last executing test programs: 1.40931767s ago: executing program 1 (id=465): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) (async) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r1, &(0x7f0000000580)=ANY=[@ANYBLOB="d60400007d0000000524010000000000000000000000000000000000000000000c4000005a83fe55000000000000000000002e00046e6f645a3dbf640237fc6225ffffff8005000000000000ff03ff92e91600059b65712c93cb3db6c231d119aaa139007002007dfa673effeb09b5351f5bde054000000000187b82d9b56928fbbf0b00002b595fcb14034354b9fd9ef196a51cd5157adc8106b494e13500cf60372d61cceab8c88641eb93b4ccf6002ab87bfc012796093f68305c4d2220837e0108e2e748501c51484ba02f109caaf91509a25500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cdb80e8d40700000037009d036f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0c41f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa75f8246bcc42eaa8c631c0c500959a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238593aed3b42ee7cac07de09d1d68a60333a882467d2b31aafb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d538f382066664c0fb4e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae122e6105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fc200000030e4ee2bfc7f8050851143e5161acd47150acbaf743822dfe203b108d37e914dc1e53e234c509eca4117a1712caa9da53d051c36884c79182661f3ca36bcdbfbbd267109f8319d8dd5c07099eb1b11030655f562694f61743d19421b4a09ef8b8b4ce9c993c7d6cb300c4e657a4e50a35b5cc16b8c161a8e3df9036bbcf28adcd19a6c4c291709aee5ab3e5bc5ae29f475e4d24408b5167d0faf5fc1566b705c8b60afa8aca42f7e0469188a0ef062ca18e38f9ee10ac77d2b7eb9d60ea79fdb556411e59dfbd8dbb8a2a6622ebcf82b4c696fa4da21bad2320d0d68e9bf4346f0686119a39e400395c8f2825ea069ae0e143bd1a44179ed8e3cea0b5e9a19cc7ffa500fa41b6c8049bde45827d54ec901d27ad125056889b3336b3f06838c5b667ae22efe3bc15b825f7fbce48027281cf9fe8fc21fc77c243de26705310eb81cf74de0293192a13f6ad057de61fd8aba8ef4439bc06a45b2b03162515a23433afeb52aedb5ab6f334653380515f779f35dc8a78c37772492a2284c21d21356d473f00f85137c7bf0636f757d3528869b3f007735cff85c9d978bf55dcc26d62d25e308f08827a91ff47bec92f8e91e7908665400aa4e39b35986239d5c7b9492c5bb26bc55b55b49ed70486e6e7da38c208450f9f79e1b4100000000000093b1b800000000000000ae2d5b5c99f717f0a07749239b5d08f8c5c0ad7951e0a7c7f3db8dfd3f8657258a6c04f32d57ad2873de45fa98b0f8267917ff9bbe9c0d74a5aca206fe29e0c1039f22553c2747425d831030782ee78f8ba35de318c53f094f9227239cdf0184a15175da5cc9782e94b6c870a487678bfae745dff268bda7fdec873ce4fb4b8dcba0419b30449adfef724162bfb10aafcfea48a67fae7733cc3a7f1eef91be5285215eab41f66f45792943571a168b256b685030b0825e765f6d71419591f4c9fc609277303dee39885c1f555dae91dd21d60f08b8d93850b4e0d813eabeb185b963c408dc4d6f33254f08169c21d52a4fbdac0224a0e5d1fea822dda140ae556249f9bc28e2bad918dca3b46009010f1e8cc812ea61ee3688849112b22b1bbc6d6e116a50dec24c5cfc9765f48741ffd2314dcc9ccef04305ec5e8c343cb57188ecb50b49f5f8cd4e549caa685396436d198ccbfcf55796e14b587cc27b26012b5573705eca59e37801db63d6a888137eb721dd9f47e7e73909055d77c3ddcfad44b7d1335b99df8ac5504ebdba35e7eaa0b5a2b2db28ff307a436622c8bb541017d4a19352dfb9e2e98e758a0ff78b9a2342d5224ca0c142abf22a828de279a1bc6ac9472e5578ac606007f7bb3c469367f4d727e08a722ef1aa66175cdd397f06df7543e99fc806bd69addd3ec77cf7b09536917590ce2cdde44d4b7ef4e50a924d7e730fa6eead0fbac4d4e8662df87717efead2f776c7aa02d4f342585276b0617423c4140f7ade0569b704d100eedd26f2f98fe07ad9347f6959d43cc302be68f5b435da1d9379ed590485234cc5c916116e", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0], 0x4d6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f0000000000)={0x0, 0x4, {0xffffffffffffffff}, {0xee01}, 0xffffffffffffffa6, 0x4}) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) connect$nfc_llcp(r5, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "f235cd041ecfd237d48b9fc39aa09025f026b0634b6f82bded015a1b2cc967eff95fd0b6841d40ae65cd6ddd03de31eba0328a09ff4f717c7b1b1c65e750c8"}, 0x60) (async) r6 = syz_open_procfs$namespace(r4, &(0x7f0000000080)='ns/net\x00') ioctl$BTRFS_IOC_ADD_DEV(r6, 0xb701, 0x0) 1.305238974s ago: executing program 2 (id=467): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000ec0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001f40)={0x30, r8, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r10}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x2b}]}, 