last executing test programs: 58.420141454s ago: executing program 3 (id=72): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r1, 0x8}, 0x8) (async) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r1, 0x8}, 0x8) 58.325638684s ago: executing program 3 (id=74): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x20, 0x21, 0x0, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@rand_addr=0x64010101, {0x0, 0x0, 0x0, 0x3628, 0xffffffff00000001, 0x0, 0x7fffffff, 0x543}, {0x4, 0x7fffffffffffffff, 0x0, 0x1}, {}, 0x70bd2c, 0x3500, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x15c}, 0x1, 0x0, 0x200000000000000, 0x880}, 0x2014) 58.323392598s ago: executing program 3 (id=76): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000380)={0x36a, 0x78, 0x300, 0x0, 0xa, 0x0, 0x0, 0x0, {0x0, 0x1f}, {}, {}, {}, 0x0, 0x40, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) 58.244969099s ago: executing program 3 (id=77): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001200"}) 58.179969655s ago: executing program 3 (id=79): socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000300)='\x06\x00\x00\x00\x04\xb0\xfe\x98\a\x84\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb:\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000x0}, 0x8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=r4, @ANYRES32=r4, @ANYBLOB="2f000000ab2000000400000075230570fab44acf37d2a199a86243b10ca5395c21d06c574f", @ANYRES32=r5, @ANYBLOB, @ANYRES64=0x0], 0x20) write(r2, &(0x7f0000000300)='offline\x00', 0x7) write(r2, &(0x7f0000000400)='online_movab', 0xc) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/system/memory/memory34/state\x00', 0x2, 0x0) write(r6, &(0x7f0000000300)='offline\x00', 0x7) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r7, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) 56.704787696s ago: executing program 3 (id=112): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a3100000000080003000000000630000480080001000000123414000280080001007f000001080002007f000002100009800c0001800800010000000100"], 0xb0}, 0x1, 0x0, 0x700}, 0x0) 41.676652019s ago: executing program 32 (id=112): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a3100000000080003000000000630000480080001000000123414000280080001007f000001080002007f000002100009800c0001800800010000000100"], 0xb0}, 0x1, 0x0, 0x700}, 0x0) 34.308883367s ago: executing program 1 (id=629): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000005e000100"/20, @ANYRES32=r1, @ANYBLOB="9d"], 0x1c}}, 0x44) 34.240278428s ago: executing program 1 (id=631): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5800000042000100000000000000000003010000000000002600010000112233445566778899aabb86dd450000140000000001170000010203040506070800800c00020006002000884800140c0003"], 0x58}}, 0x0) 34.235973395s ago: executing program 1 (id=633): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c0000000000000f0000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000080000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) 34.170135006s ago: executing program 1 (id=634): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mmap$IORING_OFF_SQES(0x0, 0x1, 0x100000a, 0x10, r0, 0x10000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)={0x24, r2, 0x1, 0x4070bd29, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xc4}, 0x40) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000000)={0xfff, 0x0, 0x3, 0x5, 0x4}) ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29) fsetxattr$security_selinux(r5, &(0x7f0000000080), &(0x7f00000000c0)='system_u:object_r:getty_var_run_t:s0\x00', 0x25, 0x1) setsockopt(r5, 0x84, 0x14, &(0x7f0000000040)="020000000980ffff", 0x8) openat$nmem0(0xffffffffffffff9c, 0x0, 0x40, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ifreq(0xffffffffffffffff, 0x89a2, &(0x7f0000000240)={'bridge0\x00', @ifru_ivalue=0x10}) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x1bff415, 0x0) 34.079906392s ago: executing program 1 (id=637): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800e6ff040000000100005c965ce1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="020100020a0000000000000000000000030005000000000002000000000000000000004fae0000000200100020000000ffffffff00000000030006000000000002000000640101"], 0x50}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000200000000000a50000000060a010400000000001000000a0000010900010073797a31000000002400048020000180070001006374000014000280080002000000000608000140000000090900020073797a320000000014000000110001"], 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x19}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100000}, 0x48) 33.880222185s ago: executing program 1 (id=639): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80a42, 0x47) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=ANY=[], 0x0, 0x1600) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSLCKTRMIOS(r1, 0x80047456, &(0x7f00000010c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r4, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) close_range(r2, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r3, 0x0, &(0x7f0000000380)={{r5, r6+60000000}, {r7, r8+10000000}}, &(0x7f0000000400)) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl(0xffffffffffffffff, 0xc138fd03, 0x0) mkdir(&(0x7f0000000280)='./bus\x00', 0x63) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) write$binfmt_elf64(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="7fbc06b1933947d5b60c0000000000000300060000000000ad0100000000000040000000000000007b000000000000000200000001003800010004001eff07000100000007000002060000000000000005000000000000000100000000000000020000000000000000000100000000000400000000000000"], 0x78) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='./bus\x00', 0x80040, 0x1f1) 33.85028826s ago: executing program 33 (id=639): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80a42, 0x47) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=ANY=[], 0x0, 0x1600) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSLCKTRMIOS(r1, 0x80047456, &(0x7f00000010c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r4, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) close_range(r2, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(r3, 0x0, &(0x7f0000000380)={{r5, r6+60000000}, {r7, r8+10000000}}, &(0x7f0000000400)) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl(0xffffffffffffffff, 0xc138fd03, 0x0) mkdir(&(0x7f0000000280)='./bus\x00', 0x63) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) write$binfmt_elf64(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="7fbc06b1933947d5b60c0000000000000300060000000000ad0100000000000040000000000000007b000000000000000200000001003800010004001eff07000100000007000002060000000000000005000000000000000100000000000000020000000000000000000100000000000400000000000000"], 0x78) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='./bus\x00', 0x80040, 0x1f1) 1.599897754s ago: executing program 5 (id=1475): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002f00090027bd7000000000000400300004001d00040012"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 1.549665246s ago: executing program 5 (id=1477): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000001f00000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001"], 0x17d4}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000) 1.548997191s ago: executing program 5 (id=1479): setresuid(0x0, 0xee00, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000001040)=ANY=[@ANYBLOB="b7050000000100007910a800000000001d50000000000000950000000000b000dad0ae437202fe29729e5361e283f4c4ddf4f91558ee5ce40394c5f0063281d106d9692809f9019b91aa47941e12669ec84cb12e51a175b929b9eb3ed662fd9448d2cf8c101279664c6e0e70869cd88420cb289b7fdbd62b760fd36c31a0919c482808100058572aea56c1b636001f34db40ee898d88ee30e8942a975c7806f0cfb12f6127edd280f96e41d54100b2ced86c59bb6524d0d985c6eaef2ea15d1ceadcf5cdde89b6c76ea58af225f8a9c763767491566c6a3627011463fb7267715090bc94407ad0962476b14a851594175b41576cbd060faa5ae19d1d433bad4e5aa7f338f511028103bf634e003cce56be57cd177878f429"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0xfffffffffffffe1e}, 0x2a) 1.480239185s ago: executing program 5 (id=1481): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffe0900010073797a30000100002c000000030a01020000000000000000010000000900030073797a31000000000900010073797a30000000007c000000060a010400000000000000000100000008000b40000000000900010073797a30000000005400048010000180080001"], 0xf0}, 0x1, 0xfff5}, 0x0) 1.398167305s ago: executing program 5 (id=1482): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x80ff, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x5, 0x0, 0xfffe, 0xa}, {0x6, 0x3, 0x1, 0x0, 0x0, 0x2}, {0x0, 0x1400000003, 0x800009d8}, 0xfffffffe, 0x0, 0x1, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x2, 0x6c}, 0x2, @in6=@local, 0x0, 0x2, 0x0, 0x4, 0x0, 0xfffffffe, 0x200000}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x64004081}, 0x0) 1.397204879s ago: executing program 5 (id=1484): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x20000000000001db, &(0x7f0000000080)=[{0x9, 0x1, 0x4, 0x81}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$dmmidi(0x0, 0x2, 0x94000) socket$packet(0x11, 0x2, 0x300) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) syz_usb_control_io$sierra_net(r6, 0x0, 0x0) syz_usb_control_io$rtl8150(r6, 0x0, 0x0) r7 = dup(r5) write$UHID_INPUT(r7, &(0x7f0000001a00)={0xf, {"a2e3ad214fc752f90b5e09094bf70e0dd038e7ff7fc6e5539b1b48078b089b3b0838721a0890e0878f0e1ac6e7049b3d6c959b4c9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d07420736cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e2c5070000179c6f30e065cd5b91cd0ae17d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3bb469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be8afb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918070000003f0000000c558cdc0a3621c56cea8d20fa911afe40db6ebe8cac64289fd3da232f1b5dbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860421c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2f09000000000000007747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847354b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d27c9a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d483d4675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516ab68032f88c042ffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d95f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e218eb4035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f06f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378fd4dd891e937c2ea5410e05130050000f1000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9d1a3d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca503705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdfa1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102b0c7829389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442748af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d8224fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d784cfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000f400", 0x1000}}, 0x1006) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x109980, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x23, 0x0, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010101, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x0, 0x0, {0x6, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @broadcast, {[@timestamp_addr={0x44, 0x4}]}}}}}}}, 0x0) r11 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$hid(r11, &(0x7f0000001280)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000140)=""/241) 579.861035ms ago: executing program 4 (id=1494): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0x401, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1703}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x4c}, 0x1, 0x0, 0x1000000, 0x2004d808}, 0x0) 520.252072ms ago: executing program 4 (id=1495): socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000000)={0x0, 0x0, 0x3014, 0x0, 0x0, 0xfffffffd, 0x8}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x54c8}}, './file0\x00'}) ioctl$HIDIOCGNAME(r4, 0x80404806, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) syz_emit_ethernet(0x237, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd602a1c9902013c0000000000000000000000000000000000ff020000000000000000"], 0x0) ioctl$VHOST_SET_LOG_FD(r5, 0x4004af07, &(0x7f00000002c0)=r5) r6 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r7, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) ioperm(0x6, 0x1, 0x95d) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$xdp(0x2c, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r9, {0x2}}, './file0\x00'}) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000340), r10) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi4\x00', 0x200, 0x0) sendmsg$NFT_MSG_GETTABLE(r8, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="bc000000010a03000000000000000000030000040e000000000000002df54df926cf81f0c9f9f1ef408c54faa413a754a5708ade056dd1f8b58005ef31efce16c0bce18333cf8983dc037e00002d0006009389b9bc3481524fc16de6ddf3eab4c38a6fb9c96335007df0da82b9064581afd88b775c40d0363e6c0000000900010073797a31000000000900010073797a30000000000b000600bf4bdfc87b990e000800024000000000080002400000000200"/188], 0xbc}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r9, 0x180000000) 406.666205ms ago: executing program 0 (id=1500): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f0000000000)='exfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000280)={0x4, "daa56c11e5a17b8835712f7a57ee0ea5101f0a7243f7d4d529e90b3e0e383c7c", 0x1, 0x8, 0x1ff, 0x3, 0x2, 0x1, 0xf, 0x8c4}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008103e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000140)={0x3ff, "782cd2b6e763913af3d73f7c8b0a758f28b5a7ed8cdf331498a849226b0dea07"}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r0}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0xffffffffffffff2d, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfd3f5, {0x0, 0x0, 0x0, r7, {0x1}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xa, 0xfff0}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xe70, 0x30, 0x25, 0x0, 0x0, {}, [{0xe5c, 0x1, [@m_pedit={0xe58, 0x1, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {}, {}, {}, {}, {0x0, 0x800}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfb82}, {}, {}, {0x10}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4d3}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x5ad8d0b5}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {0x0, 0x0, 0x20000000}, {}, {}, {0x0, 0x18e}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x8}, {0x0, 0x2}], [{}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {0x2, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe70}}, 0x0) 406.509062ms ago: executing program 4 (id=1501): sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010028bd7000fedbdf2509000000280002800800020002000080080001000020000014000380"], 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x24040021) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r2, @ANYBLOB="00000000000000001c001a8018000480"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000580)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000000000000030000000300000000200000000000000000000020300000000000000010000840000000400000000010000000e0000000000000000000004"], 0x0, 0x4a}, 0x20) sendmsg$nl_route(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="440000002000010004000000fbdbdf250a400000000000081100000014000200fc02000000000000000000000001000014000100200100"/68], 0x44}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB="5e00000010003904000000000000000003000000206558ba59d87f5b77869967011490f54ba351d7c5e1bad3dfe2d8f88770e580924766e372108c8c51ad6b017a96faa389dbc42aa34d", @ANYRES32=0x0, @ANYBLOB="10000000001000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000214000200fc0200000000000000000000000000ff"], 0x5c}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000000c0)="3d0958057e36f23391ffa3db3ee33def75bf1f5c0c6fd79f5d349e928e6082de2e0cb2cf04328cdbe6ecb0f7ae75c9a36a4a1013d5a631844fc06bd9fcd261fe2e39838e99151a1867e94e6771b0c05a04284cd73e24c7cfa5b72b841e243fdf80", 0x61) 348.174828ms ago: executing program 4 (id=1502): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast1, @in6=@loopback}, {@in6=@mcast2, 0x0, 0x32}, @in6=@loopback, {}, {0x0, 0x0, 0x2000, 0x2}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x14}, [@algo_auth={0x48, 0x1, {{'xcbc(aes)\x00'}}}]}, 0x138}}, 0x0) 347.014147ms ago: executing program 4 (id=1504): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x0, 0x16d7, 0x80, 0x3, 0x87}, &(0x7f0000000640)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde56, 0x200, 0x0, 0x66}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf480, 0x0, 0x3, 0x18a}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1e9, 0x100, 0x3, 0x2c5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe75b, 0x4000, 0x1, 0x41}}], 0x4, &(0x7f00000018c0)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x3, {0x6}, 0x0, 0x0, '\x00', {0x3, 0xa79, 0x0, &(0x7f00000008c0)=@buf_4k="2c551e1f1af21f59727f2cc4deeb18be05ce5bf978bdbcf79e8d2713cf753d0dec9dafedea1e101a0445457d6dca8e7ae79879b82471de25b86718b2469480977f0d0f990605905dd57e7d4ab3a3cc9399732243afe1e624ac6fafa6bc3a77ada9637ba04da81d19eb7bd908045d7853b8de0f4f3dd7093d8ae739296c995c36417a932d0161151891c7a435415216e267fe053e65a0f2b80d4a0a33586527ed6e8a09bff06ab11afec730d1dedc9c896cbe26b5b48cdfc8ff35e5d6f6bc133fbb7268ea00037c0b887e48ec86f85033b05f04594ac54879bc1162d624918a7fc3aad224549740b31ddc4091fd8f47be024d841e88b745ca16697c050c211f6f7459e866ad4a056f6669045c248b3c2270ae706cb90290b3b81e690f8bdd2fad921d6bf4fed2e8d38ebe7ae1b318b1b7441b6dcaf56a2915963ccc9ee14a0a4ed5fad9c689cb9c4973dfb3c551c6c37bf3164abf23824783a71543f785432a8d1b909575172fab5782e54cd28d7e8ab655027305a09497d98e5b1de58bab83f2aa7f7addc7032960921b3f4db94cd0d114396a76ce786d53c28ecf9f0e7b11d99050130a4e601f9738e79a4240f9ed6c57d81316e45a7154e203b9a36e4a3660ab4b58c65b38df1d39ff05013e055b2a7803a31bc41d187c9d95d08927b1f3641e1a505a958f3477b125de24e3c60f860359c99590c411995b2b54a8140ad0e6426652082db002db0ac4b943375c4227d333ce78b5e77b82257ddd0e098d28374bcfd784ecf271a40dd545da20ed1cd1d0e366590b9634f5b7b6ce769c0c7a4bde393515ba7074a76214918c16b500a0fc48bf63dd87833596652dfdfccd8df0d0113665b143dcba02d3d921e39d02305b768a0e33d3274ae4a9f81b48cb8b765304f05d23b0ae9b1ed3d88ab01a256b8a24379e4fa528e1c7aacd85e23ae450df23d3717b5ed643d140d88243da0eaa4db293c2ec3484cc06e88d577db8a697d0d27961be01735dd0bb0cbd01e79def3fbb9a959e657569057329729b9b3c9ca50c30a47cd936aa4441ca11dc3d945a622458b5fa874742c2bb5936890ab37e100d19ba0042df10608cfd3384b0933da4691b07940c790211f09baf004b9bfd9a3b1ece7b32f203006e6964075ac0d9975028214a356b2db570ac696baa6de07ba308bbf14c4a51d2f848cc05e3ca7d996357becc003a8b11df1a9ead362474f9e5ae6dade3f6e99f9ac2518939effd9e417eef6741f695d86ce264ff124b944ec76b89e11ba7b6095f8bac33f982cf92c1cfe5c84dc544d8ea72bad4ba68fb6564ebc16aebee9bc07b701f4ca6b5d7672ae2f6f4c3e17d5814375ec56e68293be328aaf2988c07b153bb1bd5076efc9943d819f555db02b9eda1976985da486eb9996199c7c5088544c1e3be6c6c50d61082ff1de92df83813e1d98ced1725aa762fa6151a1e7f295dfd992f77760b572423fd147297c11419306c7dbb113f88fc30773f732ab20116f2d9b55b7513003d56e2ec93ae9099d0f89016fabedef3e7aabdb07eac1d5294948f2f7b3170394438997f03e5a67d26a05cd6d6ca0de3eb6b846fcedb4550ca2251faf05ef7a7c75d645528651c667ca9ccdfb1713bcd76c66be2d8e6046b1d4702521be31b78b521762015115e6cd8d527b8ae456008c8d689553cf428596977886fd45a644324c7c948ed218501ee796cecda9685e89d8f943ad07de45132361afcc79ec49fc5f15c7d19e370b1aa6e03e6607dc10089a1fbc9a3f1f9d5927751b28ef0646da558e807c1a98db353caa31da2bd4b74a981fd5ef42cff38119524b49a9764d83d381cdb9ae72568b7b47b51d50f47ddd085e1ff88cf677c20d731541baa50fa2292ceddb4dd2f262b898e74f1f71b1f31e2d2bc223ef3d164e1d4ceaa5421034b9ca545f8c16fd8acca1e99e3f9427d52fe38db5e1446327b5a250d6a136e77fff20091e8d1ec36eb7a229d95edf832c596d997472c658acfe1b1269f8a088bf69710a04d069c741786b2adc0fb5ebf817012c36a67e357b5a4db0b832bdec46087a38990c70608730724bf9349544af29274ac3fd6c01fc34002a5dcd834c6678df6d6306655513397362d485bed8b0b4ed27724d0ecd03c56a2fd69301083d06f69488fe8c9e4474c4c0b1a8a55c85867c3d4f55d690823721749d279257657a075c0407185146f705a921cc4d34701e82bb467a2987823d38982bfd1a88bb6e97a37da8a89551db840b62e63190a93842b95a2bd6373e70e