.749790][ T7738] kasan_save_stack+0x30/0x50 [ 421.749820][ T7738] kasan_save_track+0x14/0x30 [ 421.749837][ T7738] __kasan_slab_alloc+0x89/0x90 [ 421.749855][ T7738] kmem_cache_alloc_noprof+0x269/0x6a0 [ 421.749883][ T7738] acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 421.749902][ T7738] acpi_ut_create_internal_object_dbg+0x51/0x260 [ 421.749921][ T7738] acpi_ds_build_internal_object+0x173/0x790 [ 421.749940][ T7738] acpi_ds_create_node+0xe3/0x280 [ 421.749956][ T7738] acpi_ds_exec_end_op+0x10cf/0x1e60 [ 421.749974][ T7738] acpi_ps_parse_loop+0x5e1/0x26e0 [ 421.749994][ T7738] acpi_ps_parse_aml+0x81e/0x1120 [ 421.750015][ T7738] acpi_ps_execute_table+0x393/0x500 [ 421.750037][ T7738] acpi_ns_execute_table+0x596/0x970 [ 421.750064][ T7738] acpi_ns_parse_table+0xcb/0x160 [ 421.750090][ T7738] acpi_ns_load_table+0xc9/0x490 [ 421.750113][ T7738] acpi_tb_load_namespace+0x2b0/0x8f0 [ 421.750133][ T7738] acpi_load_tables+0x89/0x160 [ 421.750172][ T7738] acpi_init+0x146/0x840 [ 421.750198][ T7738] do_one_initcall+0x11c/0x6f0 [ 421.750221][ T7738] kernel_init_freeable+0x6ea/0x7b0 [ 421.750249][ T7738] kernel_init+0x21/0x1e0 [ 421.750270][ T7738] ret_from_fork+0x730/0xd60 [ 421.750295][ T7738] ret_from_fork_asm+0x1a/0x30 [ 421.750317][ T7738] [ 421.750321][ T7738] Freed by task 7653: [ 421.750331][ T7738] kasan_save_stack+0x30/0x50 [ 421.750359][ T7738] kasan_save_track+0x14/0x30 [ 421.750376][ T7738] kasan_save_free_info+0x3b/0x70 [ 421.750398][ T7738] __kasan_slab_free+0x5f/0x80 [ 421.750414][ T7738] kmem_cache_free+0x127/0x6c0 [ 421.750436][ T7738] acpi_os_release_object+0x1c/0x30 [ 421.750459][ T7738] acpi_ut_delete_object_desc+0xea/0x130 [ 421.750476][ T7738] acpi_ut_update_ref_count.part.0+0x510/0x2250 [ 421.750502][ T7738] acpi_ut_update_object_reference+0x5f9/0x800 [ 421.750528][ T7738] acpi_ut_remove_reference+0x192/0x1d0 [ 421.750553][ T7738] acpi_rs_get_prt_method_data+0xcd/0x150 [ 421.750579][ T7738] acpi_get_irq_routing_table+0xb8/0x140 [ 421.750606][ T7738] acpi_pci_irq_find_prt_entry+0x178/0xdd0 [ 421.750633][ T7738] acpi_pci_irq_lookup+0x8e/0x6b0 [ 421.750657][ T7738] acpi_pci_irq_disable+0x1a8/0x360 [ 421.750683][ T7738] pcibios_disable_device+0x89/0xb0 [ 421.750709][ T7738] do_pci_disable_device+0x9f/0x100 [ 421.750736][ T7738] pci_disable_device+0x130/0x270 [ 421.750760][ T7738] usb_hcd_pci_remove+0x1ed/0x300 [ 421.750781][ T7738] pci_device_remove+0xb2/0x1d0 [ 421.750801][ T7738] device_remove+0xcb/0x180 [ 421.750818][ T7738] device_release_driver_internal+0x441/0x610 [ 421.750842][ T7738] pci_stop_bus_device+0x120/0x160 [ 421.750867][ T7738] pci_stop_and_remove_bus_device+0x58/0xa0 [ 421.750891][ T7738] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 421.750918][ T7738] remove_store+0x123/0x140 [ 421.750940][ T7738] dev_attr_store+0x58/0x80 [ 421.750961][ T7738] sysfs_kf_write+0xf2/0x150 [ 421.750980][ T7738] kernfs_fop_write_iter+0x3e0/0x5f0 [ 421.750994][ T7738] vfs_write+0x6af/0x1050 [ 421.751008][ T7738] ksys_write+0x12a/0x250 [ 421.751022][ T7738] do_syscall_64+0x123/0x790 [ 421.751037][ T7738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.751056][ T7738] [ 421.751061][ T7738] The buggy address belongs to the object at ffff888023d2d478 [ 421.751061][ T7738] which belongs to the cache Acpi-Operand of size 72 [ 421.751076][ T7738] The buggy address is located 8 bytes inside of [ 421.751076][ T7738] freed 72-byte region [ffff888023d2d478, ffff888023d2d4c0) [ 421.751094][ T7738] [ 421.751097][ T7738] The buggy address belongs to the physical page: [ 421.751104][ T7738] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023d2df08 pfn:0x23d2d [ 421.751118][ T7738] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 421.751135][ T7738] page_type: f5(slab) [ 421.751153][ T7738] raw: 00fff00000000200 ffff88801d44da40 ffffea00008f5bd0 ffffea00008f5f50 [ 421.751170][ T7738] raw: ffff888023d2df08 0000000200270007 00000000f5000000 0000000000000000 [ 421.751180][ T7738] page dumped