0x30}, 0x1, 0x0, 0x0, 0xc840}, 0x44000) sendmsg$NL80211_CMD_SET_STATION(r6, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="100025bd7000fedbdf251200000008000300", @ANYRES32=r2, @ANYBLOB="05001900000000000600ab00050000000600b5003a0300006cd5ebb8c9bb736990c3e11d664a7cb066d9bbfec56be850b9393c67419cae3c4d56623bda81bc3c543bfe63ea1bc156aabbc939accfa75a05cb5934ebd238910a5f725fa33ec1504f618c66"], 0x34}, 0x1, 0x0, 0x0, 0x20064000}, 0x40000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@newtaction={0x44, 0x2e, 0xffff, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ife={0x2c, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0xf}, {0xffffffffffffffc6, 0x8, {0x2, 0x1}}}}]}]}, 0x44}}, 0x0) getdents(r3, &(0x7f0000000040)=""/50, 0x32) getdents64(r3, 0x0, 0x43) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20080a0}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, r1, 0x100, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x80000000, 0x6a}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x16, 0xcd, [0x5, 0x81, 0x1, 0x4, 0x7, 0x1, 0x200, 0xc8, 0xffff]}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x8, 0xcd, [0x2, 0x5]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4088}, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x34, r1, 0x401, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0xc, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000000) 1.242943773s ago: executing program 2 (id=469): r0 = socket$netlink(0x10, 0x3, 0x15) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0x11, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_key={0x2, 0x9, 0x40, 0x0, "1cdc0dca1d9f6884"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x2}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x7}}, @sadb_x_nat_t_type={0x1, 0x14, 0x7}]}, 0x88}, 0x1, 0x7}, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff060025000000190004000400ad4a0d00000000000006000000000000f9313200"/57, 0x39}], 0x1) 1.242815543s ago: executing program 2 (id=470): socket$kcm(0xa, 0x2, 0x0) syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a31000000001400048008000240e7b140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x2c, 0x4, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x89}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x14}, 0x880) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000040)={0x1}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0x10, 0x0, 0x0, 0x2004cb, 0x3, 0x100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x2], 0x0, 0x200306}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.090487216s ago: executing program 1 (id=473): openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x900) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r11 = dup(r10) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) 1.035435914s ago: executing program 2 (id=476): ioperm(0x104, 0x2, 0x1) arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, &(0x7f00000000c0)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101600, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0xf, 0x2, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r4, 0x6a, 0x4, 0xfffffffe, 0x4) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r5, 0x0, 0xf, &(0x7f0000000000)='\x00', 0x1) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000000)=0x2, 0x4) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') prctl$PR_SET_PTRACER(0x59616d61, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 574.373317ms ago: executing program 1 (id=488): socket$kcm(0xa, 0x2, 0x0) syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0x10, 0x0, 0x0, 0x2004cb, 0x3, 0x100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x2], 0x0, 0x200306}) ioctl$KVM_RUN(r2, 0xae80, 0xff01000000000000) 574.185175ms ago: executing program 3 (id=489): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x34, r1, 0x401, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0xc, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000000) (fail_nth: 3) 573.867636ms