47fbe141ce2ba13000bce91a7606b33d6ec1e5d0ff9732f2b2bf6378eaccd645fa9510ee5166a15013aa721f286062e7d8e01fa99b6ba7773174bc9bd30328c52f7e13a9ee3688a8826d46d7c5368260f7abe57e7eef35b3488f4d6a593008a6b62ede3035a3f71aef15a810e50af8117ab1d5910fca30e5f67265d617d12ac501151d8bf01ba857e79d125b3d3dc98f1fb41718a5aa8cd26fcfbc35d1729836ea521064d4a2ac826ee888833dc4a6630f5142ca39d8595ac4a63db841335bd0bb20667fce7a9022afb0f67b5e58818f5ff1df5762c305ebda463e25c2b74a8a6c2231e16498395d664597d85343e726baeaff81d2322cb1b31e29d4601bcc6f6acfa792d1be637b8ced3e3070b63e8b2be9b82db577ac9f8ff4e8e853889bd7f108594aa83dd04ecd4ca789e0a2805197cfa457cc21eb83509b7ada9b4937933bf38b6fa3befd7554e652ebc1fe8cb73a21762ec91f185b64a5ab39a92918572ea1000681c98cdbf84150bc4305fa263f9a2720ae87a230f64d29ef4260641d1fe4c443080ebc3077df43520c034c4d63970216bdb6b282ee2fca77e60d1e7ab6be3f1fa39b429d73bdd658a9e8f94be3aa4d6f235512bf45d84f6cdbf268816e927c218e9a5ffce4556e44c0b53b808f4f69bac9c00d05ceef87b79b229984353bc9141eca50fcc20bac9376f64e81b7b57e1f6c6fe60cd58b1584a88f998a24231b1004a3a196fa4306f3b9a767187b845afd5b2a262650824ba838932855d5fe63dda30c17225fcf656dfdc3f8f66a0ecd2c92a925fb0334ef4001047509d357a14de2820b66ba2a25032fb901784a6a57a47a3643290bf7a4b55fa90dd4b21b6244596b5018174dc0223f5c6786181471ff9db4bb3e9b5cba3b88194bf4bc508979874fd8b5db696c524fa5483dfe3e8d60aeaf86eea5337a165635c97ccb7641f04c465e35ef340690ae696d15269b3dbd0fd94f8b2dc0282f89b28faf79c2da83131b6f01d5eee93576d304e33244238cebbe7f566e492b8615eb7a3c96adda5ad67217f4a2e04bc4f464b1b8384d536ebfab9dc0cc7f407d060f2d38d3c81952c119f155f45d0f52494ff3a9db66ed54e95dfd663d38fc482615782339e1042877eb4cd5d746fda901ba238746b456c6a0a8f8f2689ef42825484d65189cef31c4cb068c409b0d4283e92a2ff4d3d874800f34be84e4ff851ffc286c48f1fc2963ddb1cf174a27146b9d3539bd6b4817bb060adf0d003613aadb34588f725e1a3d6e03898b42e59bde096be2c461a7569a72d228505543089b873984318aae301fac25dad5f71e3c15e2ec039d41a50a1065a2c3da9a6db0bac6c09cb727a1be879bb448cd7d7d6b3583d9cf49a1e3890ab54b654fffdd2c95dbf023c7f7872c9aa7eff635b29c37896239ddd498c3971188f406236d5831d113df6777776cf70a0248107da2d8ea66ff5a10e221383da7d4d9362e44c9ea44b1d0613c58887bee495ae2bbab7dbcfd61960872a39ccee984f11ac55efd98cb9a3e59c310c97490f1a5bafd15316b1f74c9051a96bb5ca0abd7dc17551fb6d11d734f530fe3dd1722a62f028bd7b92d8715a3f1a3ee58538903025162f260a894f30a372149eb24d2286aae726e34d6a3d19f675c9ef0c3626906bd7a82e79f53133e3a66af8ad9a5d98d53765972c29d0083ee882f286762d530d279ac7de622b79f1fff85ff75617eba109abdad0c214dd9b029263f7342d94fa487b906858078951fd21a6ad8e36b26cfbc512dd1de18ef61555836db20969429b0c8f26d52de0454158910de6fbee33a2afd079b3f290502b4347bd1598e75d1a6d2619cf5aed4d2bda44b5817d5ae25177940bd489503a65fe4733a6e9fc92be73292a8789e2cb64cfd7240007994fb1023f2fc7d5376a6177f88202db171393e92387b4cad9ccd34e97d769101cc3926a76805c4c64fb54064cd3b1589e368fed3fecfa6aa4e85f5cb66449f5fda484f0cf31acc1c3abf8de8ea941cc59108a39b947c2309e93b568d63bbcaeeaaa1cbbc05d1c983071212da2f9a0d645d7253fb796eeb0a4975ebb292051932ec7af98d181b1b5c750b6717410580408bba47ae6888417adc4b0e4464ad76cb64928a22970ff0633df7c728b4ddab0bbb7c12c4edb40a634a79108677e300fb6b8b48ecded55a567b46f91f9a758033987ea8dbb7ce5bdbe02ca473bb1685a15bf34e1207e575c5f875b646af01a47d25ad02440e1cae6c5cfa2e8c7f1b2964d57cc81ebcf5e15673c579e40ffb34079d015442f505dbe4caee130e898b683e2f131128f937d55d90be057190514fc82f100311ec1ad52602a83ebc521695f7448fe5bbd16065ae1cf221c3b4eb35ba253945e7d78e5825df4a890278dc39d6c2a63a0ebb0845292480f7b32e0f93a606ffc1818e224519d717f6eff252403d67e84a0c2900838ffbec6443051c091b844f6d5936ac0e26939655533b142eeaeffe297b840b5ae0e138eafe07c6177d89df1472c1eb222f9da3a651015ab6395e32d685878ab58e52d3a838eddab931cde438c6d3008cfa757bccf995fbf43a44333c56e8d91b348c0a53e3e6fef0d546e3ad5498885d0be4ca8f201f926ccb4ce1ff3016ed359dceb2526467a0b1bd8e8544ba8c0ed3e6ab884e89c27fba1842c8ff5bdd342ee1e77f228edfe319de10d5e572c4efe6a9304d6251caa827feee478944ce35afd8cc628cb1f6c1b65f232bc178634aff926468f09404b565c9b5355d37e455e1cfccf7c91222a68daa100039728907b5e2f658697529c0105fe02ca72a8653e994ce177bc32a07db23a565bc49dbcfaad214f1b7ca88a47ce463d35b607402c949e6217e3fe857d9c0f2939abdf8a814441b38c64ebad2b5c11e549b1a438b6f2a41b07dd6ec0fbf13abb12d4ff47294fe033d853b3e070ca6abc77150e2ef5d0105dd930efe153c7ff58be1a4df2953f77f9a4eb7915dca5568d105456489ec9b02abf344fdcb9d28475ea6ece521507f16de39ca48689b1c49d7722290e6654f2da4a8e9ff43b25297eaa3b62938100f0d8cf3dea5658574d25ee8ed5839b4de1fe69411526e254dabf08b98607ca10cd3fbee0bcc1f268bdbeb4a7d6d45a07257de4cff9039bc02cb0a77523dbf3aacbddf05539d8be5bdbe212933a95f6445a0fccafac778884070e43d94445c79eb3c0dd3cedac0ff20b38a218da9417ec6c436b46cb6bd5ea11da9ba33eecd28a8936f23f71b222e9c672da255c53dd138c413ebf45d4e79bbc1e0d62a3d88a44641379f70282c4d26fcf5be574f770190ea67818a58472290f51821a8fdf015f0985a30ce222d002c7e1e0766af390935306a99567ea9da54347c43c73086b88a3ea9fdf59eb304fc5a1ee42d779aafa352bf1626a401996900819d45231ce0dacaf99e3ee4f47ef686d3418b8f446c9c1a616fdadd963bcc5780b38076b64598a9ae06b4a3bf39712eab21a285961a6fbf266056ab7d"}}, &(0x7f0000001940)) r1 = io_uring_setup(0x178e, &(0x7f0000000140)={0x0, 0x79a9, 0x1, 0xffff7ffb, 0x10000b, 0x0, r0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r2, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, &(0x7f0000000080)={0x3, &(0x7f0000000340)=[{}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @link_local}]}) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) unshare(0x2a020480) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 346.791738ms ago: executing program 0 (id=1505): setresuid(0x0, 0xee00, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000001040)=ANY=[@ANYBLOB="b7050000000100007910a800000000001d50000000000000950000000000b000dad0ae437202fe29729e5361e283f4c4ddf4f91558ee5ce40394c5f0063281d106d9692809f9019b91aa47941e12669ec84cb12e51a175b929b9eb3ed662fd9448d2cf8c101279664c6e0e70869cd88420cb289b7fdbd62b760fd36c31a0919c482808100058572aea56c1b636001f34db40ee898d88ee30e8942a975c7806f0cfb12f6127edd280f96e41d54100b2ced86c59bb6524d0d985c6eaef2ea15d1ceadcf5cdde89b6c76ea58af225f8a9c763767491566c6a3627011463fb7267715090bc94407ad0962476b14a851594175b41576cbd060faa5ae19d1d433bad4e5aa7f338f511028103bf634e003cce56be57cd177878f429"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0xfffffffffffffe1e}, 0x2a) 289.110195ms ago: executing program 0 (id=1506): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000380)={0x36a, 0x78, 0x300, 0x0, 0xa, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3e}, {}, {}, {}, 0x0, 0x40, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) 288.902235ms ago: executing program 4 (id=1507): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$packet(0x11, 0x1, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031600d3fc140000004788031c09103328", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_WAIT_FOR_RESUME(r4, 0x5523) ioctl$USBDEVFS_FORBID_SUSPEND(r4, 0x5521) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="58000000020603000000000000000000070000000c00078008000640000000000500010006000000050005000200000005000400000000100900020073797a310000000014000300686173683a69702c706f72742c697000"], 0x58}, 0x1, 0x0, 0x0, 0x810}, 0x20004090) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0x7, &(0x7f0000000000), 0x4) writev(r0, &(0x7f0000001180)=[{&(0x7f00000011c0)="273eebfef2f171d6b26b0e923301b61c42cb1dff56bac3c6a0b7b95c", 0x1c}], 0x1) mprotect(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1000001) 288.821385ms ago: executing program 0 (id=1508): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffe0900010073797a30000100002c000000030a01020000000000000000010000000900030073797a31000000000900010073797a30000000007c000000060a010400000000000000000100000008000b40000000000900010073797a30000000005400048010000180080001"], 0xf0}, 0x1, 0x80000}, 0x0) 288.578299ms ago: executing program 2 (id=1509): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0xff80, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x5, 0x0, 0xfffe, 0xa}, {0x6, 0x3, 0x1, 0x0, 0x0, 0x2}, {0x0, 0x1400000003, 0x800009d8}, 0xfffffffe, 0x0, 0x1, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x2, 0x6c}, 0x2, @in6=@local, 0x0, 0x2, 0x0, 0x4, 0x0, 0xfffffffe, 0x200000}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x64004081}, 0x0) 199.978582ms ago: executing program 2 (id=1510): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x3c, &(0x7f00000001c0)={0x2, {{0xa, 0x4e20, 0x4, @mcast1, 0x39}}, {{0xa, 0x4e22, 0x6, @mcast2, 0x4}}}, 0x108) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) r1 = creat(&(0x7f0000000040)='./mnt/file0\x00', 0x8) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x6c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x6}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x11}]}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0xffffffff}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x1d}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x5}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x3}, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x9}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x7}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8080}, 0x80) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x40086610, 0x0) 129.843312ms ago: executing program 0 (id=1511): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00070800010000000000140008004500003c000028004084ca2502020202ac14000104d2321000000000000000000100001c11223344000800000005000500000005c0040008"], 0x4a) 129.528886ms ago: executing program 2 (id=1512): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="300000003f0007012bbd700000000000017c00000400fc800c00018005b41918", @ANYRES32=r0, @ANYBLOB="0c0002"], 0x30}, 0x1, 0x0, 0xe4, 0x2000c800}, 0x4040) 129.383212ms ago: executing program 0 (id=1513): r0 = syz_io_uring_setup(0x4f08, &(0x7f0000000400)={0x0, 0x8b0e, 0x40000, 0x3, 0x800000c6}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f00000000c0)=0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5, 0x4, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_FUTEX_WAKE={0x34, 0x0, 0x0, 0xe, 0x7, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x5}}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='binder\x00', 0x18021, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r8 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000000c0)='addr\x00', &(0x7f0000000100)='127.0.0.1\x00', 0x0) r9 = socket(0x10, 0x3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000000)={0x40000001}, 0x10) write(r9, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000140)='vers\x00', &(0x7f0000000180)='3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000001c0)='proto\x00', &(0x7f0000000200)='tcp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000240)='mountproto\x00', &(0x7f0000000280)='tcp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000002c0)='po\x8ft\x10', &(0x7f0000000300)='2049\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000340)='mountport\x00', &(0x7f0000000380)='2049\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000003c0)='nconnect\x00', &(0x7f0000000400)='2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000440)={0x2}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {0x7}, {0x10, 0x4}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x88c4) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'syzkaller0\x00'}) 60.188686ms ago: executing program 2 (id=1514): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000002f00090027bd9f0000000000040000000c0018003fac0f000bac0f"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x4) 59.969353ms ago: executing program 2 (id=1515): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="300300002100010029bd7000fbdbdf2500000000000000000000000000000001fe880000000000000000fa91d04e210004020080403200"/64, @ANYRES32, @ANYRES32, @ANYBLOB="b66b6e00020000001c00040002004e224e23000000000000000000000a00000000000000ef0014006e68706f6c79313330352d6e656f6e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018050000800100006bb7afe1dc317d61dbafa1bdab6236f633531a73753276682d54e0da67f60f05e80aad359ce584c5dd8b37a27f66107aef37be2eb3a96a938450987a7337b094121a9dc8481394c734ee9f6d5933f36670af337e3906e2d3c3bf0127bd8718422ee29be040ea316d43cc6bd418ff65a87ecb106356e20a15ed5a06fc5e750f020cc22cc5e8f1f9e5cc114c1e25b16832b0f1985c86efcdb8b0e1aef5a5e7a6f8fc410e0008001f0003000000cc0111"], 0x330}}, 0x0) 0s ago: executing program 2 (id=1516): ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000440)={@local, 0x1}) ioctl$VIDIOC_S_AUDIO(0xffffffffffffffff, 0x40345622, &(0x7f0000000140)={0x7, "21a50716ca6fceb02dcf9d18052be51e251cf0421a583745d048023943b5c2e0", 0x1, 0x1}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x26, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x355, 0xe1, 0x6, 0xfc000004, 0x40403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x4, 0x2, 0x2, 0x7, 0x489, 0x20, 0x3, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x92cee5b, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x6, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x110000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10003, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1001005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0xd]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000400)={0x0, &(0x7f0000000280)=[@nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_vmresume={0x130, 0x18, 0x1}, @rdmsr={0x66, 0x18, {0x2a1}}, @uexit={0x0, 0x18, 0x7}, @wr_crn={0x67, 0x20, {0x3, 0x8000}}, @code={0xa, 0x56, {"440f06410f6a680a672e66410f79c6650f01c466baf80cb894245783ef66bafc0c66ed8122f59000000f01780066ba410066b8f60066ef470f78a60d00000066b881008ec0"}}, @wr_crn={0x67, 0x20, {0x2, 0x6}}, @uexit={0x0, 0x18, 0x1ff}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_clgi={0x17f, 0x10}, @set_irq_handler={0xc8, 0x20, {0x47}}, @nested_amd_clgi={0x17f, 0x10}], 0x15e}) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_clone(0x91a0200, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)="24ab3f9fadf08a2bff49ec2208104e0c6339b39cda51a6b76683d93f1ad6a9b71cb8184fda55") r5 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x40042) write$binfmt_aout(r5, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x125) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x13, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) kernel console output (not intermixed with test programs): .618815][ T6829] RAX: ffffffffffffffda RBX: 00007f1f5e86f6c0 RCX: 00007f1f5d95e98e [ 409.618825][ T6829] RDX: 0000000000000001 RSI: 00007f1f5e86f0a0 RDI: 0000000000000004 [ 409.618833][ T6829] RBP: 00007f1f5e86f090 R08: 0000000000000000 R09: 0000000000000000 [ 409.618842][ T6829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 409.618850][ T6829] R13: 00007f1f5dc26038 R14: 00007f1f5dc25fa0 R15: 00007ffcc680e328 [ 409.618870][ T6829] [ 409.858042][ T6843] binder: BINDER_SET_CONTEXT_MGR already set [ 409.858051][ T6843] binder: 6842:6843 ioctl 4018620d 200000000240 returned -16 [ 409.859191][ T6843] binder: BINDER_SET_CONTEXT_MGR already set [ 409.859197][ T6843] binder: 6842:6843 ioctl 4018620d 200000000040 returned -16 [ 409.889773][ T6845] vlan2: entered promiscuous mode [ 409.889787][ T6845] batadv0: entered promiscuous mode [ 409.889888][ T6845] vlan2: entered allmulticast mode [ 409.889896][ T6845] batadv0: entered allmulticast mode [ 409.896525][ T5792] Bluetooth: hci3: unexpected event for opcode 0x0c14 [ 410.146800][ T6873] xt_CT: No such helper "syz1" [ 410.178368][ T6876] syzkaller0: entered promiscuous mode [ 410.178381][ T6876] syzkaller0: entered allmulticast mode [ 410.179961][ T6876] tipc: Enabled bearer , priority 0 [ 410.180624][ T6875] tipc: Resetting bearer [ 410.189403][ T6875] tipc: Disabling bearer [ 410.274570][ T6871] erspan0: entered promiscuous mode [ 410.301449][ T6881] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 410.380600][ T6885] netlink: 'syz.1.307': attribute type 7 has an invalid length. [ 410.380612][ T6885] netlink: 'syz.1.307': attribute type 8 has an invalid length. [ 410.513816][ T6905] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 411.016728][ T6978] vlan2: entered promiscuous mode [ 411.016828][ T6978] vlan2: entered allmulticast mode [ 411.222224][ T6992] xt_CT: No such helper "syz1" [ 411.235336][ T6997] input: syz1 as /devices/virtual/input/input5 [ 411.259873][ T5800] udevd[5800]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 411.268856][ T6999] syzkaller0: entered promiscuous mode [ 411.268872][ T6999] syzkaller0: entered allmulticast mode [ 411.271341][ T6999] tipc: Enabled bearer , priority 10 [ 411.272383][ T6998] tipc: Resetting bearer [ 411.292094][ T6998] tipc: Disabling bearer [ 411.550367][ T7008] erspan0: entered promiscuous mode [ 411.654203][ T5892] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 411.769954][ T7040] __nla_validate_parse: 18 callbacks suppressed [ 411.769972][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.770011][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.798754][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.798785][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.835169][ T5892] usb 7-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 411.835991][ T5892] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 411.836014][ T5892] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.838214][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.838260][ T7040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 411.849196][ T5892] keyspan 7-1:1.0: Keyspan 2 port adapter converter detected [ 411.853170][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 81 [ 411.853227][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 1 [ 411.869437][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 84 [ 411.869517][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 411.877530][ T5892] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 411.884410][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 88 [ 411.884472][ T5892] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 6 [ 411.886252][ T5892] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 412.047431][ T7012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.047711][ T7012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.048208][ T7012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.051507][ T7012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.052130][ T7012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.052700][ T7012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.055440][ T7012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.060068][ T7012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.060846][ T7012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.061190][ T7012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.081939][ T5934] usb 7-1: USB disconnect, device number 4 [ 412.096831][ T5934] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 412.099160][ T5934] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 412.099465][ T5934] keyspan 7-1:1.0: device disconnected [ 412.500706][ T7064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.374'. [ 412.644529][ T7073] input: syz0 as /devices/virtual/input/input6 [ 412.652644][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.653511][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.653676][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.653835][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.655492][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.655747][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.655905][ T7075] netlink: 'syz.0.377': attribute type 83 has an invalid length. [ 412.727491][ T7079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.378'. [ 412.830840][ T7089] 8021q: adding VLAN 0 to HW filter on device bond1 [ 412.840403][ T7089] bond1: (slave geneve2): making interface the new active one [ 412.841474][ T7089] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 412.864463][ T13] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 412.864488][ T13] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 412.864506][ T13] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 412.864523][ T13] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 413.013267][ T5967] libceph: connect (1)[c::]:6789 error -101 [ 413.013444][ T5967] libceph: mon0 (1)[c::]:6789 connect error [ 413.020976][ T5967] libceph: connect (1)[c::]:6789 error -101 [ 413.022712][ T5967] libceph: mon0 (1)[c::]:6789 connect error [ 413.045776][ T7103] ceph: No mds server is up or the cluster is laggy [ 413.146427][ T7114] xt_CT: No such helper "syz1" [ 413.245952][ T5892] net_ratelimit: 9 callbacks suppressed [ 413.245965][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.915521][ T7132] syzkaller0: entered promiscuous mode [ 413.915534][ T7132] syzkaller0: entered allmulticast mode [ 413.917108][ T7132] tipc: Started in network mode [ 413.917122][ T7132] tipc: Node identity 3e6b73feeedd, cluster identity 4711 [ 413.917234][ T7132] tipc: Enabled bearer , priority 3 [ 413.917993][ T7131] tipc: Resetting bearer [ 413.928010][ T7131] tipc: Disabling bearer [ 414.033071][ T7134] validate_nla: 27 callbacks suppressed [ 414.033083][ T7134] netlink: 'syz.0.394': attribute type 2 has an invalid length. [ 414.041443][ T7134] ´: entered promiscuous mode [ 414.072739][ T7138] netlink: Unknown conntrack attr (0) [ 414.106414][ T7145] EXT4-fs warning (device sda1): verify_group_input:136: Cannot add at group 4294967295 (only 8 groups) [ 414.117302][ T7146] syz.0.398 (7146): attempted to duplicate a private mapping with mremap. This is not supported. [ 414.150885][ T5799] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 414.154972][ T5799] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 414.155435][ T5799] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 414.156901][ T5799] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 414.157227][ T5799] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 414.193519][ T7160] netlink: 12 bytes leftover after parsing attributes in process `syz.0.402'. [ 414.279823][ T43] kauditd_printk_skb: 53 callbacks suppressed [ 414.279835][ T43] audit: type=1400 audit(1789016050.078:460): avc: denied { write } for pid=7170 comm="syz.2.405" name="/" dev="9p" ino=82837537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 414.283193][ T43] audit: type=1400 audit(1789016050.078:461): avc: denied { write } for pid=7170 comm="syz.2.405" name="blkio.bfq.io_service_time_recursive" dev="9p" ino=82837727 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 414.284347][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.307033][ T7177] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 414.504958][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.508191][ T7197] binder: BINDER_SET_CONTEXT_MGR already set [ 414.508205][ T7197] binder: 7196:7197 ioctl 4018620d 200000000100 returned -16 [ 414.509862][ T7197] binder: BINDER_SET_CONTEXT_MGR already set [ 414.509872][ T7197] binder: 7196:7197 ioctl 4018620d 2000000002c0 returned -16 [ 414.556816][ T7149] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.556907][ T7149] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.556994][ T7149] bridge_slave_0: entered allmulticast mode [ 414.557801][ T7149] bridge_slave_0: entered promiscuous mode [ 414.558977][ T7149] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.559041][ T7149] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.559120][ T7149] bridge_slave_1: entered allmulticast mode [ 414.559827][ T7149] bridge_slave_1: entered promiscuous mode [ 414.577496][ T43] audit: type=1400 audit(1789016050.378:462): avc: denied { append } for pid=7204 comm="syz.2.409" name="sda1" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 414.597840][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.608984][ T7149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.611840][ T7149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.625381][ T7149] team0: Port device team_slave_0 added [ 414.628381][ T7149] team0: Port device team_slave_1 added [ 414.642006][ T7149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 414.642015][ T7149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 414.642027][ T7149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 414.643699][ T7149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 414.643706][ T7149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 414.643718][ T7149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 414.649537][ T7214] binder: BINDER_SET_CONTEXT_MGR already set [ 414.649544][ T7214] binder: 7213:7214 ioctl 4018620d 200000000100 returned -16 [ 414.687975][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.707384][ T7149] hsr_slave_0: entered promiscuous mode [ 414.708209][ T7149] hsr_slave_1: entered promiscuous mode [ 414.783251][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.884825][ T7149] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 414.887415][ T7149] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 414.887989][ T7149] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 414.891222][ T7149] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 414.892017][ T7149] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 414.895236][ T7149] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 414.895579][ T7149] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 414.900263][ T7149] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 414.943721][ T7149] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.943771][ T7149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.943939][ T7149] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.943988][ T7149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 414.962718][ T13] bridge_slave_1: left allmulticast mode [ 414.962733][ T13] bridge_slave_1: left promiscuous mode [ 414.962825][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.965569][ T13] bridge_slave_0: left allmulticast mode [ 414.965582][ T13] bridge_slave_0: left promiscuous mode [ 414.965760][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.002045][ T7241] netlink: 4 bytes leftover after parsing attributes in process `syz.2.415'. [ 415.049395][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 415.050848][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 415.051668][ T13] bond0 (unregistering): Released all slaves [ 415.066535][ T6026] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.066930][ T6026] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.100088][ T13] tipc: Left network mode [ 415.166862][ T7149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.176696][ T43] audit: type=1400 audit(1789016050.978:463): avc: denied { read write } for pid=7249 comm="syz.0.418" name="sg1" dev="devtmpfs" ino=726 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 415.188569][ T7248] usb usb8: usbfs: process 7248 (syz.2.417) did not claim interface 0 before use [ 415.190169][ T7149] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.198298][ T43] audit: type=1400 audit(1789016050.998:464): avc: denied { create } for pid=7247 comm="syz.2.417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 415.201558][ T6026] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.201669][ T6026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.203731][ T7253] loop0: detected capacity change from 0 to 3904 [ 415.212160][ T43] audit: type=1400 audit(1789016051.008:465): avc: denied { write } for pid=7246 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 415.269283][ T43] audit: type=1400 audit(1789016051.068:466): avc: denied { create } for pid=7259 comm="syz.1.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 415.269639][ T43] audit: type=1400 audit(1789016051.068:467): avc: denied { write } for pid=7259 comm="syz.1.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 415.273863][ T6026] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.273909][ T6026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.276413][ T43] audit: type=1400 audit(1789016051.078:468): avc: denied { write } for pid=7255 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 415.314065][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2 [ 415.334265][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.359883][ T13] hsr_slave_0: left promiscuous mode [ 415.366583][ T13] hsr_slave_1: left promiscuous mode [ 415.367289][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 415.367305][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 415.372535][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 415.372549][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 415.374854][ T7272] jffs2: notice: (7272) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 415.391578][ T13] veth1_macvtap: left promiscuous mode [ 415.391609][ T13] veth0_macvtap: left promiscuous mode [ 415.391657][ T13] veth1_vlan: left promiscuous mode [ 415.391696][ T13] veth0_vlan: left promiscuous mode [ 415.405687][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.491826][ T43] audit: type=1400 audit(1789016051.288:469): avc: denied { bind } for pid=7287 comm="syz.1.431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 415.542908][ T13] team0 (unregistering): Port device team_slave_1 removed [ 415.550250][ T13] team0 (unregistering): Port device team_slave_0 removed [ 415.606944][ T7299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.613558][ T7299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.641127][ T7291] syzkaller0: entered promiscuous mode [ 415.641140][ T7291] syzkaller0: entered allmulticast mode [ 415.642605][ T7291] tipc: Enabled bearer , priority 10 [ 415.644062][ T7290] tipc: Resetting bearer [ 415.665529][ T7290] tipc: Disabling bearer [ 415.822719][ T7319] netlink: 'syz.2.437': attribute type 7 has an invalid length. [ 415.822732][ T7319] netlink: 'syz.2.437': attribute type 8 has an invalid length. [ 415.825386][ T7319] bond0: entered promiscuous mode [ 415.825399][ T7319] bond_slave_0: entered promiscuous mode [ 415.825524][ T7319] bond_slave_1: entered promiscuous mode [ 415.826397][ T7319] bridge0: entered promiscuous mode [ 415.826779][ T7319] gretap0: entered promiscuous mode [ 415.827247][ T7319] debugfs: 'hsr1' already exists in 'hsr' [ 415.827258][ T7319] Cannot create hsr debugfs directory [ 415.832288][ T5441] 8021q: adding VLAN 0 to HW filter on device eth3 [ 415.837739][ T7149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 415.977860][ T5441] 8021q: adding VLAN 0 to HW filter on device eth4 [ 415.978059][ T7149] veth0_vlan: entered promiscuous mode [ 415.984383][ T7149] veth1_vlan: entered promiscuous mode [ 415.997948][ T7149] veth0_macvtap: entered promiscuous mode [ 416.000476][ T7149] veth1_macvtap: entered promiscuous mode [ 416.009541][ T7149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 416.012849][ T7149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 416.080545][ T6026] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 416.080565][ T6026] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 416.101783][ T6026] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 416.101795][ T6026] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 416.117360][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.117428][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.117457][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.117486][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.143553][ T5441] 8021q: adding VLAN 0 to HW filter on device eth5 [ 416.204496][ T5792] Bluetooth: hci4: command tx timeout [ 416.281619][ T7377] xt_l2tp: wrong L2TP version: 4 [ 416.292818][ T7349] infiniband syz2: set active [ 416.292836][ T7349] infiniband syz2: added bridge0 [ 416.309078][ T7349] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 416.309099][ T7349] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 416.309120][ T7349] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 416.338745][ T7349] RDS/IB: syz2: added [ 416.338922][ T7349] smc: adding ib device syz2 with port count 1 [ 416.338969][ T7349] smc: ib device syz2 port 1 has no pnetid [ 416.366235][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.503348][ T7394] vlan2: entered promiscuous mode [ 416.503361][ T7394] batadv0: entered promiscuous mode [ 416.503436][ T7394] vlan2: entered allmulticast mode [ 416.503444][ T7394] batadv0: entered allmulticast mode [ 416.638057][ T5892] libceph: connect (1)[c::]:6789 error -101 [ 416.638211][ T5892] libceph: mon0 (1)[c::]:6789 connect error [ 416.675947][ T7407] ceph: No mds server is up or the cluster is laggy [ 416.730372][ T7419] loop0: detected capacity change from 0 to 3904 [ 416.803870][ T7436] netlink: 'syz.1.471': attribute type 21 has an invalid length. [ 416.803886][ T7436] IPv6: NLM_F_CREATE should be specified when creating new route [ 416.803927][ T7436] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 416.803932][ T7436] IPv6: NLM_F_CREATE should be set when creating new route [ 416.803950][ T7436] IPv6: NLM_F_CREATE should be set when creating new route [ 416.803961][ T7436] IPv6: NLM_F_CREATE should be set when creating new route [ 416.808030][ T7436] netlink: 'syz.1.471': attribute type 21 has an invalid length. [ 416.808104][ T7436] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 416.820925][ T7439] netlink: 'syz.0.472': attribute type 12 has an invalid length. [ 416.874926][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.874951][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.874971][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.874988][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.046300][ T7465] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=93 sclass=netlink_xfrm_socket pid=7465 comm=syz.1.481 [ 417.098617][ T7476] jffs2: notice: (7476) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 417.193283][ T7494] netlink: Unknown conntrack attr (0) [ 417.208078][ T7497] netlink: 'syz.2.491': attribute type 1 has an invalid length. [ 417.221775][ T7497] 8021q: adding VLAN 0 to HW filter on device bond2 [ 417.341153][ T7512] __nla_validate_parse: 13 callbacks suppressed [ 417.341167][ T7512] netlink: 28 bytes leftover after parsing attributes in process `syz.1.496'. [ 417.341183][ T7512] netlink: 'syz.1.496': attribute type 7 has an invalid length. [ 417.341190][ T7512] netlink: 'syz.1.496': attribute type 8 has an invalid length. [ 417.341197][ T7512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.496'. [ 417.382890][ T5872] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.387359][ T7509] netlink: 8 bytes leftover after parsing attributes in process `syz.0.495'. [ 417.405195][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.559936][ T7522] loop0: detected capacity change from 0 to 1 [ 417.596923][ T7522] ldm_validate_privheads(): Disk read failed. [ 417.596978][ T7522] loop0: [ 417.596992][ T7522] loop0: partition table partially beyond EOD, truncated [ 417.676459][ T7526] netlink: 8 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.676473][ T7526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.676487][ T7526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.715235][ T7526] netlink: 8 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.715249][ T7526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.715263][ T7526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.500'. [ 417.748337][ T7529] netlink: 12 bytes leftover after parsing attributes in process `syz.4.501'. [ 417.860697][ T7541] netlink: 'syz.4.507': attribute type 39 has an invalid length. [ 417.917475][ T7542] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 417.974799][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.284551][ T5792] Bluetooth: hci4: command tx timeout [ 418.445046][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.448391][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.525679][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.545936][ T7594] syzkaller0: entered promiscuous mode [ 418.545955][ T7594] syzkaller0: entered allmulticast mode [ 418.842330][ T7608] vlan2: entered promiscuous mode [ 418.842426][ T7608] vlan2: entered allmulticast mode [ 418.877320][ T7606] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.877431][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.881991][ T7606] JFS: charset not found [ 419.003384][ T7617] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 419.073799][ T7625] binder: BINDER_SET_CONTEXT_MGR already set [ 419.073809][ T7625] binder: 7622:7625 ioctl 4018620d 200000000100 returned -16 [ 419.190413][ T7637] loop0: detected capacity change from 0 to 3904 [ 419.311204][ T7662] netlink: 'syz.1.553': attribute type 21 has an invalid length. [ 419.337845][ T7668] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 419.337860][ T7668] overlayfs: missing 'lowerdir' [ 419.341518][ T43] kauditd_printk_skb: 35 callbacks suppressed [ 419.341528][ T43] audit: type=1400 audit(1789016055.138:505): avc: denied { setopt } for pid=7666 comm="syz.1.556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 419.396559][ T43] audit: type=1400 audit(1789016055.198:506): avc: denied { write } for pid=7677 comm="syz.4.560" name="rtc0" dev="devtmpfs" ino=942 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 419.407940][ T43] audit: type=1400 audit(1789016055.208:507): avc: denied { create } for pid=7679 comm="syz.2.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 419.408385][ T43] audit: type=1400 audit(1789016055.208:508): avc: denied { setopt } for pid=7679 comm="syz.2.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 419.413117][ T43] audit: type=1400 audit(1789016055.208:509): avc: denied { append } for pid=7677 comm="syz.4.560" name="card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 419.413303][ T7684] netlink: Unknown conntrack attr (0) [ 419.413754][ T43] audit: type=1400 audit(1789016055.208:510): avc: denied { getopt } for pid=7677 comm="syz.4.