because: kasan: bad access detected [ 421.751189][ T7738] page_owner tracks the page as allocated [ 421.751194][ T7738] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2833459641 [ 421.751221][ T7738] post_alloc_hook+0xfd/0x120 [ 421.751241][ T7738] get_page_from_freelist+0x1113/0x35e0 [ 421.751263][ T7738] __alloc_frozen_pages_noprof+0x2bd/0x3280 [ 421.751285][ T7738] new_slab+0xb1/0x6d0 [ 421.751303][ T7738] refill_objects+0xe3/0x410 [ 421.751321][ T7738] __pcs_replace_empty_main+0x35e/0x650 [ 421.751344][ T7738] kmem_cache_alloc_noprof+0x4bf/0x6a0 [ 421.751370][ T7738] acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 421.751388][ T7738] acpi_ut_create_internal_object_dbg+0x51/0x260 [ 421.751407][ T7738] acpi_ds_create_operand+0x6be/0xc20 [ 421.751426][ T7738] acpi_ds_eval_data_object_operands+0x125/0x640 [ 421.751445][ T7738] acpi_ds_exec_end_op+0xe41/0x1e60 [ 421.751464][ T7738] acpi_ps_parse_loop+0x5e1/0x26e0 [ 421.751484][ T7738] acpi_ps_parse_aml+0x81e/0x1120 [ 421.751505][ T7738] acpi_ps_execute_table+0x393/0x500 [ 421.751528][ T7738] acpi_ns_execute_table+0x596/0x970 [ 421.751555][ T7738] page_owner free stack trace missing [ 421.751561][ T7738] [ 421.751565][ T7738] Memory state around the buggy address: [ 421.751574][ T7738] ffff888023d2d380: 00 fc fc fc fc fa fb fb fb fb fb fb fb fb fc fc [ 421.751587][ T7738] ffff888023d2d400: fc fc 00 00 00 00 00 00 00 00 00 fc fc fc fc fa [ 421.751601][ T7738] >ffff888023d2d480: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb [ 421.751611][ T7738] ^ [ 421.751620][ T7738] ffff888023d2d500: fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb [ 421.751633][ T7738] ffff888023d2d580: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fc [ 421.751644][ T7738] ================================================================== [ 421.751752][ T7738] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 422.167723][ T7738] CPU: 3 UID: 0 PID: 7738 Comm: syz.4.387 Not tainted syzkaller #0 PREEMPT(full) [ 422.171554][ T7738] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 422.175750][ T7738] Call Trace: [ 422.177188][ T7738] [ 422.178509][ T7738] dump_stack_lvl+0x100/0x190 [ 422.180520][ T7738] vpanic+0x2dc/0x6f8 [ 422.182221][ T7738] panic+0xd1/0xe0 [ 422.183814][ T7738] ? __pfx_panic+0x10/0x10 [ 422.185726][ T7738] ? acpi_ns_get_attached_object+0x148/0x1b0 [ 422.188245][ T7738] ? preempt_schedule+0x57/0xd0 [ 422.190346][ T7738] check_panic_on_warn.cold+0x19/0x34 [ 422.192639][ T7738] end_report.part.0+0x3a/0x90 [ 422.194271][ T7738] kasan_report.cold+0xe/0x18 [ 422.195844][ T7738] ? acpi_ns_get_attached_object+0x148/0x1b0 [ 422.197877][ T7738] acpi_ns_get_attached_object+0x148/0x1b0 [ 422.199892][ T7738] acpi_ex_resolve_node_to_value+0xb7/0x9a0 [ 422.201852][ T7738] ? acpi_ut_trace_ptr+0x1d2/0x2a0 [ 422.203535][ T7738] ? __pfx_acpi_ex_resolve_node_to_value+0x10/0x10 [ 422.205638][ T7738] ? acpi_ds_create_operand+0x267/0xc20 [ 422.207428][ T7738] acpi_ex_resolve_to_value+0x3da/0xcd0 [ 422.209404][ T7738] ? __pfx_acpi_ex_resolve_to_value+0x10/0x10 [ 422.211453][ T7738] ? __pfx_acpi_ns_lookup+0x10/0x10 [ 422.213218][ T7738] ? __asan_memset+0x23/0x50 [ 422.214753][ T7738] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 422.216795][ T7738] acpi_ds_evaluate_name_path+0x30d/0x4a0 [ 422.218638][ T7738] ? __pfx_acpi_ds_evaluate_name_path+0x10/0x10 [ 422.221192][ T7738] ? acpi_ps_get_next_namepath+0x1f6/0xa10 [ 422.223323][ T7738] ? acpi_ut_trace_ptr+0x141/0x2a0 [ 422.224992][ T7738] acpi_ds_exec_end_op+0xb78/0x1e60 [ 422.226729][ T7738] ? __pfx_acpi_ds_exec_end_op+0x10/0x10 [ 422.228577][ T7738] acpi_ps_parse_loop+0x5e1/0x26e0 [ 422.230380][ T7738] ? __pfx_acpi_ps_parse_loop+0x10/0x10 [ 422.232194][ T7738] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 422.234066][ T7738] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 422.236106][ T7738] ? acpi_ut_create_thread_state+0x6d/0x170 [ 422.238069][ T7738] acpi_ps_parse_aml+0x81e/0x1120 [ 422.239963][ T7738] acpi_ps_execute_method+0x5c4/0xe90 [ 422.241683][ T7738] acpi_ns_evaluate+0x640/0x1670 [ 422.243265][ T7738] acpi_ut_evaluate_object+0xf7/0x610 [ 422.244966][ T7738] acpi_rs_get_prt_method_data+0xa0/0x150 [ 422.246838][ T7738] ? __pfx_acpi_rs_get_prt_method_data+0x10/0x10 [ 422.248965][ T7738] ? acpi_ut_status_exit+0x111/0x1c0 [ 422.250757][ T7738] ? acpi_rs_validate_parameters+0x104/0x210 [ 422.253301][ T7738] acpi_get_irq_routing_table+0xb8/0x140 [ 422.255729][ T7738] ? __pfx_acpi_get_irq_routing_table+0x10/0x10 [ 422.258374][ T7738] ? do_raw_spin_lock+0x128/0x260 [ 422.260520][ T7738] acpi_pci_irq_find_prt_entry+0x178/0xdd0 [ 422.262930][ T7738] ? mark_held_locks+0x40/0x70 [ 422.264949][ T7738] ? __pfx_acpi_pci_irq_find_prt_entry+0x10/0x10 [ 422.267608][ T7738] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 422.270087][ T7738] ? pci_conf1_read+0x138/0x240 [ 422.272180][ T7738] acpi_pci_irq_lookup+0x8e/0x6b0 [ 422.274313][ T7738] ? __pfx_acpi_pci_irq_lookup+0x10/0x10 [ 422.276708][ T7738] ? __pfx_pci_bus_read_config_word+0x10/0x10 [ 422.279312][ T7738] acpi_pci_irq_enable+0x1f5/0x6f0 [ 422.281537][ T7738] ? __pfx_acpi_pci_irq_enable+0x10/0x10 [ 422.283925][ T7738] ? __pfx_pci_enable_resources+0x10/0x10 [ 422.286330][ T7738] ? __pfx___pci_set_power_state+0x10/0x10 [ 422.288875][ T7738] pcibios_enable_device+0xb6/0xe0 [ 422.290669][ T7738] do_pci_enable_device+0x21f/0x4a0 [ 422.292412][ T7738] ? __pfx_do_pci_enable_device+0x10/0x10 [ 422.294266][ T7738] ? pci_update_current_state+0x102/0x240 [ 422.296149][ T7738] ? __pfx_pci_update_current_state+0x10/0x10 [ 422.298222][ T7738] ? __lock_acquire+0x5c0/0x1f40 [ 422.300103][ T7738] pci_enable_device_flags+0x27c/0x370 [ 422.302413][ T7738] quirk_usb_early_handoff+0x17f/0x1360 [ 422.304263][ T7738] ? lock_acquire+0x1d1/0x380 [ 422.305867][ T7738] ? pci_fixup_device+0x328/0x4d0 [ 422.307465][ T7738] ? __pfx_quirk_usb_early_handoff+0x10/0x10 [ 422.309506][ T7738] ? ktime_get+0x22c/0x320 [ 422.311139][ T7738] ? lockdep_hardirqs_on+0x7d/0x110 [ 422.312828][ T7738] ? ktime_get+0x23e/0x320 [ 422.314278][ T7738] ? __pfx_quirk_usb_early_handoff+0x10/0x10 [ 422.316374][ T7738] pci_fixup_device+0x334/0x4d0 [ 422.318007][ T7738] pci_bus_add_device+0x55/0x100 [ 422.319970][ T7738] pci_bus_add_devices+0x9a/0x1f0 [ 422.321705][ T7738] pci_rescan_bus+0x2a/0x40 [ 422.323535][ T7738] rescan_store+0xfb/0x130 [ 422.325009][ T7738] ? __pfx_rescan_store+0x10/0x10 [ 422.326644][ T7738] ? sysfs_file_kobj+0xe4/0x290 [ 422.328282][ T7738] ? __pfx_rescan_store+0x10/0x10 [ 422.330238][ T7738] bus_attr_store+0x74/0xb0 [ 422.332176][ T7738] ? __pfx_bus_attr_store+0x10/0x10 [ 422.334368][ T7738] sysfs_kf_write+0xf2/0x150 [ 422.336352][ T7738] kernfs_fop_write_iter+0x3e0/0x5f0 [ 422.338610][ T7738] ? __pfx_sysfs_kf_write+0x10/0x10 [ 422.340846][ T7738] vfs_write+0x6af/0x1050 [ 422.342688][ T7738] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 422.345157][ T7738] ? __pfx_vfs_write+0x10/0x10 [ 422.347203][ T7738] ? find_held_lock+0x2b/0x80 [ 422.349235][ T7738] ksys_write+0x12a/0x250 [ 422.351052][ T7738] ? __pfx_ksys_write+0x10/0x10 [ 422.353094][ T7738] do_syscall_64+0x123/0x790 [ 422.355030][ T7738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.357487][ T7738] RIP: 0033:0x7f9f54d9f559 [ 422.359396][ T7738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.366539][ T7738] RSP: 002b:00007f9f55cee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 422.369206][ T7738] RAX: ffffffffffffffda RBX: 00007f9f55025fa0 RCX: 00007f9f54d9f559 [ 422.371708][ T7738] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 000000000000000b [ 422.374150][ T7738] RBP: 00007f9f54e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 422.376619][ T7738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 422.379140][ T7738] R13: 00007f9f55026038 R14: 00007f9f55025fa0 R15: 00007fff1e4a99e8 [ 422.381623][ T7738] [ 422.383302][ T7738] Kernel Offset: disabled [ 422.384741][ T7738] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:00:50 Registers: info registers vcpu 0 CPU#0 RAX=000000000011dedf RBX=ffffffff8fc91540 RCX=ffffffff8bebe325 RDX=0000000000000001 RSI=ffffffff8e621faf RDI=ffffffff8c833580 RBP=fffffbfff1f922a8 RSP=ffffffff8fc07cf0 R8 =0000000000000001 R9 =ffffed100d406825 R10=ffff88806a03412b R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1f80fa2 R15=dffffc0000000000 RIP=ffffffff8bebc7bf RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d448e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000561b470816e8 CR3=000000002dc0e000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000feffffe0 Opmask01=0000000000010007 Opmask02=0000000001010037 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000561b4706e5d0 0000561b4706e5d0 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000f6609824 6ae36db300020003 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000029 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000561b47071310 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffa36544b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000561b471364f0 0000561b4720d070 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000561b470595b0 0000561b47059660 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000011043 0000000800010000 88bb66706ae36db2 00020010000005f4 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0011000500000006 00100005000003e8 000d000800000000 3168746500030009 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000561b47049b8d 000000000c4f5851 000d000d004e5850 5c535b5413495853 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000100000000 0000000100000001 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 80410004803e0004 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000e002400000001 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000003e800002710 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2030002030303d69 665f640a64695f20 64626265200a3364 6820200020626262 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbff52532232d20 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 262821df2e2e33df 3228df3232202b22 df312e232d2435bf 2324353124322431 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=dffffc0000000000 RBX=ffffc9000561ee20 RCX=ffffc9000561ed74 RDX=ffffc9000561ee20 RSI=ffffffff8e5faf72 RDI=ffffc9000561ee20 RBP=ffffc9000561eeb0 RSP=ffffc9000561ee10 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=000000000008f7f0 R12=ffffffff81f81620 R13=ffffc9000561eee0 R14=0000000000000000 R15=ffff888023c44b00 RIP=ffffffff81bb4642 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555594415500 ffffffff 00c00000 GS =0000 ffff8880d458e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000055557bc84a28 CR3=000000004aa1f000 CR4=00352ef0 DR0=0000000066d5c2cc DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000020081 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8c6add749f88d39e 74459faf7cbdaf0b ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 acaa3d431567f41a 92a009c8bde5b2d0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 d3a0cff9711d60cb 209ef26988f5d3e2 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a37f54bd0c0ee3c 97259be3e9f9d0a5 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000084c0 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 464b493d01009246 bb3e0000924d5d62 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 01009219826332c7 0000010000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000004e2d900000 1a7c00001952803c ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00daa33192dd6704 00000100b4fb1478 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b2759779df9ee989 128bc13f848167da ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b14e454f4db71615 e4237d2323720899 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 2074657365720064 656c696166202973 2528746174736c00 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 0551405640570041 40494c4443050c56 