ago: executing program 3 (id=490): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00'}) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100000000000000000008"], 0x14}], 0x1}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNGETFILTER(r2, 0x801054db, &(0x7f0000000140)=""/97) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x2c, r4, 0x10ada85e65c25349, 0x70bd2b, 0x0, {{0x67}, {@val={0x8}, @val={0xc, 0x99, {0x8, 0x4}}}}, [@NL80211_ATTR_TID_CONFIG={0x4, 0x142}]}, 0x2c}}, 0x6048004) sendmsg$NL80211_CMD_TESTMODE(r3, &(0x7f00000005c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000580)={&(0x7f0000000400)={0x15c, r4, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8000, 0x28}}}}, [@NL80211_ATTR_TESTDATA={0x102, 0x45, "24567b0f01206d00853b93b96afc3361208517ec7ff61db130948e1b1d758f65dbb1c399da1bd8d18d3e8cf15e9e0fd77ffbe27ef10288451cc3b40d2dd2bdf8e0d5535721f5cfcd46480fa685add58a1b6437099bfc3ef24c50948608ff2baa5e0176e82d000c5f8c93f23a6f4f474487bb01e5a7301205de2383039aa1694536029b8e1a32817323a7f740bae84be40d52151459163af84ec5872712180f8dad69c9acca8bc83de525f530e8b71b83a571946615eca23baf34bcc7aa6abb61f47c671c3df3f643d35fe912c6b364753e39b72d2c52727e90a79fbf9069e9a73a7dcb14ced44e0ed7b61e2b1441179a4f784fa8e61ea89f7d302c3d0166"}, @NL80211_ATTR_TESTDATA={0x21, 0x45, "17d0c9b1b7ecf4966a8afb115a33a8833a6f7384d3dbc8cf5f39641d52"}, @NL80211_ATTR_TESTDATA={0x12, 0x45, "cd410d4c426cfcd4be0f55067022"}]}, 0x15c}, 0x1, 0x0, 0x0, 0x20000001}, 0x80) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file2\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000000)={0x18, 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'ip6gre0\x00'}}, 0x1e) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000080)={0x18, 0x0, {0x2, @local, 'ip_vti0\x00'}}, 0x1e) close(r6) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0/file2\x00', 0x1432a8, 0x12) 491.99953ms ago: executing program 1 (id=493): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000280)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(r1) r3 = fcntl$dupfd(r0, 0x406, r1) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0, 0x1000}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000080)={0x0, r2}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000002c0)) syz_emit_ethernet(0x46, &(0x7f0000000400)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x38, 0x80, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x6, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x67, 0x0, 0x0, 0x89, 0x0, @loopback, @multicast2}, "00186371ae9b1c03"}}}}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x401, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x5}]}}}]}, 0x50}}, 0x0) r5 = getpid() syz_pidfd_open(r5, 0x0) r6 = syz_open_procfs(r5, &(0x7f00000000c0)='net/vlan/config\x00') preadv(r6, &(0x7f00000014c0)=[{&(0x7f0000000340)=""/191, 0xbf}], 0x1, 0x182, 0xffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x7, &(0x7f0000000040)=@framed={{0xffffffb4, 0x6, 0x0, 0x0, 0x0, 0x71, 0x11, 0x24, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7}, @map_fd={0x18, 0x1, 0x1, 0x0, r6}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x94) 424.236237ms ago: executing program 0 (id=494): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x900) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) 423.035257ms ago: executing program 0 (id=495): r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) recvfrom$inet6(r1, &(0x7f0000000040)=""/26, 0x1a, 0x2, 0x0, 0xffffffffffffffce) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x2b8, 0xb0000010, 0x0, 0x5c8f0200, 0x250, 0x3a8, 0x3a8, 0x250, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [0x0, 0x0, 0xffffffff], [], 'vlan1\x00', 'veth0_to_team\x00', {0xff}}, 0x0, 0xa8, 0xf0, 0x700}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8000206, 'syz1\x00'}}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x87, 0x80, 0x2, 0xfe, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @private0, @empty, [0x49fc5045ed3ae8ef, 0xff000000, 0x6675841787364651, 0xff], [0xff, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0xffffff00, 0x8000007f, 