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 419.415968][ T43] audit: type=1400 audit(1789016055.208:511): avc: denied { ioctl } for pid=7677 comm="syz.4.560" path="/dev/rtc0" dev="devtmpfs" ino=942 ioctlcmd=0x700a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 419.466918][ T7686] netlink: 'syz.1.563': attribute type 7 has an invalid length. [ 419.466931][ T7686] netlink: 'syz.1.563': attribute type 8 has an invalid length. [ 419.485325][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.490739][ T7694] loop0: detected capacity change from 0 to 1 [ 419.525903][ T7696] netlink: 'syz.4.567': attribute type 30 has an invalid length. [ 419.526301][ T7696] netlink: 'syz.4.567': attribute type 30 has an invalid length. [ 419.578452][ T7694] ldm_validate_privheads(): Disk read failed. [ 419.580147][ T7694] loop0: [ 419.580168][ T7694] loop0: partition table partially beyond EOD, truncated [ 419.631420][ T7704] TC_ACT_REPEAT abuse ? [ 419.635272][ T43] audit: type=1326 audit(1789016055.438:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7703 comm="syz.4.569" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7d1dd9e159 code=0x0 [ 419.669182][ T43] audit: type=1400 audit(1789016055.468:513): avc: denied { write } for pid=7709 comm="syz.1.572" name="/" dev="9p" ino=82837537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 419.852930][ T43] audit: type=1400 audit(1789016055.648:514): avc: denied { getopt } for pid=7720 comm="syz.1.573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 419.950123][ T7726] FAULT_INJECTION: forcing a failure. [ 419.950123][ T7726] name fail_futex, interval 1, probability 0, space 0, times 1 [ 419.950143][ T7726] CPU: 3 UID: 0 PID: 7726 Comm: syz.0.578 Not tainted syzkaller #0 PREEMPT(full) [ 419.950155][ T7726] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 419.950162][ T7726] Call Trace: [ 419.950166][ T7726] [ 419.950171][ T7726] dump_stack_lvl+0x100/0x190 [ 419.950200][ T7726] should_fail_ex.cold+0x5/0xa [ 419.950215][ T7726] get_futex_key+0x1d0/0x14f0 [ 419.950232][ T7726] ? __pfx_get_futex_key+0x10/0x10 [ 419.950245][ T7726] ? __pfx_futex_hash+0x10/0x10 [ 419.950258][ T7726] ? get_pid_task+0xfc/0x250 [ 419.950289][ T7726] ? get_pid_task+0xfc/0x250 [ 419.950306][ T7726] futex_wake+0xf4/0x5e0 [ 419.950322][ T7726] ? futex_wait+0x11e/0x370 [ 419.950339][ T7726] ? find_held_lock+0x2b/0x80 [ 419.950354][ T7726] ? __pfx_futex_wake+0x10/0x10 [ 419.950377][ T7726] ? rcu_read_lock_any_held+0x6a/0x90 [ 419.950394][ T7726] ? find_held_lock+0x2b/0x80 [ 419.950409][ T7726] ? ksys_write+0x190/0x250 [ 419.950423][ T7726] ? ksys_write+0x190/0x250 [ 419.950436][ T7726] do_futex+0x2b2/0x440 [ 419.950451][ T7726] ? __pfx_do_futex+0x10/0x10 [ 419.950466][ T7726] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 419.950487][ T7726] __x64_sys_futex+0x34f/0x4d0 [ 419.950504][ T7726] ? __pfx___x64_sys_futex+0x10/0x10 [ 419.950518][ T7726] ? __task_pid_nr_ns+0x1ca/0x510 [ 419.950532][ T7726] ? __task_pid_nr_ns+0x1ca/0x510 [ 419.950551][ T7726] do_syscall_64+0x123/0x790 [ 419.950567][ T7726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.950578][ T7726] RIP: 0033:0x7f27c979e159 [ 419.950587][ T7726] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.950598][ T7726] RSP: 002b:00007f27ca7110e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 419.950609][ T7726] RAX: ffffffffffffffda RBX: 00007f27c9a26098 RCX: 00007f27c979e159 [ 419.950616][ T7726] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f27c9a2609c [ 419.950623][ T7726] RBP: 00007f27c9a26090 R08: 0000000000000001 R09: 0000000000000000 [ 419.950629][ T7726] R10: 000000000000015d R11: 0000000000000246 R12: 0000000000000000 [ 419.950635][ T7726] R13: 00007f27c9a26128 R14: 00007ffd37c12160 R15: 00007ffd37c12248 [ 419.950649][ T7726] [ 420.272815][ T7746] process 'syz.2.586' launched '/dev/fd/6' with NULL argv: empty string added [ 420.307868][ T7748] zonefs (loop2) ERROR: Not a zoned block device [ 420.309626][ T5792] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 420.309778][ T5792] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 420.374956][ T5792] Bluetooth: hci4: command tx timeout [ 420.483972][ T7758] openvswitch: netlink: IP tunnel dst address not specified [ 420.489889][ T7757] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7757 comm=syz.2.591 [ 420.541568][ T1480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.653171][ T7770] netlink: 'syz.2.595': attribute type 12 has an invalid length. [ 420.667503][ T7772] netlink: 'syz.4.596': attribute type 4 has an invalid length. [ 420.668453][ T7774] netlink: 'syz.4.596': attribute type 4 has an invalid length. [ 420.674508][ T5865] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.674551][ T5865] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.674574][ T5865] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.674593][ T5865] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.879397][ T7808] tmpfs: Bad value for 'mpol' [ 420.979793][ T7817] jffs2: notice: (7817) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 421.054279][ T5967] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 421.080854][ T7826] loop0: detected capacity change from 0 to 1 [ 421.128626][ T7826] ldm_validate_privheads(): Disk read failed. [ 421.128658][ T7826] loop0: [ 421.128667][ T7826] loop0: partition table partially beyond EOD, truncated [ 421.137148][ T5139] ldm_validate_privheads(): Disk read failed. [ 421.137196][ T5139] loop0: [ 421.137213][ T5139] loop0: partition table partially beyond EOD, truncated [ 421.217129][ T5967] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 421.218127][ T5967] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 421.218147][ T5967] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 421.218164][ T5967] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 421.218198][ T5967] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 421.218221][ T5967] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 421.219840][ T5967] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 421.219861][ T5967] usb 5-1: Product: syz [ 421.219881][ T5967] usb 5-1: Manufacturer: syz [ 421.250428][ T5967] cdc_wdm 5-1:1.0: skipping garbage [ 421.250446][ T5967] cdc_wdm 5-1:1.0: skipping garbage [ 421.258771][ T5967] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 421.258790][ T5967] cdc_wdm 5-1:1.0: Unknown control protocol [ 421.352120][ T7847] netlink: 'syz.4.625': attribute type 32 has an invalid length. [ 421.441406][ T1480] usb 5-1: USB disconnect, device number 6 [ 421.451079][ T7855] binder: BINDER_SET_CONTEXT_MGR already set [ 421.451088][ T7855] binder: 7854:7855 ioctl 4018620d 200000000100 returned -16 [ 421.452837][ T7855] binder: BINDER_SET_CONTEXT_MGR already set [ 421.452847][ T7855] binder: 7854:7855 ioctl 4018620d 2000000002c0 returned -16 [ 421.556889][ T7868] SELinux: Context system_u:object_r:getty_var_run_t:s0 is not valid (left unmapped). [ 421.744028][ T7876] vlan2: entered promiscuous mode [ 421.744042][ T7876] batadv0: entered promiscuous mode [ 421.744345][ T7876] vlan2: entered allmulticast mode [ 421.744368][ T7876] batadv0: entered allmulticast mode [ 421.834014][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.834036][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.927339][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.927376][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.996723][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.996747][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.000796][ T5799] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 422.010800][ T5799] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 422.014592][ T5799] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 422.017163][ T5799] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 422.018374][ T5799] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 422.095985][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.096006][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.222974][ T7901] xt_CT: No such helper "syz1" [ 422.293909][ T7912] loop0: detected capacity change from 0 to 3904 [ 422.330052][ T13] gretap0 (unregistering): left promiscuous mode [ 422.362575][ T13] bridge0 (unregistering): left promiscuous mode [ 422.373579][ T13] bond0 (unregistering): left promiscuous mode [ 422.389516][ T13] bond0 (unregistering): Released all slaves [ 422.405663][ T7916] netlink: 'syz.4.652': attribute type 12 has an invalid length. [ 422.445104][ T5799] Bluetooth: hci4: command tx timeout [ 422.471240][ T13] ´: left promiscuous mode [ 422.563668][ T13] tipc: Disabling bearer [ 422.571089][ T13] tipc: Left network mode [ 422.612597][ T7933] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 422.615426][ T5441] 8021q: adding VLAN 0 to HW filter on device eth6 [ 422.892995][ T5441] 8021q: adding VLAN 0 to HW filter on device eth7 [ 422.906001][ T7882] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.906074][ T7882] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.906135][ T7882] bridge_slave_0: entered allmulticast mode [ 422.909748][ T7882] bridge_slave_0: entered promiscuous mode [ 422.911152][ T7882] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.911192][ T7882] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.911244][ T7882] bridge_slave_1: entered allmulticast mode [ 422.911981][ T7882] bridge_slave_1: entered promiscuous mode [ 422.942847][ T7882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 422.959812][ T7882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 423.031224][ T7882] team0: Port device team_slave_0 added [ 423.033838][ T7882] team0: Port device team_slave_1 added [ 423.097115][ T7965] warning: `syz.0.663' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 423.136795][ T7882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 423.136812][ T7882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 423.136834][ T7882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 423.138387][ T7882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 423.138400][ T7882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 423.138421][ T7882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 423.179084][ T13] hsr_slave_0: left promiscuous mode [ 423.179500][ T13] hsr_slave_1: left promiscuous mode [ 423.183431][ T13] veth1_macvtap: left promiscuous mode [ 423.183450][ T13] veth0_macvtap: left promiscuous mode [ 423.183502][ T13] veth1_vlan: left promiscuous mode [ 423.183532][ T13] veth0_vlan: left promiscuous mode [ 423.448331][ T5441] 8021q: adding VLAN 0 to HW filter on device eth8 [ 423.474883][ T7882] hsr_slave_0: entered promiscuous mode [ 423.475307][ T7882] hsr_slave_1: entered promiscuous mode [ 423.475594][ T7882] debugfs: 'hsr0' already exists in 'hsr' [ 423.475606][ T7882] Cannot create hsr debugfs directory [ 423.640644][ T7882] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 423.642414][ T7882] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 423.642764][ T7882] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 423.657498][ T7882] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 423.657943][ T7882] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 423.661052][ T7882] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 423.661539][ T7882] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 423.663459][ T7882] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 423.690348][ T5441] 8021q: adding VLAN 0 to HW filter on device eth9 [ 423.728406][ T7882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 423.752296][ T7882] 8021q: adding VLAN 0 to HW filter on device team0 [ 423.759065][ T6026] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.759113][ T6026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 423.770301][ T6026] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.770371][ T6026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.054507][ T5799] Bluetooth: hci2: command tx timeout [ 424.057256][ T7882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 424.279468][ T8025] __nla_validate_parse: 24 callbacks suppressed [ 424.279487][ T8025] netlink: 4 bytes leftover after parsing attributes in process `syz.0.671'. [ 424.281973][ T8024] netlink: 4 bytes leftover after parsing attributes in process `syz.0.671'. [ 424.298464][ T7882] veth0_vlan: entered promiscuous mode [ 424.315306][ T7882] veth1_vlan: entered promiscuous mode [ 424.417762][ T7882] veth0_macvtap: entered promiscuous mode [ 424.421078][ T7882] veth1_macvtap: entered promiscuous mode [ 424.427988][ T7882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 424.429863][ T7882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 424.453662][ T8027] netlink: 8 bytes leftover after parsing attributes in process `syz.4.672'. [ 424.455819][ T43] kauditd_printk_skb: 27 callbacks suppressed [ 424.455835][ T43] audit: type=1400 audit(1789016060.238:542): avc: denied { getopt } for pid=8029 comm="syz.0.673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 424.495387][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.495599][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.495773][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.496051][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.516616][ T8027] erspan0: entered promiscuous mode [ 424.531903][ T6027] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.531922][ T6027] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.571982][ T6029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.572003][ T6029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.603801][ T43] audit: type=1400 audit(1789016060.398:543): avc: denied { setopt } for pid=8036 comm="syz.4.675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 424.605200][ T8037] syz.4.675 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 424.769456][ T8056] netlink: 4 bytes leftover after parsing attributes in process `syz.4.680'. [ 424.930449][ T8073] netlink: 68 bytes leftover after parsing attributes in process `syz.5.688'. [ 425.029561][ T43] audit: type=1400 audit(1789016060.828:544): avc: denied { create } for pid=8084 comm="syz.4.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 425.033519][ T8085] lo: entered allmulticast mode [ 425.040559][ T43] audit: type=1400 audit(1789016060.838:545): avc: denied { name_bind } for pid=8084 comm="syz.4.692" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 425.053827][ T8097] net_ratelimit: 3 callbacks suppressed [ 425.053842][ T8097] netlink: Unknown conntrack attr (0) [ 425.071468][ T8084] lo: left allmulticast mode [ 425.109886][ T8105] overlay: Unknown parameter 'smackfstransmute' [ 425.112890][ T43] audit: type=1400 audit(1789016060.908:546): avc: denied { watch watch_reads } for pid=8104 comm="syz.4.696" path="/64/bus" dev="tmpfs" ino=351 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 425.122382][ T8105] ip6tnl1: entered allmulticast mode [ 425.127098][ T5865] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.127226][ T5865] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.130701][ T43] audit: type=1400 audit(1789016060.928:547): avc: denied { write } for pid=8104 comm="syz.4.696" name="enable" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 425.145797][ T35] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.153337][ T8107] loop0: detected capacity change from 0 to 1 [ 425.217790][ T8107] ldm_validate_privheads(): Disk read failed. [ 425.217820][ T8107] loop0: [ 425.217829][ T8107] loop0: partition table partially beyond EOD, truncated [ 425.262239][ T43] audit: type=1400 audit(1789016061.058:548): avc: denied { accept } for pid=8114 comm="syz.5.702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 425.262569][ T43] audit: type=1400 audit(1789016061.058:549): avc: denied { listen } for pid=8114 comm="syz.5.702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 425.514157][ T35] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 425.534328][ T5892] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.674224][ T35] usb 10-1: Using ep0 maxpacket: 8 [ 425.674793][ T35] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 425.675611][ T35] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 425.675624][ T35] usb 10-1: config 0 has no interface number 0 [ 425.675641][ T35] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 425.675652][ T35] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 425.675664][ T35] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 425.675677][ T35] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 425.675696][ T35] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.678358][ T35] usb 10-1: config 0 descriptor?? [ 425.685448][ T35] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 425.884443][ T5892] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.949295][ T43] audit: type=1400 audit(1789016061.748:550): avc: denied { connect } for pid=8114 comm="syz.5.702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 425.952637][ T43] audit: type=1400 audit(1789016061.748:551): avc: denied { write } for pid=8114 comm="syz.5.702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 426.124291][ T5799] Bluetooth: hci2: command tx timeout [ 426.501421][ T1480] usb 10-1: USB disconnect, device number 2 [ 426.505635][ T1480] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 426.507140][ T8143] netlink: 12 bytes leftover after parsing attributes in process `syz.2.711'. [ 426.565622][ T8145] nvmet: adding nsid 1 to subsystem testsubsys [ 426.839061][ T8170] loop0: detected capacity change from 0 to 1 [ 426.888004][ T8170] ldm_validate_privheads(): Disk read failed. [ 426.888053][ T8170] loop0: [ 426.888067][ T8170] loop0: partition table partially beyond EOD, truncated [ 426.967512][ T8180] netlink: 32 bytes leftover after parsing attributes in process `syz.4.725'. [ 427.050944][ T8194] syzkaller0: entered promiscuous mode [ 427.050959][ T8194] syzkaller0: entered allmulticast mode [ 427.053077][ T8194] tipc: Enabled bearer , priority 10 [ 427.053739][ T8193] tipc: Resetting bearer [ 427.070321][ T8199] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.4128768.0), cmd(3) [ 427.084976][ T8193] tipc: Disabling bearer [ 427.327828][ T8234] netlink: 20 bytes leftover after parsing attributes in process `syz.4.743'. [ 427.406933][ T8241] geneve1: entered allmulticast mode [ 427.495044][ T8251] netlink: 68 bytes leftover after parsing attributes in process `syz.4.750'. [ 427.596026][ T8265] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8265 comm=syz.4.755 [ 427.628980][ T8273] sd 0:0:0:0: PR command failed: 1026 [ 427.629005][ T8273] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 427.629025][ T8273] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 427.668714][ T8281] netlink: 12 bytes leftover after parsing attributes in process `syz.2.761'. [ 427.730490][ T8287] netlink: 'syz.2.764': attribute type 1 has an invalid length. [ 427.762691][ T8287] 8021q: adding VLAN 0 to HW filter on device bond3 [ 427.845095][ T8287] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.845390][ T8287] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.903283][ T8304] netlink: 'syz.5.768': attribute type 1 has an invalid length. [ 427.907656][ T8287] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 427.915960][ T8287] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 427.998713][ T8287] geneve1: left allmulticast mode [ 428.048247][ T8287] ip6gre1: left promiscuous mode [ 428.048268][ T8287] ip6gre1: left allmulticast mode [ 428.071750][ T10] syz2: Port: 1 Link DOWN [ 428.078138][ T8306] macvlan2: entered promiscuous mode [ 428.078152][ T8306] macvlan2: entered allmulticast mode [ 428.078638][ T8306] bond3: entered promiscuous mode [ 428.079621][ T8306] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 428.080759][ T8306] bond3: left promiscuous mode [ 428.114299][ T12] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.114321][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.114334][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.114354][ T12] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.114367][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.114381][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.114398][ T12] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.114412][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.114425][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.114442][ T12] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.114455][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.114468][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.188989][ T8327] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 428.204696][ T5799] Bluetooth: hci2: command tx timeout [ 428.225094][ T8325] netlink: 'syz.4.772': attribute type 7 has an invalid length. [ 428.225113][ T8325] netlink: 'syz.4.772': attribute type 8 has an invalid length. [ 428.235652][ T8325] bond0: entered promiscuous mode [ 428.235666][ T8325] bond_slave_0: entered promiscuous mode [ 428.235769][ T8325] bond_slave_1: entered promiscuous mode [ 428.236708][ T8325] bridge0: entered promiscuous mode [ 428.237081][ T8325] gretap0: entered promiscuous mode [ 428.284668][ T8336] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 428.287216][ T8338] syzkaller0: entered promiscuous mode [ 428.287233][ T8338] syzkaller0: entered allmulticast mode [ 428.290304][ T8338] tipc: Enabled bearer , priority 10 [ 428.292303][ T8337] tipc: Resetting bearer [ 428.309556][ T8337] tipc: Disabling bearer [ 428.427481][ T8347] binder: BINDER_SET_CONTEXT_MGR already set [ 428.427491][ T8347] binder: 8346:8347 ioctl 4018620d 200000000100 returned -16 [ 428.429004][ T8347] binder: BINDER_SET_CONTEXT_MGR already set [ 428.429010][ T8347] binder: 8346:8347 ioctl 4018620d 2000000002c0 returned -16 [ 428.643716][ T8358] fuse: Bad value for 'fd' [ 428.934393][ C3] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 428.975631][ T8310] usb 10-1: new low-speed USB device number 3 using dummy_hcd [ 428.991703][ T8394] 9p: Bad value for 'debug' [ 429.138892][ T8310] usb 10-1: unable to get BOS descriptor or descriptor too short [ 429.138931][ T8310] usb 10-1: New USB device found, idVendor=1430, idProduct=6cdc, bcdDevice=85.cc [ 429.139994][ T8310] usb 10-1: config 8 has an invalid interface number: 198 but max is 0 [ 429.140012][ T8310] usb 10-1: config 8 has no interface number 0 [ 429.140039][ T8310] usb 10-1: config 8 interface 198 altsetting 0 endpoint 0xA has invalid maxpacket 1023, setting to 8 [ 429.142833][ T8310] usb 10-1: string descriptor 0 read error: -22 [ 429.142971][ T8310] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.146914][ T8365] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 429.351776][ T5879] usb 10-1: USB disconnect, device number 3 [ 429.464169][ T43] kauditd_printk_skb: 5281 callbacks suppressed [ 429.464187][ T43] audit: type=1326 audit(1789016065.258:5833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464276][ T43] audit: type=1326 audit(1789016065.268:5834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464342][ T43] audit: type=1326 audit(1789016065.268:5835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464408][ T43] audit: type=1326 audit(1789016065.268:5836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464472][ T43] audit: type=1326 audit(1789016065.268:5837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464558][ T43] audit: type=1326 audit(1789016065.268:5838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464624][ T43] audit: type=1326 audit(1789016065.268:5839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464700][ T43] audit: type=1326 audit(1789016065.268:5840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464765][ T43] audit: type=1326 audit(1789016065.268:5841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.464855][ T43] audit: type=1326 audit(1789016065.268:5842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.4.