000d514451564900 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=8000000000000001 RBX=dffffc0000000000 RCX=0000000000000001 RDX=ffff88801e762580 RSI=ffffffff81ec4d13 RDI=ffffc900007bfda8 RBP=ffffc900007bfda8 RSP=ffffc900007bf950 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000003 R11=53414b203a475542 R12=0000000000000000 R13=ffffc900007bfda8 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff820e52f0 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d468e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f3e43b73e9c CR3=0000000051a77000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000020081 Opmask01=0000000000000000 Opmask02=00000000ff02fefe Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b2759779df9ee989 128bc13f848167da ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b14e454f4db71615 e4237d2323720899 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ed2140076ce87f93 1570995b01196bce ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f7fb35a2431011f 12934d2d028306b0 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000008480 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 01008fde785aaaaa 01009045aaaaaaaa ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 06c47cefaaaa0000 93062175295a4d52 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000100aaaaaaaa 9040bc2082260000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000100a2a4fe2b 91b71da4cdf896d5 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 e25f70fda1284fa8 af67224b8b37386e ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 39e4bae11de978a1 e89b95789bad1d1b ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 2074657365720064 656c696166202973 2528746174736c00 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 0551405640570041 40494c4443050c56 000d514451564900 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85c0c735 RDI=ffffffff9cf39a00 RBP=ffffffff9cf399c0 RSP=ffffc90004d668a0 R8 =000000000000001f R9 =0000000000000000 R10=0000000000000003 R11=0000000033373754 R12=0000000000000000 R13=0000000000000032 R14=000000000000000a R15=ffffc90004d66bb8 RIP=ffffffff85c0c75f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f9f55cee6c0 ffffffff 00c00000 GS =0000 ffff8880d478e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f4249bc86de CR3=0000000054069000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000008000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000040000000 Opmask01=00000000000000ff Opmask02=00000000fffffeff Opmask03=0000000020400004 Opmask04=00000000ffffffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055e370566c80 000055e370566c80 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055e370407ca0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055e370400c30 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f424a727b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f424a688c80 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3446413130303030 7673343339323030 3030643638303830 303030763a696370 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0030306933306373 4330636230303131 3030303064733446 4131303030307673 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e090e040f0d0d0d 0d590b050d050d0d 0d0d4b07545e4d00 5341494c41444f4d ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055e600646461 0000000000000021 0000000000387075 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4400000000000002 0000001e00000004 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055e370404e10 fffffffffffffffc 44007f424a5f5d68 00007fe1092a169c ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ea64fff77edfeffb fffffffffffffffd 75307ff77fdffff9 fffffffffffffffc ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30322f31302f3430 64623a322d332e36 312e312d6e616962 65642d332e36312e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000100000055 0000000000000000 0000000000001011 00004e4f53412552 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000