0xff], 0x202, 0x8}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) socket$inet6_udp(0xa, 0x2, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) listen(r1, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) (async) recvfrom$inet6(r1, &(0x7f0000000040)=""/26, 0x1a, 0x2, 0x0, 0xffffffffffffffce) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x2b8, 0xb0000010, 0x0, 0x5c8f0200, 0x250, 0x3a8, 0x3a8, 0x250, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [0x0, 0x0, 0xffffffff], [], 'vlan1\x00', 'veth0_to_team\x00', {0xff}}, 0x0, 0xa8, 0xf0, 0x700}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8000206, 'syz1\x00'}}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x87, 0x80, 0x2, 0xfe, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @private0, @empty, [0x49fc5045ed3ae8ef, 0xff000000, 0x6675841787364651, 0xff], [0xff, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0xffffff00, 0x8000007f, 0xff], 0x202, 0x8}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) (async) 422.896478ms ago: executing program 1 (id=496): openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x900) r1 = socket$inet(0x2, 0x5, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000080)="441f0803000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = dup3(r2, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write(r6, &(0x7f0000001280)='\f', 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) 422.419652ms ago: executing program 3 (id=497): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYBLOB="d2877bd1680cfe777465bde413d79ab691fa3cc42906f33ba21f6764bc793f7c887399893c8d72bfa8d53b2d1b1a3ef628f8e288bc04c38e300e71c4545468a389e66ef2ff70"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 268.881261ms ago: executing program 0 (id=498): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x34, r1, 0x401, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0xc, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000000) (fail_nth: 4) 268.680258ms ago: executing program 0 (id=499): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt(r1, 0x0, 0x7, 0x0, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800e00010069703665727370616e000000100002800400120008000100", @ANYRES32=0x0, @ANYBLOB="39254da26ac08a967ef94178571ca7a4d8272ef33099b0b574b6452e215eab60600bb22cdbe66615cb94ec7112f24ecb6ba451ba4c726123033b75f7cf2bf349d62a826cc5c7857d16684b0deb66696f95"], 0x44}}, 0x0) 193.224737ms ago: executing program 0 (id=500): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$KDFONTOP_GET(r0, 0x4b72, &(0x7f0000000840)={0x1, 0x1, 0x15, 0x1f, 0x15e, &(0x7f0000000440)}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="9e000000", @ANYRES16, @ANYBLOB="05000000003200000000060000000800e71a", @ANYRESOCT=r2, @ANYBLOB="0800050002000000"], 0x24}, 0x1, 0x0, 0x0, 0x8000001}, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0xffffffffffffffff, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x2000000003, 0xc39, 0x8000003, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x6, 0x800000000000001, 0x7, 0xfffffffffffffffb, 0x81, 0x100, 0x5, 0x931, 0x101, 0x3, 0xf, 0x8000000000000000, 0x7, 0x1, 0x8, 0x77, 0x6a8, 0x102, 0xe, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x3, 0x8000000000000000, 0x5, 0x9, 0x80008000, 0x8000000000000000, 0x40000000000004, 0xffffffff, 0xfffffffffffffffd, 0x5bc, 0x1, 0x0, 0x4, 0x8000, 0xc9, 0x0, 0x6, 0x9, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x26, 0xffffffffffffffff, 0x7, 0xbfa, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0x4, 0x3, 0x7, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x1, 0x2300000003, 0x5, 0x7, 0x406, 0x3, 0x6, 0x5, 0x1, 0x3, 0x10000, 0x7fffffff, 0x7, 0x3, 0x1]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) r4 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000002540)={0x73622a85, 0x1114, 0x2}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r3, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000000)=[@request_death={0x400c630e, 0x0, 0xfcff}, @clear_death], 0x0, 0x0, 0x0}) setsockopt$RDS_CONG_MONITOR(r6, 0x114, 0x6, &(0x7f0000000040), 