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1dd9e159 code=0x50000 [ 429.762778][ T8423] __nla_validate_parse: 8 callbacks suppressed [ 429.762791][ T8423] netlink: 8 bytes leftover after parsing attributes in process `syz.2.805'. [ 429.947993][ T8435] netlink: 12 bytes leftover after parsing attributes in process `syz.2.808'. [ 430.284664][ T5799] Bluetooth: hci2: command tx timeout [ 430.339521][ T8462] netlink: 28 bytes leftover after parsing attributes in process `syz.0.815'. [ 430.339554][ T8462] netlink: 'syz.0.815': attribute type 7 has an invalid length. [ 430.339567][ T8462] netlink: 'syz.0.815': attribute type 8 has an invalid length. [ 430.339580][ T8462] netlink: 4 bytes leftover after parsing attributes in process `syz.0.815'. [ 430.355831][ T8462] bridge0: entered promiscuous mode [ 430.356598][ T8462] syz_tun: entered promiscuous mode [ 430.357477][ T8462] gretap0: entered promiscuous mode [ 430.357984][ T8462] debugfs: 'hsr1' already exists in 'hsr' [ 430.357997][ T8462] Cannot create hsr debugfs directory [ 432.951175][ T8442] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 433.009746][ T8504] netlink: 'syz.0.833': attribute type 2 has an invalid length. [ 433.078855][ T5799] Bluetooth: hci2: unexpected event 0x04 length: 11 > 10 [ 433.326055][ T8569] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.326072][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.328040][ T8565] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.1040187392.0), cmd(3) [ 433.343946][ T8569] ip6erspan0: entered promiscuous mode [ 433.346506][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.347297][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.347610][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.347914][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.348322][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.348647][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.348966][ T8566] netlink: 'syz.0.851': attribute type 5 has an invalid length. [ 433.391361][ T8575] netlink: 12 bytes leftover after parsing attributes in process `syz.2.854'. [ 433.460451][ T8587] vivid-004: disconnect [ 433.541379][ T8608] 8021q: VLANs not supported on sit0 [ 433.541421][ T8608] 8021q: VLANs not supported on sit0 [ 433.541455][ T8608] 8021q: VLANs not supported on sit0 [ 433.541500][ T8608] 8021q: VLANs not supported on sit0 [ 433.541533][ T8608] 8021q: VLANs not supported on sit0 [ 433.541566][ T8608] 8021q: VLANs not supported on sit0 [ 433.541600][ T8608] 8021q: VLANs not supported on sit0 [ 433.541642][ T8608] 8021q: VLANs not supported on sit0 [ 433.541675][ T8608] 8021q: VLANs not supported on sit0 [ 433.541708][ T8608] 8021q: VLANs not supported on sit0 [ 433.541740][ T8608] 8021q: VLANs not supported on sit0 [ 433.541790][ T8608] 8021q: VLANs not supported on sit0 [ 433.541824][ T8608] 8021q: VLANs not supported on sit0 [ 433.541893][ T8608] 8021q: VLANs not supported on sit0 [ 433.541928][ T8608] 8021q: VLANs not supported on sit0 [ 433.541973][ T8608] 8021q: VLANs not supported on sit0 [ 433.542006][ T8608] 8021q: VLANs not supported on sit0 [ 433.542039][ T8608] 8021q: VLANs not supported on sit0 [ 433.542071][ T8608] 8021q: VLANs not supported on sit0 [ 433.542115][ T8608] 8021q: VLANs not supported on sit0 [ 433.542148][ T8608] 8021q: VLANs not supported on sit0 [ 433.542180][ T8608] 8021q: VLANs not supported on sit0 [ 433.542213][ T8608] 8021q: VLANs not supported on sit0 [ 433.542256][ T8608] 8021q: VLANs not supported on sit0 [ 433.542289][ T8608] 8021q: VLANs not supported on sit0 [ 433.542322][ T8608] 8021q: VLANs not supported on sit0 [ 433.542354][ T8608] 8021q: VLANs not supported on sit0 [ 433.542398][ T8608] 8021q: VLANs not supported on sit0 [ 433.542431][ T8608] 8021q: VLANs not supported on sit0 [ 433.542468][ T8608] 8021q: VLANs not supported on sit0 [ 433.542500][ T8608] 8021q: VLANs not supported on sit0 [ 433.542544][ T8608] 8021q: VLANs not supported on sit0 [ 433.542577][ T8608] 8021q: VLANs not supported on sit0 [ 433.595643][ T8623] netlink: 68 bytes leftover after parsing attributes in process `syz.0.863'. [ 433.630143][ T8629] loop0: detected capacity change from 0 to 1 [ 433.674468][ T8629] ldm_validate_privheads(): Disk read failed. [ 433.674498][ T8629] loop0: [ 433.674507][ T8629] loop0: partition table partially beyond EOD, truncated [ 433.732029][ T8642] netlink: 4 bytes leftover after parsing attributes in process `syz.5.870'. [ 433.997929][ T8677] netlink: 4 bytes leftover after parsing attributes in process `syz.0.879'. [ 434.007808][ T8595] vivid-004: reconnect [ 434.032890][ T8688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.884'. [ 434.074257][ T5865] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.074285][ T5865] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.074303][ T5865] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.074322][ T5865] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.138870][ T8706] netlink: 12 bytes leftover after parsing attributes in process `syz.0.891'. [ 434.257547][ T8738] kAFS: No cell specified [ 434.271652][ T8726] FAULT_INJECTION: forcing a failure. [ 434.271652][ T8726] name failslab, interval 1, probability 0, space 0, times 0 [ 434.271671][ T8726] CPU: 3 UID: 0 PID: 8726 Comm: syz.4.897 Not tainted syzkaller #0 PREEMPT(full) [ 434.271683][ T8726] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 434.271690][ T8726] Call Trace: [ 434.271694][ T8726] [ 434.271698][ T8726] dump_stack_lvl+0x100/0x190 [ 434.271752][ T8726] should_fail_ex.cold+0x5/0xa [ 434.271768][ T8726] should_failslab+0xc2/0x120 [ 434.271786][ T8726] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 434.271799][ T8726] ? copy_process+0x6a2/0x8370 [ 434.271814][ T8726] copy_process+0x6a2/0x8370 [ 434.271834][ T8726] ? __pfx_copy_process+0x10/0x10 [ 434.271846][ T8726] ? kasan_save_track+0x14/0x30 [ 434.271858][ T8726] ? __kasan_kmalloc+0xaa/0xb0 [ 434.271870][ T8726] ? lockdep_init_map_type+0x5c/0x250 [ 434.271885][ T8726] ? lockdep_init_map_type+0x5c/0x250 [ 434.271897][ T8726] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 434.271916][ T8726] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 434.271931][ T8726] vhost_task_create+0x1db/0x370 [ 434.271949][ T8726] ? __pfx_vhost_task_create+0x10/0x10 [ 434.271971][ T8726] ? __pfx_vhost_task_fn+0x10/0x10 [ 434.271989][ T8726] ? register_lock_class+0x3f/0x7b0 [ 434.272000][ T8726] ? rcu_is_watching+0x13/0xc0 [ 434.272015][ T8726] ? trace_contention_end+0x126/0x160 [ 434.272030][ T8726] kvm_mmu_post_init_vm+0x1b3/0x360 [ 434.272044][ T8726] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 434.272059][ T8726] ? __pfx___mutex_lock+0x10/0x10 [ 434.272077][ T8726] ? kasan_quarantine_put+0x104/0x240 [ 434.272090][ T8726] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 434.272103][ T8726] ? lock_acquire+0x1d1/0x380 [ 434.272115][ T8726] ? do_raw_write_lock+0x11e/0x260 [ 434.272128][ T8726] ? find_held_lock+0x2b/0x80 [ 434.272143][ T8726] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 434.272158][ T8726] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 434.272175][ T8726] kvm_vcpu_ioctl+0x730/0x1700 [ 434.272210][ T8726] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 434.272225][ T8726] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 434.272240][ T8726] ? do_vfs_ioctl+0x226/0x13e0 [ 434.272251][ T8726] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 434.272261][ T8726] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 434.272275][ T8726] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 434.272290][ T8726] ? __fget_files+0x34/0x3d0 [ 434.272309][ T8726] ? selinux_file_ioctl+0x13b/0x290 [ 434.272320][ T8726] ? selinux_file_ioctl+0xb6/0x290 [ 434.272332][ T8726] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 434.272348][ T8726] __x64_sys_ioctl+0x18e/0x210 [ 434.272360][ T8726] do_syscall_64+0x123/0x790 [ 434.272375][ T8726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.272387][ T8726] RIP: 0033:0x7f7d1dd9e159 [ 434.272396][ T8726] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 434.272407][ T8726] RSP: 002b:00007f7d1ecaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 434.272418][ T8726] RAX: ffffffffffffffda RBX: 00007f7d1e025fa0 RCX: 00007f7d1dd9e159 [ 434.272425][ T8726] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 434.272436][ T8726] RBP: 00007f7d1ecaa090 R08: 0000000000000000 R09: 0000000000000000 [ 434.272442][ T8726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.272448][ T8726] R13: 00007f7d1e026038 R14: 00007f7d1e025fa0 R15: 00007ffd4f0332b8 [ 434.272463][ T8726] [ 434.539269][ T8753] xt_CT: No such helper "syz1" [ 434.606137][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 434.606197][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 434.630910][ T43] kauditd_printk_skb: 28981 callbacks suppressed [ 434.630921][ T43] audit: type=1400 audit(1789016070.428:34824): avc: denied { mmap_zero } for pid=8760 comm="syz.4.908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 434.631392][ T43] audit: type=1400 audit(1789016070.428:34825): avc: denied { getopt } for pid=8760 comm="syz.4.908" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 434.719735][ T43] audit: type=1400 audit(1789016070.518:34826): avc: denied { write } for pid=8764 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 434.774352][ T43] audit: type=1400 audit(1789016070.578:34827): avc: denied { write } for pid=8770 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 435.028266][ T8793] netlink: Unknown conntrack attr (0) [ 435.094290][ T5799] Bluetooth: hci2: command tx timeout [ 435.098078][ T43] audit: type=1400 audit(1789016070.898:34828): avc: denied { connect } for pid=8800 comm="syz.0.923" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 435.105393][ T5935] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 435.173148][ T8809] __nla_validate_parse: 4 callbacks suppressed [ 435.173161][ T8809] netlink: 12 bytes leftover after parsing attributes in process `syz.5.927'. [ 435.261234][ T43] audit: type=1400 audit(1789016071.058:34829): avc: denied { write } for pid=8817 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 435.277409][ T43] audit: type=1400 audit(1789016071.078:34830): avc: denied { mount } for pid=8775 comm="syz.4.912" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 435.338913][ T5935] usb 9-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 435.340154][ T5935] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 435.340198][ T5935] usb 9-1: can't read configurations, error -71 [ 435.342049][ T43] audit: type=1400 audit(1789016071.138:34831): avc: denied { remount } for pid=8829 comm="syz.2.934" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 435.367557][ T43] audit: type=1400 audit(1789016071.168:34832): avc: denied { write } for pid=8828 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 435.422507][ T43] audit: type=1400 audit(1789016071.218:34833): avc: denied { write } for pid=8839 comm="syz.5.939" name="/" dev="9p" ino=82837537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 435.444575][ T8838] FAULT_INJECTION: forcing a failure. [ 435.444575][ T8838] name failslab, interval 1, probability 0, space 0, times 0 [ 435.444596][ T8838] CPU: 0 UID: 0 PID: 8838 Comm: syz.2.938 Not tainted syzkaller #0 PREEMPT(full) [ 435.444608][ T8838] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 435.444615][ T8838] Call Trace: [ 435.444619][ T8838] [ 435.444624][ T8838] dump_stack_lvl+0x100/0x190 [ 435.444651][ T8838] should_fail_ex.cold+0x5/0xa [ 435.444667][ T8838] should_failslab+0xc2/0x120 [ 435.444685][ T8838] __kmalloc_noprof+0xfc/0x840 [ 435.444697][ T8838] ? lsm_blob_alloc+0x68/0x90 [ 435.444715][ T8838] lsm_blob_alloc+0x68/0x90 [ 435.444730][ T8838] security_task_alloc+0x2a/0x260 [ 435.444743][ T8838] copy_process+0x2c11/0x8370 [ 435.444764][ T8838] ? __pfx_copy_process+0x10/0x10 [ 435.444776][ T8838] ? kasan_save_track+0x14/0x30 [ 435.444798][ T8838] ? __kasan_kmalloc+0xaa/0xb0 [ 435.444815][ T8838] ? lockdep_init_map_type+0x5c/0x250 [ 435.444834][ T8838] ? lockdep_init_map_type+0x5c/0x250 [ 435.444856][ T8838] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 435.444882][ T8838] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 435.444907][ T8838] vhost_task_create+0x1db/0x370 [ 435.444933][ T8838] ? __pfx_vhost_task_create+0x10/0x10 [ 435.444954][ T8838] ? __pfx_vhost_task_fn+0x10/0x10 [ 435.444972][ T8838] ? register_lock_class+0x3f/0x7b0 [ 435.444984][ T8838] ? rcu_is_watching+0x13/0xc0 [ 435.444999][ T8838] ? trace_contention_end+0x126/0x160 [ 435.445014][ T8838] kvm_mmu_post_init_vm+0x1b3/0x360 [ 435.445028][ T8838] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 435.445043][ T8838] ? __pfx___mutex_lock+0x10/0x10 [ 435.445062][ T8838] ? kasan_quarantine_put+0x104/0x240 [ 435.445075][ T8838] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 435.445089][ T8838] ? lock_acquire+0x1d1/0x380 [ 435.445100][ T8838] ? do_raw_write_lock+0x11e/0x260 [ 435.445114][ T8838] ? find_held_lock+0x2b/0x80 [ 435.445129][ T8838] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 435.445143][ T8838] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 435.445161][ T8838] kvm_vcpu_ioctl+0x730/0x1700 [ 435.445177][ T8838] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 435.445192][ T8838] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 435.445207][ T8838] ? do_vfs_ioctl+0x226/0x13e0 [ 435.445218][ T8838] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 435.445228][ T8838] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 435.445242][ T8838] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 435.445257][ T8838] ? __fget_files+0x34/0x3d0 [ 435.445276][ T8838] ? selinux_file_ioctl+0x13b/0x290 [ 435.445289][ T8838] ? selinux_file_ioctl+0xb6/0x290 [ 435.445301][ T8838] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 435.445317][ T8838] __x64_sys_ioctl+0x18e/0x210 [ 435.445329][ T8838] do_syscall_64+0x123/0x790 [ 435.445345][ T8838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.445356][ T8838] RIP: 0033:0x7efcf159e159 [ 435.445366][ T8838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.445376][ T8838] RSP: 002b:00007efcf2471028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 435.445388][ T8838] RAX: ffffffffffffffda RBX: 00007efcf1825fa0 RCX: 00007efcf159e159 [ 435.445395][ T8838] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 435.445402][ T8838] RBP: 00007efcf2471090 R08: 0000000000000000 R09: 0000000000000000 [ 435.445408][ T8838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.445414][ T8838] R13: 00007efcf1826038 R14: 00007efcf1825fa0 R15: 00007ffec8de3df8 [ 435.445428][ T8838] [ 435.534000][ T8846] netlink: 28 bytes leftover after parsing attributes in process `syz.0.941'. [ 435.534035][ T8846] netlink: 4 bytes leftover after parsing attributes in process `syz.0.941'. [ 435.729184][ T5139] ldm_validate_privheads(): Disk read failed. [ 435.729234][ T5139] loop0: [ 435.729249][ T5139] loop0: partition table partially beyond EOD, truncated [ 435.817313][ T5139] ldm_validate_privheads(): Disk read failed. [ 435.817345][ T5139] loop0: [ 435.817354][ T5139] loop0: partition table partially beyond EOD, truncated [ 435.861655][ T8872] xt_NFQUEUE: number of total queues is 0 [ 435.876071][ T8873] nfs: Bad value for 'mountport' [ 435.943676][ T8886] netlink: Unknown conntrack attr (0) [ 435.970697][ T8888] syz.2.955 uses obsolete (PF_INET,SOCK_PACKET) [ 436.149666][ T8905] netlink: 12 bytes leftover after parsing attributes in process `syz.4.960'. [ 436.524427][ C3] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 436.858358][ T8925] netlink: 68 bytes leftover after parsing attributes in process `syz.5.968'. [ 436.870525][ T8927] netlink: 32 bytes leftover after parsing attributes in process `syz.4.969'. [ 436.870542][ T8927] netlink: 4 bytes leftover after parsing attributes in process `syz.4.969'. [ 437.096391][ T8961] overlayfs: failed to clone upperpath [ 437.101174][ T8945] netlink: 8 bytes leftover after parsing attributes in process `syz.5.977'. [ 437.104607][ T8945] erspan0: entered promiscuous mode [ 437.196278][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 437.196304][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 437.196321][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 437.196339][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 437.221711][ T8979] xt_MASQUERADE: bad MAP_IPS. [ 437.248858][ T8990] netlink: 8 bytes leftover after parsing attributes in process `syz.5.992'. [ 437.248878][ T8990] netlink: 4 bytes leftover after parsing attributes in process `syz.5.992'. [ 437.338896][ T9009] loop5: detected capacity change from 0 to 2640 [ 437.339506][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339531][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339546][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339560][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339575][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339597][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339617][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339632][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339640][ T9009] ldm_validate_partition_table(): Disk read failed. [ 437.339653][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339667][ T9009] Buffer I/O error on dev loop5, logical block 0, async page read [ 437.339689][ T9009] Dev loop5: unable to read RDB block 0 [ 437.339774][ T9009] loop5: unable to read partition table [ 437.339861][ T9009] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 437.414139][ T5799] Bluetooth: hci0: SCO packet for unknown connection handle 401 [ 437.432231][ T9030] tmpfs: Bad value for 'usrquota_block_hardlimit' [ 437.488928][ T9038] overlayfs: missing 'workdir' [ 437.627856][ T9057] FAULT_INJECTION: forcing a failure. [ 437.627856][ T9057] name failslab, interval 1, probability 0, space 0, times 0 [ 437.627876][ T9057] CPU: 0 UID: 0 PID: 9057 Comm: syz.4.1020 Not tainted syzkaller #0 PREEMPT(full) [ 437.627889][ T9057] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 437.627895][ T9057] Call Trace: [ 437.627899][ T9057] [ 437.627904][ T9057] dump_stack_lvl+0x100/0x190 [ 437.627931][ T9057] should_fail_ex.cold+0x5/0xa [ 437.627947][ T9057] should_failslab+0xc2/0x120 [ 437.627965][ T9057] kmem_cache_alloc_noprof+0x92/0x6a0 [ 437.627977][ T9057] ? vhost_task_create+0x1db/0x370 [ 437.627993][ T9057] ? kvm_mmu_post_init_vm+0x1b3/0x360 [ 437.628006][ T9057] ? alloc_pid+0x1bd/0x1930 [ 437.628023][ T9057] alloc_pid+0x1bd/0x1930 [ 437.628041][ T9057] ? __pfx_alloc_pid+0x10/0x10 [ 437.628060][ T9057] ? __lock_acquire+0x5c0/0x1f40 [ 437.628073][ T9057] ? avc_has_perm_noaudit+0x145/0x3b0 [ 437.628094][ T9057] ? fpu_clone+0x226/0x7a0 [ 437.628110][ T9057] ? copy_thread+0x729/0xbe0 [ 437.628123][ T9057] copy_process+0x4dd6/0x8370 [ 437.628143][ T9057] ? __pfx_copy_process+0x10/0x10 [ 437.628192][ T9057] ? kasan_save_track+0x14/0x30 [ 437.628204][ T9057] ? __kasan_kmalloc+0xaa/0xb0 [ 437.628217][ T9057] ? lockdep_init_map_type+0x5c/0x250 [ 437.628230][ T9057] ? lockdep_init_map_type+0x5c/0x250 [ 437.628243][ T9057] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 437.628260][ T9057] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 437.628276][ T9057] vhost_task_create+0x1db/0x370 [ 437.628293][ T9057] ? __pfx_vhost_task_create+0x10/0x10 [ 437.628315][ T9057] ? __pfx_vhost_task_fn+0x10/0x10 [ 437.628335][ T9057] ? register_lock_class+0x3f/0x7b0 [ 437.628347][ T9057] ? rcu_is_watching+0x13/0xc0 [ 437.628361][ T9057] ? trace_contention_end+0x126/0x160 [ 437.628376][ T9057] kvm_mmu_post_init_vm+0x1b3/0x360 [ 437.628390][ T9057] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 437.628404][ T9057] ? __pfx___mutex_lock+0x10/0x10 [ 437.628422][ T9057] ? kasan_quarantine_put+0x104/0x240 [ 437.628436][ T9057] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 437.628449][ T9057] ? lock_acquire+0x1d1/0x380 [ 437.628461][ T9057] ? do_raw_write_lock+0x11e/0x260 [ 437.628474][ T9057] ? find_held_lock+0x2b/0x80 [ 437.628489][ T9057] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 437.628504][ T9057] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 437.628521][ T9057] kvm_vcpu_ioctl+0x730/0x1700 [ 437.628538][ T9057] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 437.628553][ T9057] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 437.628567][ T9057] ? do_vfs_ioctl+0x226/0x13e0 [ 437.628578][ T9057] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 437.628588][ T9057] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 437.628602][ T9057] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 437.628616][ T9057] ? __fget_files+0x34/0x3d0 [ 437.628635][ T9057] ? selinux_file_ioctl+0x13b/0x290 [ 437.628646][ T9057] ? selinux_file_ioctl+0xb6/0x290 [ 437.628658][ T9057] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 437.628674][ T9057] __x64_sys_ioctl+0x18e/0x210 [ 437.628686][ T9057] do_syscall_64+0x123/0x790 [ 437.628701][ T9057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.628713][ T9057] RIP: 0033:0x7f7d1dd9e159 [ 437.628722][ T9057] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.628732][ T9057] RSP: 002b:00007f7d1ecaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 437.628744][ T9057] RAX: ffffffffffffffda RBX: 00007f7d1e025fa0 RCX: 00007f7d1dd9e159 [ 437.628751][ T9057] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 437.628757][ T9057] RBP: 00007f7d1ecaa090 R08: 0000000000000000 R09: 0000000000000000 [ 437.628764][ T9057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.628770][ T9057] R13: 00007f7d1e026038 R14: 00007f7d1e025fa0 R15: 00007ffd4f0332b8 [ 437.628785][ T9057] [ 437.777488][ T9082] FAULT_INJECTION: forcing a failure. [ 437.777488][ T9082] name failslab, interval 1, probability 0, space 0, times 0 [ 437.777511][ T9082] CPU: 3 UID: 0 PID: 9082 Comm: syz.2.1027 Not tainted syzkaller #0 PREEMPT(full) [ 437.777523][ T9082] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 437.777530][ T9082] Call Trace: [ 437.777536][ T9082] [ 437.777540][ T9082] dump_stack_lvl+0x100/0x190 [ 437.777560][ T9082] should_fail_ex.cold+0x5/0xa [ 437.777577][ T9082] should_failslab+0xc2/0x120 [ 437.777592][ T9082] __kvmalloc_node_noprof+0x113/0x9b0 [ 437.777607][ T9082] ? __pfx___mutex_lock+0x10/0x10 [ 437.777623][ T9082] ? nf_hook_entries_grow+0x255/0x870 [ 437.777648][ T9082] nf_hook_entries_grow+0x255/0x870 [ 437.777666][ T9082] ? __call_rcu_common.constprop.0+0x3f2/0x9b0 [ 437.777684][ T9082] __nf_register_net_hook+0x112/0x780 [ 437.777699][ T9082] nf_register_net_hook+0xdb/0x170 [ 437.777711][ T9082] nf_register_net_hooks+0x5d/0xd0 [ 437.777724][ T9082] nf_ct_netns_do_get+0x387/0x610 [ 437.777737][ T9082] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 437.777769][ T9082] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 437.777784][ T9082] ? rcu_is_watching+0x13/0xc0 [ 437.777803][ T9082] nf_ct_netns_get+0x3d/0x160 [ 437.777815][ T9082] connlimit_mt_check+0xb5/0x280 [ 437.777829][ T9082] ? __pfx_connlimit_mt_check+0x10/0x10 [ 437.777842][ T9082] xt_check_match+0x117/0x1c0 [ 437.777857][ T9082] find_check_entry.isra.0+0x323/0x990 [ 437.777883][ T9082] ? __pfx_find_check_entry.isra.0+0x10/0x10 [ 437.777906][ T9082] ? kasan_quarantine_put+0x104/0x240 [ 437.777923][ T9082] ? lockdep_hardirqs_on+0x7d/0x110 [ 437.777937][ T9082] ? translate_table+0xaa0/0x1630 [ 437.777952][ T9082] ? translate_table+0xaf2/0x1630 [ 437.777966][ T9082] ? kfree+0x22b/0x6d0 [ 437.777982][ T9082] ? xt_check_table_hooks+0x206/0x330 [ 437.777997][ T9082] translate_table+0xbcd/0x1630 [ 437.778020][ T9082] ? __pfx_translate_table+0x10/0x10 [ 437.778040][ T9082] do_ipt_set_ctl+0x689/0xcf0 [ 437.778056][ T9082] ? nf_sockopt_find.isra.0+0x222/0x290 [ 437.778069][ T9082] ? nf_sockopt_find.isra.0+0x222/0x290 [ 437.778084][ T9082] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 437.778099][ T9082] ? __mutex_unlock_slowpath+0x35d/0x930 [ 437.778118][ T9082] ? sockopt_release_sock+0x5c/0x70 [ 437.778136][ T9082] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 437.778157][ T9082] ? nf_sockopt_find.isra.0+0x222/0x290 [ 437.778171][ T9082] nf_setsockopt+0x8d/0xf0 [ 437.778185][ T9082] ip_setsockopt+0xcb/0xf0 [ 437.778203][ T9082] tcp_setsockopt+0xa7/0x100 [ 437.778213][ T9082] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 437.778229][ T9082] do_sock_setsockopt+0xf3/0x1d0 [ 437.778245][ T9082] __sys_setsockopt+0x195/0x220 [ 437.778260][ T9082] __x64_sys_setsockopt+0xbd/0x160 [ 437.778276][ T9082] ? do_syscall_64+0xae/0x790 [ 437.778297][ T9082] ? lockdep_hardirqs_on+0x7d/0x110 [ 437.778310][ T9082] do_syscall_64+0x123/0x790 [ 437.778326][ T9082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.778337][ T9082] RIP: 0033:0x7efcf159e159 [ 437.778347][ T9082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.778357][ T9082] RSP: 002b:00007efcf2471028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 437.778369][ T9082] RAX: ffffffffffffffda RBX: 00007efcf1825fa0 RCX: 00007efcf159e159 [ 437.778376][ T9082] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 [ 437.778382][ T9082] RBP: 00007efcf163503b R08: 00000000000002f0 R09: 0000000000000000 [ 437.778389][ T9082] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 437.778395][ T9082] R13: 00007efcf1826038 R14: 00007efcf1825fa0 R15: 00007ffec8de3df8 [ 437.778410][ T9082] [ 437.779653][ T9082] xt_connlimit: cannot load conntrack support for proto=2 [ 437.928422][ T9093] FAULT_INJECTION: forcing a failure. [ 437.928422][ T9093] name failslab, interval 1, probability 0, space 0, times 0 [ 437.928442][ T9093] CPU: 2 UID: 0 PID: 9093 Comm: syz.4.1031 Not tainted syzkaller #0 PREEMPT(full) [ 437.928454][ T9093] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 437.928461][ T9093] Call Trace: [ 437.928465][ T9093] [ 437.928469][ T9093] dump_stack_lvl+0x100/0x190 [ 437.928489][ T9093] should_fail_ex.cold+0x5/0xa [ 437.928505][ T9093] should_failslab+0xc2/0x120 [ 437.928519][ T9093] kmem_cache_alloc_noprof+0x92/0x6a0 [ 437.928531][ T9093] ? d_instantiate+0x8a/0xb0 [ 437.928548][ T9093] ? alloc_empty_file+0x5b/0x1c0 [ 437.928565][ T9093] alloc_empty_file+0x5b/0x1c0 [ 437.928579][ T9093] alloc_file_pseudo+0x183/0x290 [ 437.928595][ T9093] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 437.928609][ T9093] ? alloc_fd+0x471/0x7a0 [ 437.928623][ T9093] ? do_raw_spin_unlock+0x145/0x1e0 [ 437.928639][ T9093] __anon_inode_getfile+0xe8/0x280 [ 437.928652][ T9093] anon_inode_getfile_fmode+0x37/0xa0 [ 437.928664][ T9093] do_eventfd+0x159/0x2b0 [ 437.928677][ T9093] __x64_sys_eventfd2+0x53/0x80 [ 437.928691][ T9093] do_syscall_64+0x123/0x790 [ 437.928714][ T9093] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.928726][ T9093] RIP: 0033:0x7f7d1dd9e159 [ 437.928737][ T9093] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.928748][ T9093] RSP: 002b:00007f7d1ecaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000122 [ 437.928760][ T9093] RAX: ffffffffffffffda RBX: 00007f7d1e025fa0 RCX: 00007f7d1dd9e159 [ 437.928768][ T9093] RDX: 0000000000000000 RSI: 0000000000080000 RDI: 0000000000000e5c [ 437.928774][ T9093] RBP: 00007f7d1de3503b R08: 0000000000000000 R09: 0000000000000000 [ 437.928781][ T9093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 437.928788][ T9093] R13: 00007f7d1e026038 R14: 00007f7d1e025fa0 R15: 00007ffd4f0332b8 [ 437.928803][ T9093] [ 438.219337][ T9124] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=9124 comm=syz.0.1044 [ 438.281598][ T9135] validate_nla: 34 callbacks suppressed [ 438.281611][ T9135] netlink: 'syz.2.1048': attribute type 12 has an invalid length. [ 438.547776][ T9181] FAULT_INJECTION: forcing a failure. [ 438.547776][ T9181] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 438.547796][ T9181] CPU: 1 UID: 0 PID: 9181 Comm: syz.2.1066 Not tainted syzkaller #0 PREEMPT(full) [ 438.547809][ T9181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 438.547816][ T9181] Call Trace: [ 438.547820][ T9181] [ 438.547824][ T9181] dump_stack_lvl+0x100/0x190 [ 438.547845][ T9181] should_fail_ex.cold+0x5/0xa [ 438.547861][ T9181] _copy_from_user+0x2e/0xd0 [ 438.547873][ T9181] copy_msghdr_from_user+0x9f/0x4c0 [ 438.547891][ T9181] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 438.547910][ T9181] ? lock_acquire+0x1d1/0x380 [ 438.547921][ T9181] ? get_pid_task+0x2a/0x250 [ 438.547938][ T9181] ___sys_sendmsg+0x106/0x1e0 [ 438.547955][ T9181] ? __pfx____sys_sendmsg+0x10/0x10 [ 438.547970][ T9181] ? get_pid_task+0x106/0x250 [ 438.547990][ T9181] ? find_held_lock+0x2b/0x80 [ 438.548013][ T9181] __sys_sendmsg+0x160/0x210 [ 438.548026][ T9181] ? __pfx___sys_sendmsg+0x10/0x10 [ 438.548046][ T9181] do_syscall_64+0x123/0x790 [ 438.548062][ T9181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.548074][ T9181] RIP: 0033:0x7efcf159e159 [ 438.548083][ T9181] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 438.548094][ T9181] RSP: 002b:00007efcf2471028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 438.548105][ T9181] RAX: ffffffffffffffda RBX: 00007efcf1825fa0 RCX: 00007efcf159e159 [ 438.548112][ T9181] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 438.548118][ T9181] RBP: 00007efcf2471090 R08: 0000000000000000 R09: 0000000000000000 [ 438.548125][ T9181] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 438.548131][ T9181] R13: 00007efcf1826038 R14: 00007efcf1825fa0 R15: 00007ffec8de3df8 [ 438.548145][ T9181] [ 438.582832][ T9184] nbd: nbd64 already in use [ 438.677408][ T9187] overlayfs: upper fs does not support tmpfile. [ 438.681123][ T7843] udevd[7843]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 438.694990][ T9197] netlink: 'syz.5.1071': attribute type 2 has an invalid length. [ 438.700432][ T9197] ´: entered promiscuous mode [ 438.836032][ T9210] fuse: Unknown parameter '' [ 438.990383][ T9229] tipc: Enabling of bearer rejected, failed to enable media [ 439.040797][ T9236] Invalid ELF header type: 2 != 1 [ 439.224876][ T9256] netlink: 'syz.2.1091': attribute type 12 has an invalid length. [ 439.314950][ T10] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 439.474163][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 439.474625][ T10] usb 9-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 439.475418][ T10] usb 9-1: config 0 has an invalid interface number: 8 but max is 0 [ 439.475431][ T10] usb 9-1: config 0 has no interface number 0 [ 439.475449][ T10] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 439.475461][ T10] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 439.476691][ T10] usb 9-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 439.476703][ T10] usb 9-1: Product: syz [ 439.476711][ T10] usb 9-1: SerialNumber: syz [ 439.479367][ T10] usb 9-1: config 0 descriptor?? [ 439.483196][ T10] cm109 9-1:0.8: invalid payload size 0, expected 4 [ 439.488124][ T10] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.8/input/input7 [ 439.550453][ T9267] MINIX-fs: unable to read superblock [ 439.760245][ T9292] syz_tun: entered allmulticast mode [ 439.861389][ T9304] syzkaller0: entered promiscuous mode [ 439.861409][ T9304] syzkaller0: entered allmulticast mode [ 439.864818][ T9304] tipc: Enabled bearer , priority 0 [ 439.869140][ T9301] tipc: Resetting bearer [ 439.875684][ T9299] Failed to get privilege flags for destination (handle=0x2:0x0) [ 439.890193][ T9301] tipc: Disabling bearer [ 439.892400][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 439.969912][ T9297] syz_tun: left allmulticast mode [ 440.009394][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 440.009414][ T43] audit: type=1400 audit(1789016075.808:34854): avc: denied { mount } for pid=9316 comm="syz.2.1114" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 440.150145][ T9341] netlink: 'syz.2.1118': attribute type 7 has an invalid length. [ 440.150160][ T9341] netlink: 'syz.2.1118': attribute type 8 has an invalid length. [ 440.189708][ T9241] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.190181][ T9241] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.222870][ T9343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.223223][ T9343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.245443][ T9241] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 440.247916][ T9241] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 440.308944][ T9241] ip6tnl1: left allmulticast mode [ 440.324288][ T13] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 440.324310][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.324328][ T13] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 440.324342][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.324359][ T13] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 440.324372][ T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.324389][ T13] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 440.324403][ T13] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.412398][ T9353] __nla_validate_parse: 14 callbacks suppressed [ 440.412412][ T9353] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1125'. [ 440.420190][ C1] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 440.420241][ T5879] usb 9-1: USB disconnect, device number 4 [ 440.421027][ C1] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 440.421042][ C1] cm109 9-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 440.437984][ T5879] cm109 9-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 440.599455][ T9366] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input8 [ 440.604681][ T43] audit: type=1400 audit(1789016076.408:34855): avc: denied { getopt } for pid=9370 comm="syz.5.1131" lport=10009 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 440.649521][ T43] audit: type=1400 audit(1789016076.448:34856): avc: denied { write } for pid=9369 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 440.726637][ T43] audit: type=1400 audit(1789016076.528:34857): avc: denied { write } for pid=9386 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 440.796965][ T43] audit: type=1400 audit(1789016076.598:34858): avc: denied { write } for pid=9397 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 440.846131][ T43] audit: type=1400 audit(1789016076.648:34859): avc: denied { write } for pid=9410 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 440.866561][ T9412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 440.867604][ T9413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 440.905997][ T5139] ldm_validate_privheads(): Disk read failed. [ 440.906032][ T5139] loop0: [ 440.906041][ T5139] loop0: partition table partially beyond EOD, truncated [ 440.980206][ T9420] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9420 comm=syz.2.1146 [ 440.980266][ T9421] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9421 comm=syz.2.1146 [ 441.088641][ T9437] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1150'. [ 441.173576][ T43] audit: type=1400 audit(1789016076.968:34860): avc: denied { bind } for pid=9438 comm="syz.2.1151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 441.177736][ T9439] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1151'. [ 441.189316][ T43] audit: type=1400 audit(1789016076.988:34861): avc: denied { ioctl } for pid=9444 comm="syz.4.1153" path="socket:[28336]" dev="sockfs" ino=28336 ioctlcmd=0x9365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 441.190100][ T9445] netlink: 'syz.4.1153': attribute type 20 has an invalid length. [ 441.190110][ T9445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1153'. [ 441.195692][ T9445] netlink: 'syz.4.1153': attribute type 20 has an invalid length. [ 441.195704][ T9445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1153'. [ 441.214222][ T5865] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.214249][ T5865] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.214266][ T5865] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.214284][ T5865] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.241028][ T9455] netlink: 'syz.4.1154': attribute type 12 has an invalid length. [ 441.339422][ T43] audit: type=1400 audit(1789016077.138:34862): avc: denied { listen } for pid=9463 comm="syz.4.1158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 441.339729][ T43] audit: type=1400 audit(1789016077.138:34863): avc: denied { accept } for pid=9463 comm="syz.4.1158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 441.358073][ T9462] FAULT_INJECTION: forcing a failure. [ 441.358073][ T9462] name failslab, interval 1, probability 0, space 0, times 0 [ 441.358093][ T9462] CPU: 3 UID: 0 PID: 9462 Comm: syz.2.1157 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.358109][ T9462] Tainted: [L]=SOFTLOCKUP [ 441.358113][ T9462] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 441.358119][ T9462] Call Trace: [ 441.358140][ T9462] [ 441.358144][ T9462] dump_stack_lvl+0x100/0x190 [ 441.358172][ T9462] should_fail_ex.cold+0x5/0xa [ 441.358188][ T9462] should_failslab+0xc2/0x120 [ 441.358206][ T9462] kmem_cache_alloc_noprof+0x92/0x6a0 [ 441.358219][ T9462] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 441.358239][ T9462] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 441.358259][ T9462] mmu_topup_memory_caches+0x25/0x170 [ 441.358272][ T9462] kvm_mmu_load+0xe8/0x2580 [ 441.358285][ T9462] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 441.358302][ T9462] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 441.358320][ T9462] ? __pfx_kvm_mmu_load+0x10/0x10 [ 441.358331][ T9462] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 441.358343][ T9462] ? kvm_check_and_inject_events+0x896/0x1050 [ 441.358358][ T9462] vcpu_run+0x395d/0x5e80 [ 441.358370][ T9462] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 441.358384][ T9462] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 441.358404][ T9462] ? __pfx_vcpu_run+0x10/0x10 [ 441.358419][ T9462] ? lock_acquire+0x1d1/0x380 [ 441.358430][ T9462] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 441.358445][ T9462] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 441.358461][ T9462] ? __local_bh_enable_ip+0xa5/0x120 [ 441.358475][ T9462] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 441.358488][ T9462] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 441.358505][ T9462] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 441.358518][ T9462] ? lock_acquire+0x1d1/0x380 [ 441.358530][ T9462] ? do_raw_write_lock+0x11e/0x260 [ 441.358543][ T9462] ? find_held_lock+0x2b/0x80 [ 441.358558][ T9462] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 441.358572][ T9462] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 441.358590][ T9462] kvm_vcpu_ioctl+0x730/0x1700 [ 441.358606][ T9462] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 441.358621][ T9462] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 441.358635][ T9462] ? do_vfs_ioctl+0x226/0x13e0 [ 441.358646][ T9462] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 441.358656][ T9462] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 441.358670][ T9462] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 441.358684][ T9462] ? __fget_files+0x34/0x3d0 [ 441.358703][ T9462] ? selinux_file_ioctl+0x13b/0x290 [ 441.358714][ T9462] ? selinux_file_ioctl+0xb6/0x290 [ 441.358726][ T9462] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 441.358742][ T9462] __x64_sys_ioctl+0x18e/0x210 [ 441.358753][ T9462] do_syscall_64+0x123/0x790 [ 441.358773][ T9462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.358785][ T9462] RIP: 0033:0x7efcf159e159 [ 441.358795][ T9462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.358805][ T9462] RSP: 002b:00007efcf2471028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 441.358820][ T9462] RAX: ffffffffffffffda RBX: 00007efcf1825fa0 RCX: 00007efcf159e159 [ 441.358827][ T9462] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 441.358833][ T9462] RBP: 00007efcf2471090 R08: 0000000000000000 R09: 0000000000000000 [ 441.358840][ T9462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 441.358846][ T9462] R13: 00007efcf1826038 R14: 00007efcf1825fa0 R15: 00007ffec8de3df8 [ 441.358860][ T9462] [ 441.441814][ T9470] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1160'. [ 441.509894][ T9477] dlm: no locking on control device [ 441.515660][ T5799] Bluetooth: hci1: Invalid handle: 0xed88 > 0x0eff [ 441.614654][ T9492] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 441.701152][ T9504] overlayfs: failed to clone upperpath [ 441.799999][ T5799] Bluetooth: hci1: unknown advertising packet type: 0x20 [ 441.800011][ T5799] Bluetooth: hci1: Malformed LE Event: 0x02 [ 442.249254][ T9518] xt_CT: No such helper "syz1" [ 442.265331][ T5934] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 442.386694][ T5139] ldm_validate_privheads(): Disk read failed. [ 442.386725][ T5139] loop0: [ 442.386734][ T5139] loop0: partition table partially beyond EOD, truncated [ 442.394177][ T5934] usb 10-1: device descriptor read/64, error -71 [ 442.632315][ T9540] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.4278190080.0), cmd(3) [ 442.644174][ T5934] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 442.710927][ T9551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1194'. [ 442.761337][ T9559] netlink: 'syz.4.1198': attribute type 12 has an invalid length. [ 442.774265][ T5934] usb 10-1: device descriptor read/64, error -71 [ 442.867849][ T9570] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1203'. [ 442.884398][ T5934] usb usb10-port1: attempt power cycle [ 442.898795][ T9573] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1205'. [ 442.898825][ T9573] netlink: 'syz.0.1205': attribute type 7 has an invalid length. [ 442.898832][ T9573] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1205'. [ 442.980346][ T9583] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.984250][ T8310] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 443.155459][ T8310] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 443.156395][ T8310] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 443.156415][ T8310] usb 7-1: config 1 has no interface number 0 [ 443.158069][ T8310] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.158082][ T8310] usb 7-1: Product: syz [ 443.158089][ T8310] usb 7-1: Manufacturer: syz [ 443.158096][ T8310] usb 7-1: SerialNumber: syz [ 443.166817][ T8310] usb 7-1: 3:1 : does not exist [ 443.166829][ T8310] usb 7-1: 3:0 : does not exist [ 443.224667][ T5934] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 443.246853][ T5934] usb 10-1: device descriptor read/8, error -71 [ 443.285452][ T9606] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 443.456518][ T8310] usb 7-1: USB disconnect, device number 5 [ 443.484583][ T5934] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 443.505515][ T5934] usb 10-1: device descriptor read/8, error -71 [ 443.616169][ T5934] usb usb10-port1: unable to enumerate USB device [ 443.888684][ T9627] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 443.890254][ T9628] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 444.219321][ T9664] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 444.221527][ T9664] bond1 (unregistering): Released all slaves [ 444.251970][ T9669] nfs: Bad value for 'timeo' [ 444.300152][ T9671] syzkaller0: entered promiscuous mode [ 444.300167][ T9671] syzkaller0: entered allmulticast mode [ 444.301264][ T9671] tipc: Started in network mode [ 444.301279][ T9671] tipc: Node identity 5e315ca8c638, cluster identity 4711 [ 444.302123][ T9671] tipc: Enabled bearer , priority 0 [ 444.304004][ T9670] tipc: Resetting bearer [ 444.317901][ T9670] tipc: Disabling bearer [ 444.450758][ T9675] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 445.027313][ T43] kauditd_printk_skb: 8 callbacks suppressed [ 445.027325][ T43] audit: type=1400 audit(1789016080.828:34872): avc: denied { name_bind } for pid=9682 comm="syz.0.1246" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 445.133380][ T9697] netlink: 'syz.0.1253': attribute type 11 has an invalid length. [ 445.204538][ T43] audit: type=1400 audit(1789016080.998:34873): avc: denied { read } for pid=9698 comm="syz.2.1254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 445.273672][ T9713] validate_nla: 1 callbacks suppressed [ 445.273686][ T9713] netlink: 'syz.4.1259': attribute type 12 has an invalid length. [ 445.300831][ T9715] gfs2: path_lookup on c::: returned error -2 [ 445.392788][ T9730] tipc: Enabled bearer , priority 0 [ 445.501792][ T9754] __nla_validate_parse: 11 callbacks suppressed [ 445.501811][ T9754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1276'. [ 445.501835][ T9754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1276'. [ 445.526396][ T9754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1276'. [ 445.526454][ T9754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1276'. [ 445.542574][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.542678][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.542761][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.542863][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.542966][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.543046][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 445.626557][ T43] audit: type=1400 audit(1789016081.428:34874): avc: denied { mount } for pid=9764 comm="syz.0.1277" name="/" dev="ramfs" ino=32082 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 445.678842][ T9770] input: syz0 as /devices/virtual/input/input10 [ 445.747915][ T43] audit: type=1400 audit(1789016081.548:34875): avc: denied { write } for pid=9774 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 445.800852][ T43] audit: type=1400 audit(1789016081.598:34876): avc: denied { write } for pid=9783 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 445.859896][ T9786] xt_CT: No such helper "syz1" [ 445.888176][ T43] audit: type=1400 audit(1789016081.688:34877): avc: denied { write } for pid=9790 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 445.942199][ T43] audit: type=1400 audit(1789016081.738:34878): avc: denied { write } for pid=9800 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 446.029146][ T43] audit: type=1400 audit(1789016081.828:34879): avc: denied { write } for pid=9811 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 446.097391][ T43] audit: type=1400 audit(1789016081.898:34880): avc: denied { write } for pid=9825 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 446.166870][ T9836] binder: BINDER_SET_CONTEXT_MGR already set [ 446.166880][ T9836] binder: 9834:9836 ioctl 4018620d 200000000100 returned -16 [ 446.168751][ T9836] binder: BINDER_SET_CONTEXT_MGR already set [ 446.168807][ T9836] binder: 9834:9836 ioctl 4018620d 2000000002c0 returned -16 [ 446.193393][ T43] audit: type=1400 audit(1789016081.988:34881): avc: denied { write } for pid=9832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 446.227273][ T9844] /dev/sr0: Can't open blockdev [ 446.340093][ T9863] lo: entered allmulticast mode [ 446.342382][ T9863] netlink: 'syz.5.1308': attribute type 21 has an invalid length. [ 446.342695][ T9862] lo: left allmulticast mode [ 446.365503][ T9866] netlink: 'syz.4.1309': attribute type 12 has an invalid length. [ 446.394295][ T5934] tipc: Node number set to 3501618174 [ 446.458767][ T9883] syzkaller0: entered promiscuous mode [ 446.458781][ T9883] syzkaller0: entered allmulticast mode [ 446.462171][ T9883] tipc: Started in network mode [ 446.462185][ T9883] tipc: Node identity 063fe28bec0b, cluster identity 4711 [ 446.462303][ T9883] tipc: Enabled bearer , priority 0 [ 446.463722][ T9881] tipc: Resetting bearer [ 446.482324][ T9881] tipc: Disabling bearer [ 447.491659][ T9950] xt_CT: No such helper "syz1" [ 447.491739][ T9950] FAULT_INJECTION: forcing a failure. [ 447.491739][ T9950] name fail_futex, interval 1, probability 0, space 0, times 0 [ 447.491758][ T9950] CPU: 3 UID: 0 PID: 9950 Comm: syz.2.1336 Tainted: G L syzkaller #0 PREEMPT(full) [ 447.491773][ T9950] Tainted: [L]=SOFTLOCKUP [ 447.491778][ T9950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 447.491785][ T9950] Call Trace: [ 447.491789][ T9950] [ 447.491794][ T9950] dump_stack_lvl+0x100/0x190 [ 447.491825][ T9950] should_fail_ex.cold+0x5/0xa [ 447.491842][ T9950] get_futex_key+0x1d0/0x14f0 [ 447.491858][ T9950] ? __pfx_get_futex_key+0x10/0x10 [ 447.491872][ T9950] ? do_ipt_set_ctl+0x49d/0xcf0 [ 447.491891][ T9950] ? nf_sockopt_find.isra.0+0x222/0x290 [ 447.491905][ T9950] ? nf_sockopt_find.isra.0+0x222/0x290 [ 447.491922][ T9950] futex_wake+0xf4/0x5e0 [ 447.491939][ T9950] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 447.491959][ T9950] ? __pfx_futex_wake+0x10/0x10 [ 447.491979][ T9950] ? nf_sockopt_find.isra.0+0x222/0x290 [ 447.491994][ T9950] do_futex+0x2b2/0x440 [ 447.492008][ T9950] ? __pfx_do_futex+0x10/0x10 [ 447.492023][ T9950] ? rcu_is_watching+0x13/0xc0 [ 447.492038][ T9950] ? do_sock_setsockopt+0x101/0x1d0 [ 447.492053][ T9950] ? kfree+0x1e5/0x6d0 [ 447.492073][ T9950] __x64_sys_futex+0x34f/0x4d0 [ 447.492090][ T9950] ? __pfx___x64_sys_futex+0x10/0x10 [ 447.492109][ T9950] do_syscall_64+0x123/0x790 [ 447.492147][ T9950] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.492160][ T9950] RIP: 0033:0x7efcf159e159 [ 447.492170][ T9950] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.492181][ T9950] RSP: 002b:00007efcf24710e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 447.492192][ T9950] RAX: ffffffffffffffda RBX: 00007efcf1825fa8 RCX: 00007efcf159e159 [ 447.492200][ T9950] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007efcf1825fac [ 447.492207][ T9950] RBP: 00007efcf1825fa0 R08: 0000000000000001 R09: 0000000000000000 [ 447.492214][ T9950] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 447.492220][ T9950] R13: 00007efcf1826038 R14: 00007ffec8de3d10 R15: 00007ffec8de3df8 [ 447.492235][ T9950] [ 447.688717][ T5139] ldm_validate_privheads(): Disk read failed. [ 447.688749][ T5139] loop0: [ 447.688757][ T5139] loop0: partition table partially beyond EOD, truncated [ 447.895286][ T5707] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 447.895302][ T5707] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 447.895435][ T5799] Bluetooth: hci1: command 0x0419 tx timeout [ 448.610684][T10035] tmpfs: Bad value for 'nr_blocks' [ 448.988538][ T5139] ldm_validate_privheads(): Disk read failed. [ 448.988595][ T5139] loop0: [ 448.988612][ T5139] loop0: partition table partially beyond EOD, truncated [ 449.176182][ T5799] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 449.176249][ T5799] Bluetooth: hci2: Injecting HCI hardware error event [ 449.177684][ T5792] Bluetooth: hci2: hardware error 0x00 [ 449.534791][T10084] overlayfs: failed to clone upperpath [ 449.552239][T10084] overlayfs: failed to clone upperpath [ 449.964513][ T5799] Bluetooth: hci0: command 0x0c1a tx timeout [ 449.964612][ T5707] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 449.964630][ T5707] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 450.196009][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 450.196027][ T43] audit: type=1400 audit(1789016085.998:34891): avc: denied { getopt } for pid=10114 comm="syz.0.1403" lport=46346 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 450.633003][T10159] __nla_validate_parse: 92 callbacks suppressed [ 450.633016][T10159] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1419'. [ 450.633028][T10159] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1419'. [ 450.644284][T10160] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1418'. [ 450.644303][T10160] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1418'. [ 450.686412][T10163] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1 [ 450.788741][T10175] binder: BINDER_SET_CONTEXT_MGR already set [ 450.788751][T10175] binder: 10174:10175 ioctl 4018620d 200000000100 returned -16 [ 450.790293][T10175] binder: BINDER_SET_CONTEXT_MGR already set [ 450.790300][T10175] binder: 10174:10175 ioctl 4018620d 2000000002c0 returned -16 [ 450.898911][T10183] nfs: Bad value for 'retrans' [ 450.962852][T10173] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 451.097782][ T43] audit: type=1807 audit(1789016086.898:34892): action=measure uid>1 res=1 [ 451.099003][T10185] ima: policy update completed [ 451.099072][ T43] audit: type=1802 audit(1789016086.898:34893): pid=10185 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=completed comm="syz.4.1430" res=1 errno=0 [ 451.254140][ T5792] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 451.308299][T10196] tmpfs: Bad value for 'mpol' [ 451.759740][ T43] audit: type=1400 audit(1789016087.558:34894): avc: denied { create } for pid=10199 comm="syz.5.1435" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 451.826384][ T43] audit: type=1400 audit(1789016087.628:34895): avc: denied { unlink } for pid=7882 comm="syz-executor" name="file0" dev="tmpfs" ino=873 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 451.960434][T10209] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1439'. [ 452.069553][ T5139] ldm_validate_privheads(): Disk read failed. [ 452.069601][ T5139] loop0: [ 452.069616][ T5139] loop0: partition table partially beyond EOD, truncated [ 452.124223][ T5792] Bluetooth: hci4: command 0x0c1a tx timeout [ 452.124232][ T5707] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 452.124247][ T5707] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 452.181505][ T43] audit: type=1400 audit(1789016087.978:34896): avc: denied { map } for pid=10221 comm="syz.4.1445" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 452.239217][ T43] audit: type=1400 audit(1789016088.038:34897): avc: denied { cmd } for pid=10221 comm="syz.4.1445" path="/dev/fuse" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=io_uring permissive=1 [ 452.239413][T10222] No fuse device found [ 452.239443][T10222] No fuse device found [ 452.239458][T10222] No fuse device found [ 452.239471][T10222] No fuse device found [ 452.239486][T10222] No fuse device found [ 452.239500][T10222] No fuse device found [ 452.239513][T10222] No fuse device found [ 452.239527][T10222] No fuse device found [ 452.239541][T10222] No fuse device found [ 452.239555][T10222] No fuse device found [ 452.298005][ T43] audit: type=1326 audit(1789016088.098:34898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10234 comm="syz.0.1448" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f27c979e159 code=0x0 [ 452.354251][ T5892] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 452.525837][ T5892] usb 10-1: Using ep0 maxpacket: 16 [ 452.526558][ T5892] usb 10-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 452.527646][ T5892] usb 10-1: config 0 has an invalid interface number: 8 but max is 0 [ 452.527666][ T5892] usb 10-1: config 0 has no interface number 0 [ 452.527696][ T5892] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 452.527719][ T5892] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 452.529098][ T5892] usb 10-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 452.529118][ T5892] usb 10-1: Product: syz [ 452.529131][ T5892] usb 10-1: SerialNumber: syz [ 452.533111][ T5892] usb 10-1: config 0 descriptor?? [ 452.537565][ T5892] cm109 10-1:0.8: invalid payload size 0, expected 4 [ 452.539393][ T5892] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.8/input/input11 [ 452.937261][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 453.239897][T10258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.240113][T10258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.315424][T10217] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.315660][T10217] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.345191][T10263] binder: BINDER_SET_CONTEXT_MGR already set [ 453.345201][T10263] binder: 10261:10263 ioctl 4018620d 200000000100 returned -16 [ 453.346388][T10263] binder: BINDER_SET_CONTEXT_MGR already set [ 453.346394][T10263] binder: 10261:10263 ioctl 4018620d 2000000002c0 returned -16 [ 453.403376][T10217] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 453.408927][T10217] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 453.442213][T10268] 9pnet_fd: p9_fd_create_unix (10268): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 453.457612][T10268] i2c-slave-eeprom 0-0001: i2c_slave_register: client slave flag not set. You might see address collisions [ 453.457629][T10268] i2c-slave-eeprom 0-0001: i2c_slave_register: invalid address [ 453.459707][T10268] i2c-slave-eeprom 0-0001: probe with driver i2c-slave-eeprom failed with error -22 [ 453.463569][T10268] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x01 [ 453.525146][ T5865] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.525168][ T5865] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.525294][ T5865] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.525309][ T5865] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.525371][ T5865] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.525385][ T5865] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.525457][ T5865] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.525473][ T5865] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.606072][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 453.606274][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 453.606479][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 453.606675][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 453.606793][ T8308] usb 10-1: USB disconnect, device number 8 [ 453.606861][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 453.606872][ C3] cm109 10-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 453.613674][ T8308] cm109 10-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 453.746975][T10280] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1465'. [ 453.746997][T10280] netlink: 'syz.4.1465': attribute type 7 has an invalid length. [ 453.747004][T10280] netlink: 'syz.4.1465': attribute type 8 has an invalid length. [ 453.747010][T10280] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1465'. [ 453.835521][T10285] syzkaller1: entered promiscuous mode [ 453.835536][T10285] syzkaller1: entered allmulticast mode [ 453.997818][T10291] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1469'. [ 454.022101][T10293] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1470'. [ 454.166435][ T5139] ldm_validate_privheads(): Disk read failed. [ 454.166504][ T5139] loop0: [ 454.166515][ T5139] loop0: partition table partially beyond EOD, truncated [ 454.189986][ T43] audit: type=1400 audit(1789016089.988:34899): avc: denied { listen } for pid=10309 comm="syz.4.1478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 454.234960][T10316] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1481'. [ 454.284266][ T5799] Bluetooth: hci3: command 0x1003 tx timeout [ 454.285259][ T5792] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 454.390214][T10331] netlink: 'syz.4.1486': attribute type 39 has an invalid length. [ 454.596618][ T25] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 454.764283][ T25] usb 10-1: Using ep0 maxpacket: 16 [ 454.770003][ T25] usb 10-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 454.771189][ T25] usb 10-1: config 0 has an invalid interface number: 8 but max is 0 [ 454.771210][ T25] usb 10-1: config 0 has no interface number 0 [ 454.771241][ T25] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 454.771263][ T25] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 454.772708][ T25] usb 10-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 454.772728][ T25] usb 10-1: Product: syz [ 454.772740][ T25] usb 10-1: SerialNumber: syz [ 454.806197][ T25] usb 10-1: config 0 descriptor?? [ 454.812387][ T25] cm109 10-1:0.8: invalid payload size 0, expected 4 [ 454.814194][ T25] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.8/input/input12 [ 454.883560][T10334] netlink: 'syz.0.1487': attribute type 12 has an invalid length. [ 455.242922][ C2] cm109 10-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 455.270316][ T43] audit: type=1400 audit(1789016091.058:34900): avc: denied { map } for pid=10357 comm="syz.4.1495" path="socket:[36352]" dev="sockfs" ino=36352 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 455.270347][ T43] audit: type=1400 audit(1789016091.058:34901): avc: denied { read write } for pid=10357 comm="syz.4.1495" path="socket:[36352]" dev="sockfs" ino=36352 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 455.402152][T10381] gadgetfs: bound to dummy_udc driver [ 455.423575][ T43] audit: type=1400 audit(1789016091.218:34902): avc: denied { unmount } for pid=7149 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 455.441739][ T5139] ldm_validate_privheads(): Disk read failed. [ 455.441770][ T5139] loop0: [ 455.441779][ T5139] loop0: partition table partially beyond EOD, truncated [ 455.491294][T10325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.491499][T10325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.561679][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 455.561875][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 455.562054][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 455.562229][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 455.562347][ T5934] usb 10-1: USB disconnect, device number 9 [ 455.562411][ C3] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 455.562422][ C3] cm109 10-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 455.586651][ T5934] cm109 10-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 455.654731][ T8308] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 455.655857][ C0] gadgetfs: connected [ 455.656196][T10405] __nla_validate_parse: 14 callbacks suppressed [ 455.656206][T10405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1514'. [ 455.656474][ T8308] gadgetfs: disconnected [ 455.762128][T10383] gadgetfs: suspended from state 2 [ 455.768724][ T7149] ================================================================== [ 455.768735][ T7149] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 [ 455.768768][ T7149] Read of size 8 at addr ffff88803015fc58 by task syz-executor/7149 [ 455.768776][ T7149] [ 455.768783][ T7149] CPU: 2 UID: 0 PID: 7149 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 455.768798][ T7149] Tainted: [L]=SOFTLOCKUP [ 455.768802][ T7149] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 455.768809][ T7149] Call Trace: [ 455.768812][ T7149] [ 455.768817][ T7149] dump_stack_lvl+0x100/0x190 [ 455.768833][ T7149] print_report+0x13d/0x4b0 [ 455.768849][ T7149] ? __virt_addr_valid+0x239/0x430 [ 455.768860][ T7149] ? __mutex_lock+0x15c5/0x1bd0 [ 455.768874][ T7149] kasan_report+0xdf/0x1c0 [ 455.768891][ T7149] ? __mutex_lock+0x15c5/0x1bd0 [ 455.768906][ T7149] __mutex_lock+0x15c5/0x1bd0 [ 455.768920][ T7149] ? ep_open+0x4c/0x2c0 [ 455.768938][ T7149] ? __pfx_avc_has_perm+0x10/0x10 [ 455.768952][ T7149] ? hook_file_open+0x248/0x8e0 [ 455.768967][ T7149] ? __pfx___mutex_lock+0x10/0x10 [ 455.768983][ T7149] ? __pfx_selinux_file_open+0x10/0x10 [ 455.768996][ T7149] ? ep_open+0x4c/0x2c0 [ 455.769010][ T7149] ep_open+0x4c/0x2c0 [ 455.769025][ T7149] do_dentry_open+0x6ab/0x14d0 [ 455.769036][ T7149] ? __pfx_ep_open+0x10/0x10 [ 455.769052][ T7149] vfs_open+0x82/0x3f0 [ 455.769080][ T7149] path_openat+0x19fa/0x2440 [ 455.769094][ T7149] ? __pfx_path_openat+0x10/0x10 [ 455.769108][ T7149] do_file_open+0x20e/0x430 [ 455.769123][ T7149] ? __pfx_do_file_open+0x10/0x10 [ 455.769140][ T7149] ? _raw_spin_unlock+0x28/0x50 [ 455.769151][ T7149] ? alloc_fd+0x471/0x7a0 [ 455.769166][ T7149] do_sys_openat2+0x10f/0x1e0 [ 455.769180][ T7149] ? __pfx_do_sys_openat2+0x10/0x10 [ 455.769196][ T7149] __x64_sys_openat+0x12d/0x210 [ 455.769211][ T7149] ? __pfx___x64_sys_openat+0x10/0x10 [ 455.769225][ T7149] ? putname+0xb1/0x110 [ 455.769240][ T7149] do_syscall_64+0x123/0x790 [ 455.769254][ T7149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.769266][ T7149] RIP: 0033:0x7f7d1dd5e98e [ 455.769275][ T7149] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 455.769286][ T7149] RSP: 002b:00007ffd4f031388 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 455.769297][ T7149] RAX: ffffffffffffffda RBX: 0000555565b99500 RCX: 00007f7d1dd5e98e [ 455.769304][ T7149] RDX: 0000000000000000 RSI: 00007ffd4f0314f0 RDI: ffffffffffffff9c [ 455.769311][ T7149] RBP: 00007ffd4f0314f0 R08: 0000000000000000 R09: 0000000000000000 [ 455.769317][ T7149] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4f0325e0 [ 455.769324][ T7149] R13: 00007f7d1de3448b R14: 0000555565b994e8 R15: 0000000000000006 [ 455.769334][ T7149] [ 455.769341][ T7149] [ 455.769343][ T7149] Allocated by task 10381: [ 455.769367][ T7149] kasan_save_stack+0x30/0x50 [ 455.769381][ T7149] kasan_save_track+0x14/0x30 [ 455.769392][ T7149] __kasan_kmalloc+0xaa/0xb0 [ 455.769402][ T7149] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 455.769417][ T7149] gadgetfs_bind+0x582/0x890 [ 455.769431][ T7149] gadget_bind_driver+0x28c/0xbf0 [ 455.769442][ T7149] really_probe+0x241/0xa60 [ 455.769452][ T7149] __driver_probe_device+0x210/0x460 [ 455.769462][ T7149] driver_probe_device+0x4a/0x140 [ 455.769473][ T7149] __driver_attach+0x21f/0x5b0 [ 455.769483][ T7149] bus_for_each_dev+0x13e/0x1d0 [ 455.769497][ T7149] bus_add_driver+0x305/0x5b0 [ 455.769505][ T7149] driver_register+0x1e2/0x360 [ 455.769517][ T7149] usb_gadget_register_driver_owner+0x132/0x210 [ 455.769527][ T7149] dev_config+0xdce/0x1610 [ 455.769541][ T7149] vfs_write+0x2aa/0x1050 [ 455.769549][ T7149] ksys_write+0x12a/0x250 [ 455.769558][ T7149] do_syscall_64+0x123/0x790 [ 455.769571][ T7149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.769581][ T7149] [ 455.769583][ T7149] Freed by task 10383: [ 455.769588][ T7149] kasan_save_stack+0x30/0x50 [ 455.769598][ T7149] kasan_save_track+0x14/0x30 [ 455.769608][ T7149] kasan_save_free_info+0x3b/0x70 [ 455.769630][ T7149] __kasan_slab_free+0x5f/0x80 [ 455.769641][ T7149] kfree+0x22b/0x6d0 [ 455.769654][ T7149] put_ep+0x117/0x150 [ 455.769667][ T7149] destroy_ep_files+0x163/0x420 [ 455.769680][ T7149] gadgetfs_unbind+0x139/0x260 [ 455.769694][ T7149] gadget_unbind_driver+0x20c/0x4f0 [ 455.769704][ T7149] device_remove+0xcb/0x180 [ 455.769714][ T7149] device_release_driver_internal+0x44e/0x620 [ 455.769726][ T7149] driver_detach+0xd8/0x1b0 [ 455.769737][ T7149] bus_remove_driver+0x13b/0x2e0 [ 455.769745][ T7149] driver_unregister+0x76/0xb0 [ 455.769757][ T7149] usb_gadget_unregister_driver+0x49/0x70 [ 455.769767][ T7149] dev_release+0x132/0x1b0 [ 455.769780][ T7149] __fput+0x3ff/0xb50 [ 455.769792][ T7149] task_work_run+0x150/0x240 [ 455.769807][ T7149] do_exit+0x951/0x2ae0 [ 455.769819][ T7149] do_group_exit+0xd5/0x2a0 [ 455.769831][ T7149] get_signal+0x1ec7/0x21e0 [ 455.769841][ T7149] arch_do_signal_or_restart+0x91/0x7e0 [ 455.769857][ T7149] irqentry_exit+0x402/0xa10 [ 455.769869][ T7149] asm_exc_page_fault+0x26/0x30 [ 455.769879][ T7149] [ 455.769881][ T7149] The buggy address belongs to the object at ffff88803015fc00 [ 455.769881][ T7149] which belongs to the cache kmalloc-512 of size 512 [ 455.769889][ T7149] The buggy address is located 88 bytes inside of [ 455.769889][ T7149] freed 512-byte region [ffff88803015fc00, ffff88803015fe00) [ 455.769899][ T7149] [ 455.769902][ T7149] The buggy address belongs to the physical page: [ 455.769906][ T7149] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3015c [ 455.769916][ T7149] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 455.769924][ T7149] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 455.769933][ T7149] page_type: f5(slab) [ 455.769942][ T7149] raw: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 [ 455.769951][ T7149] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 455.769960][ T7149] head: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 [ 455.769969][ T7149] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 455.769978][ T7149] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 455.769986][ T7149] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 455.769992][ T7149] page dumped because: kasan: bad access detected [ 455.769997][ T7149] page_owner tracks the page as allocated [ 455.770000][ T7149] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5786, tgid 5786 (syz-executor), ts 394051566336 [ 455.770017][ T7149] post_alloc_hook+0xfd/0x120 [ 455.770030][ T7149] get_page_from_freelist+0x110d/0x35d0 [ 455.770046][ T7149] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 455.770062][ T7149] new_slab+0xa9/0x6e0 [ 455.770076][ T7149] refill_objects+0xe3/0x410 [ 455.770091][ T7149] __pcs_replace_empty_main+0x35e/0x650 [ 455.770106][ T7149] __kvmalloc_node_noprof+0x7bb/0x9b0 [ 455.770118][ T7149] fib_create_info+0xccd/0x4640 [ 455.770133][ T7149] fib_table_insert+0x169/0x1c70 [ 455.770142][ T7149] fib_magic+0x4d4/0x5c0 [ 455.770154][ T7149] fib_add_ifaddr+0x16d/0x560 [ 455.770166][ T7149] fib_inetaddr_event+0x147/0x270 [ 455.770179][ T7149] notifier_call_chain+0x99/0x3f0 [ 455.770192][ T7149] blocking_notifier_call_chain+0x69/0xa0 [ 455.770207][ T7149] __inet_insert_ifa+0x91d/0xc70 [ 455.770217][ T7149] inet_rtm_newaddr+0xeb1/0x18c0 [ 455.770227][ T7149] page last free pid 5795 tgid 5795 ts 393415192043 stack trace: [ 455.770234][ T7149] __free_frozen_pages+0x79f/0x10f0 [ 455.770247][ T7149] qlist_free_all+0x47/0xf0 [ 455.770256][ T7149] kasan_quarantine_reduce+0x1a0/0x1f0 [ 455.770267][ T7149] __kasan_slab_alloc+0x69/0x90 [ 455.770278][ T7149] __kmalloc_cache_noprof+0x278/0x6d0 [ 455.770292][ T7149] ref_tracker_alloc+0x190/0x590 [ 455.770305][ T7149] register_netdevice+0x17e7/0x25a0 [ 455.770318][ T7149] virt_wifi_newlink+0x3ec/0x840 [ 455.770333][ T7149] rtnl_newlink+0x1697/0x2620 [ 455.770345][ T7149] rtnetlink_rcv_msg+0x95e/0xe90 [ 455.770356][ T7149] netlink_rcv_skb+0x159/0x420 [ 455.770366][ T7149] netlink_unicast+0x585/0x850 [ 455.770375][ T7149] netlink_sendmsg+0x8b0/0xda0 [ 455.770385][ T7149] __sys_sendto+0x48b/0x4e0 [ 455.770393][ T7149] __x64_sys_sendto+0xe0/0x1c0 [ 455.770403][ T7149] do_syscall_64+0x123/0x790 [ 455.770415][ T7149] [ 455.770418][ T7149] Memory state around the buggy address: [ 455.770422][ T7149] ffff88803015fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 455.770429][ T7149] ffff88803015fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 455.770436][ T7149] >ffff88803015fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 455.770442][ T7149] ^ [ 455.770448][ T7149] ffff88803015fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 455.770455][ T7149] ffff88803015fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 455.770460][ T7149] ================================================================== [ 455.771382][ T7149] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 456.047807][ T7149] CPU: 2 UID: 0 PID: 7149 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 456.051092][ T7149] Tainted: [L]=SOFTLOCKUP [ 456.052435][ T7149] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 456.055504][ T7149] Call Trace: [ 456.056554][ T7149] [ 456.057462][ T7149] dump_stack_lvl+0x100/0x190 [ 456.058922][ T7149] vpanic+0x553/0x970 [ 456.060154][ T7149] ? __pfx_vpanic+0x10/0x10 [ 456.061419][ T7149] ? rcu_is_watching+0x13/0xc0 [ 456.062759][ T7149] ? __mutex_lock+0x15c5/0x1bd0 [ 456.064278][ T7149] panic+0xd1/0xe0 [ 456.065440][ T7149] ? __pfx_panic+0x10/0x10 [ 456.066811][ T7149] ? __mutex_lock+0x15c5/0x1bd0 [ 456.068329][ T7149] ? preempt_schedule_common+0x3c/0xb0 [ 456.070110][ T7149] check_panic_on_warn.cold+0x19/0x34 [ 456.071723][ T7149] end_report.part.0+0x3a/0x90 [ 456.073186][ T7149] kasan_report.cold+0xe/0x18 [ 456.074996][ T7149] ? __mutex_lock+0x15c5/0x1bd0 [ 456.076786][ T7149] __mutex_lock+0x15c5/0x1bd0 [ 456.078612][ T7149] ? ep_open+0x4c/0x2c0 [ 456.080195][ T7149] ? __pfx_avc_has_perm+0x10/0x10 [ 456.082123][ T7149] ? hook_file_open+0x248/0x8e0 [ 456.083936][ T7149] ? __pfx___mutex_lock+0x10/0x10 [ 456.085690][ T7149] ? __pfx_selinux_file_open+0x10/0x10 [ 456.087665][ T7149] ? ep_open+0x4c/0x2c0 [ 456.089217][ T7149] ep_open+0x4c/0x2c0 [ 456.090713][ T7149] do_dentry_open+0x6ab/0x14d0 [ 456.092431][ T7149] ? __pfx_ep_open+0x10/0x10 [ 456.094207][ T7149] vfs_open+0x82/0x3f0 [ 456.095764][ T7149] path_openat+0x19fa/0x2440 [ 456.097506][ T7149] ? __pfx_path_openat+0x10/0x10 [ 456.099235][ T7149] do_file_open+0x20e/0x430 [ 456.100643][ T7149] ? __pfx_do_file_open+0x10/0x10 [ 456.102197][ T7149] ? _raw_spin_unlock+0x28/0x50 [ 456.103732][ T7149] ? alloc_fd+0x471/0x7a0 [ 456.105092][ T7149] do_sys_openat2+0x10f/0x1e0 [ 456.106591][ T7149] ? __pfx_do_sys_openat2+0x10/0x10 [ 456.108575][ T7149] __x64_sys_openat+0x12d/0x210 [ 456.110442][ T7149] ? __pfx___x64_sys_openat+0x10/0x10 [ 456.112467][ T7149] ? putname+0xb1/0x110 [ 456.114091][ T7149] do_syscall_64+0x123/0x790 [ 456.115708][ T7149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.117522][ T7149] RIP: 0033:0x7f7d1dd5e98e [ 456.119184][ T7149] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 456.125713][ T7149] RSP: 002b:00007ffd4f031388 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 456.128611][ T7149] RAX: ffffffffffffffda RBX: 0000555565b99500 RCX: 00007f7d1dd5e98e [ 456.131011][ T7149] RDX: 0000000000000000 RSI: 00007ffd4f0314f0 RDI: ffffffffffffff9c [ 456.133438][ T7149] RBP: 00007ffd4f0314f0 R08: 0000000000000000 R09: 0000000000000000 [ 456.135806][ T7149] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4f0325e0 [ 456.138321][ T7149] R13: 00007f7d1de3448b R14: 0000555565b994e8 R15: 0000000000000006 [ 456.140705][ T7149] [ 456.142247][ T7149] Kernel Offset: disabled [ 456.143791][ T7149] Rebooting in 86400 seconds.. VM DIAGNOSIS: 04:54:51 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=ffffea0000523380 RCX=ffffffff8250a553 RDX=0000000000000001 RSI=0000000000000000 RDI=ffff88802a99cb00 RBP=0000000000000001 RSP=ffffc90003b1f278 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=ffffea0000523388 R13=0000000000000000 R14=ffff888023374d00 R15=0000000000000001 RIP=ffffffff8250a553 RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5b5a000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f27ca5efff8 CR3=00000000260d1000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=000000000534c002 Opmask01=0000000000000000 Opmask02=00000000f1000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558ef2f76600 0000558ef2f76600 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff48f97d00 0000003000000010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6c737973007325 2e73250064252e73 2500656c6f736e6f 632f7665642f000a ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a49565c56005600 0b56000041000b56 000040494a564b4a 460a5340410a000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 74746120676e6973 7261702072657466 61207265766f7466 656c207365747962 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 313d657669737369 6d726570206d6574 737973656c69663d 7373616c63742074 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5f73666e3a725f74 63656a626f3a755f 6d65747379733d74 7865746e6f637420 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 745f6d6461737973 3a725f6d64617379 733a746f6f723d74 7865746e6f637320 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 22726f7475636578 652d7a7973223d6d 6d6f632039343137 3d6469702020726f ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=ffff88802ab74b00 RSI=ffffffff81ff7ef7 RDI=ffff88802ab74b00 RBP=ffffc90002827c68 RSP=ffffc90002827b60 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=ffffc90002827be0 R13=0000000000000003 R14=fffff52000504f7d R15=0000000000000001 RIP=ffffffff81ff7ef9 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 000055558689d500 ffffffff 00c00000 GS =0000 ffff8880d5c5a000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000110c32443f CR3=000000002e14b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefffc00 Opmask01=0000000000000054 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055555d498284 000055555d498280 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7b22ff2e80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7b22ff2e80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055555d497d88 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 48d04537581a42f0 1c251ee52b05189d cf2db0ce6fca1607 a52140080588030e ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00080007000c0008 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 251e4c11cce5f9f1 e8c52cc20c020f75 5efc065aed150ae2 566310cb7ea865ff ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 cc00000003001f00 08000e41fcf8a6e7 a5f5aee1b0b8cdef 865c98f1b03268b1 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0100100008800401 000000080606016c 9c00080008e00300 100008d003001000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 08c00302100008b0 030ce01000079003 1101cc0000000300 1f0008000e41fcf8 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 a6e7a5f5aee1b0b8 cdef865c98f1b032 68b1251e4c11cce5 f9f1e8c52cc20c02 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0f755efc065aed15 0ae2566310cb7ea8 65ff18d46bcc436d 31ea40e09be22e42 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000039 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b076c5 RDI=ffffffff9bc6aca0 RBP=ffffffff9bc6ac60 RSP=ffffc90005207000 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000034313754 R12=0000000000000000 R13=0000000000000039 R14=0000000000000004 R15=ffffc90005207318 RIP=ffffffff85b076ef RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555565b99500 ffffffff 00c00000 GS =0000 ffff8880d5d5a000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f49805b8e9c CR3=00000000371e0000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000104080 Opmask01=000000000000003f Opmask02=00000000fffdffbf Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558eb4fc87d0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fedb29f1b20 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fedb29f1b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000ff000000ff 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffff00 ffffffffffffffff ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7366746567646167 2f73726576697264 2f7465676461672f 7375622f7379732f ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 540018534b4e494c 56454400184d4554 5359534255530018 4854415056454400 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7361647c2a737369 63637c2a65686361 63627c2a6476787c 2a64767c2a64737c ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558eb4fd92b0 0000558eb4fe74b0 0000558eb4fcaf80 0000558eb4fe0360 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558eb4fdac80 0000558eb4fd0020 0000558eb4fd9710 0000558eb4fd0670 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558eb4fce580 0000558eb4fd8480 0000558eb4fe8a70 0000558eb4fd9e70 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558eb4fd1f40 0000558eb4fe7140 0000558eb50487e0 0000558eb4fd89f0 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000558eb4fc6fb0 0000000000000041 000000004d551b5f ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000558174f4c 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000000e3aa3 RBX=ffff88801f2d0000 RCX=ffffffff8bd08185 RDX=0000000000000001 RSI=ffffffff8e3ede41 RDI=ffffffff8c622780 RBP=ffffed1003e5a000 RSP=ffffc900001a7e00 R8 =0000000000000001 R9 =ffffed100d4e67bd R10=ffff88806a733deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000034fc4 R15=dffffc0000000000 RIP=ffffffff8bd066bf RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c01300 GS =0000 ffff8880d5e5a000 ffffffff 00c01300 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=0000000035cb7000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73657479625f6563 69767265735f6f69 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffcb5074306 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffcb5074306 00007ffcb507430c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f774463561e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f774463565e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f77446357c2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7744635650 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000