0x4) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) 134.200899ms ago: executing program 3 (id=501): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000001c0)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000001400)=ANY=[@ANYBLOB='\x00\x00\x00\f'], 0x152) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x34, r3, 0x401, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0xc, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000000) 74.097126ms ago: executing program 1 (id=502): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x41000, 0x1}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$netlink(0x10, 0x3, 0xf) getsockopt$sock_buf(r2, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="e80100002e000100000000000000000004001980d20109"], 0x1e8}], 0x1, 0x0, 0x0, 0x84}, 0x300) r5 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x5, 0x10001, 0x7fff, 0xa, 0x1}, 0x50) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="de53cfbdd9787737b4f951fdd80574f710cf3fe7c468376dff3f639ccb0c51d27e55829a88b468438d293b798dfa930d835dcec48d16ded81297bab88aeec1ce58b5330101e53b4d5e883cf1352675519b06388f6f0d04b7d92ef2d3200df943c8256d67d33c048654697e2e8a596369f7a8c2ec04f8895682645973101c", @ANYRES16=r8, @ANYBLOB="01003cbd7000fddbdf250100000008000100000000000c000200090000000400000004000780"], 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x400c0) read$FUSE(r6, &(0x7f0000004100)={0x2020}, 0x2020) sendmsg$nl_route(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)=@dellink={0x3e4, 0x11, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, 0x32102, 0x40020}, [@IFLA_MTU={0x8, 0x4, 0x4}, @IFLA_VFINFO_LIST={0x3ac, 0x16, 0x0, 0x1, [{0xfc, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x2, 0x1}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x4, 0x6665}}, @IFLA_VF_VLAN_LIST={0x90, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x2, 0xdf2, 0x9, 0x88a8}}, {0x14, 0x1, {0x8000, 0xcb0, 0x0, 0x8100}}, {0x14, 0x1, {0x2, 0xd08, 0x4, 0x8100}}, {0x14, 0x1, {0x4, 0xe34, 0x1, 0x9a8}}, {0x14, 0x1, {0x5b, 0xbab, 0x5, 0x8100}}, {0x14, 0x1, {0x0, 0xdc2, 0xffff0001, 0x8100}}, {0x14, 0x1, {0x0, 0x57a, 0xf5c5, 0x9a8}}]}, @IFLA_VF_TRUST={0xc, 0x9, {0x4, 0x8}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x2, 0x1}}, @IFLA_VF_VLAN={0x10, 0x2, {0x6, 0x393, 0x7}}, @IFLA_VF_RATE={0x10, 0x6, {0x4, 0x9, 0x5}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x8, 0x6}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1, 0x2}}]}, {0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x200, 0x8}}]}, {0x48, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x4, 0x7, 0x4}}, @IFLA_VF_MAC={0x28, 0x1, {0x4, @local}}, @IFLA_VF_TRUST={0xc, 0x9, {0x3, 0x80000001}}]}, {0x38, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x1, 0x5}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xfffffffe, 0x6}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x8, 0x40}}]}, {0x70, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x7, 0x883f}}, @IFLA_VF_RATE={0x10, 0x6, {0xf, 0xe810, 0x9}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0xffffffff, 0x80000000}}, @IFLA_VF_VLAN={0x10, 0x2, {0xa, 0xba9, 0x7}}, @IFLA_VF_RATE={0x10, 0x6, {0x84, 0xef54, 0x9}}, @IFLA_VF_RATE={0x10, 0x6, {0xe, 0x7, 0x1ff}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x11, 0x8}}]}, {0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x4, 0xffff}}]}, {0x18c, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0x8, 0x4}}, @IFLA_VF_VLAN_LIST={0x40, 0xc, 0x0, 0x1, [{0x14, 0x1, {0xffff, 0x57a, 0x70a, 0x8100}}, {0x14, 0x1, {0x1, 0xfdf, 0x6, 0x8100}}, {0x14, 0x1, {0xfffffffd, 0x43, 0x2, 0x88a8}}]}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x7f, 0x9}}, @IFLA_VF_MAC={0x28, 0x1, {0x3, @broadcast}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xffffffff, 0x5}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1000, 0x800}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1cc, 0x1000}}, @IFLA_VF_VLAN={0x10, 0x2, {0x7fff, 0xb53, 0x8001}}, @IFLA_VF_VLAN_LIST={0xcc, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x305, 0x4ed, 0x0, 0x88a8}}, {0x14, 0x1, {0x4, 0xb64, 0x7, 0x9a8}}, {0x14, 0x1, {0xfffffffd, 0x2a, 0x3, 0x8100}}, {0x14, 0x1, {0x1, 0x379, 0x2, 0x88a8}}, {0x14, 0x1, {0x4, 0x1f2, 0x8e89, 0x88a8}}, {0x14, 0x1, {0x1d34, 0x9f2, 0x7fffffff, 0x8100}}, {0x14, 0x1, {0x40, 0x711, 0xbe4, 0x8100}}, {0x14, 0x1, {0xfffffffe, 0x1d, 0x735149f3, 0xccfc}}, {0x14, 0x1, {0x5, 0xd4a, 0x10000, 0x88a8}}, {0x14, 0x1, {0x0, 0x927, 0x5, 0x8100}}]}]}]}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x3}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x20008042}, 0x80080) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x405, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10408, 0x2140}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000881}, 0x200000c4) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(r9, 0x1, &(0x7f0000000240)={0x0, 0x401, 0x2f}) r10 = shmget$private(0x0, 0x9000, 0x0, &(0x7f0000ff7000/0x9000)=nil) r11 = shmat(r10, &(0x7f0000ff9000/0x1000)=nil, 0x5000) shmdt(r11) getsockopt$sock_int(r0, 0x1, 0x4, 0x0, &(0x7f0000000080)) 73.898807ms ago: executing program 2 (id=503): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x900) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) 13.773159ms ago: executing program 0 (id=504): r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x40000) ioctl$SNDRV_PCM_IOCTL_INFO(r0, 0x81204101, &(0x7f0000000040)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='hugetlbfs\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) (async) r3 = socket(0x40000000015, 0x5, 0x0) bind$inet(r3, 0x0, 0x0) sendmsg$xdp(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) pipe(0x0) (async, rerun: 64) r4 = socket(0x2a, 0x2, 0x0) (async) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000013000100000000000000000000000002", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) (async) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) (async) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, &(0x7f00000001c0)={[{@nr_inodes={'nr_inodes', 0x3d, [0x38]}}]}) 13.579158ms ago: executing program 3 (id=505): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2ee295da8597357a, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bond0\x00', 0x1}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, &(0x7f00000000c0)=0x4) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000001c0)={0x2, &(0x7f0000000040)=[{0x30, 0x80, 0x5, 0xfffff018}, {0x6, 0x0, 0x0, 0x5387cf8b}]}) 13.306584ms ago: executing program 2 (id=506): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0x10) ppoll(&(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x5, @any, 0x0, 0x1}, 0xe) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="6c0167f40f00130702000000fcdbdf51000000000000000000000000000000012001d2f8e1df6300000000000000000000000000014e2000004e210202020020", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe8000000000000000000000000000bb000000fc32000000fe800000000000000000000000000042000000000000000000000000000000000c00000000000000080000000000000000000000000000000000000000000000000000000000000043050000000000000400000000000000ffffffffffffff7f0000000000000000fcffffffffffffff00000000000000000000000028bd7000003500000200040010000000000000005f001200726663343130362867636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009800000060000000217d66d38547aa140db8a200000000c538c7cb001c0004002d004e244e240000fe80000000000000000000000000002c"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048081}, 0xc000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000006c0)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=507): r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000000)={0xddd, {{0xa, 0x4e22, 0x0, @mcast2}}}, 0x88) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) add_key(&(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r3, 0x4068aea3, &(0x7f0000000200)) kernel console output (not intermixed with test programs): [ 43.996290][ T40] audit: type=1400 audit(1778552243.356:116): avc: denied { rlimitinh } for pid=5643 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.004380][ T40] audit: type=1400 audit(1778552243.356:117): avc: denied { siginh } for pid=5643 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.787172][ T40] audit: type=1400 audit(1778552244.166:118): avc: denied { write } for pid=5648 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.825704][ T40] audit: type=1400 audit(1778552244.206:119): avc: denied { write } for pid=5651 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.908239][ T40] audit: type=1400 audit(1778552244.286:120): avc: denied { write } for pid=5654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.964252][ T40] audit: type=1400 audit(1778552244.346:121): avc: denied { write } for pid=5657 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:3651' (ED25519) to the list of known hosts. [ 47.524148][ T5676] cgroup: Unknown subsys name 'net' [ 47.685552][ T5676] cgroup: Unknown subsys name 'cpuset' [ 47.689738][ T5676] cgroup: Unknown subsys name 'rlimit' [ 47.906883][ T5719] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 48.619061][ T5676] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 52.587726][ T40] kauditd_printk_skb: 36 callbacks suppressed [ 52.587743][ T40] audit: type=1400 audit(1778552251.966:158): avc: denied { execmem } for pid=5727 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 52.747330][ T40] audit: type=1400 audit(1778552252.126:159): avc: denied { create } for pid=5731 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.757258][ T40] audit: type=1400 audit(1778552252.126:160): avc: denied { create } for pid=5732 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.764995][ T40] audit: type=1400 audit(1778552252.126:161): avc: denied { read write } for pid=5733 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1291 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 52.774916][ T40] audit: type=1400 audit(1778552252.126:162): avc: denied { open } for pid=5733 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1291 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 52.782648][ T40] audit: type=1400 audit(1778552252.126:163): avc: denied { open } for pid=5732 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1291 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 52.783217][ T5737] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 52.790231][ T40] audit: type=1400 audit(1778552252.136:164): avc: denied { ioctl } for pid=5732 comm="syz-executor" path="socket:[7315]" dev="sockfs" ino=7315 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.800587][ T5744] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 52.800741][ T5745] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 52.801275][ T5745] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 52.802624][ T5745] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 52.804212][ T5737] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 52.804604][ T5737] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 52.806450][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 52.809470][ T5744] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 52.810128][ T5745] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 52.810647][ T5745] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 52.810996][ T5745] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 52.812373][ T5737] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 52.814331][ T5744] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 52.814916][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 52.816105][ T5748] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 52.819612][ T5737] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 52.820628][ T40] audit: type=1400 audit(1778552252.196:165): avc: denied { read } for pid=5739 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 52.824083][ T5737] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 52.825671][ T40] audit: type=1400 audit(1778552252.196:166): avc: denied { open } for pid=5739 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 52.826016][ T5748] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 52.826580][ T5748] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 52.870106][ T40] audit: type=1400 audit(1778552252.196:167): avc: denied { mounton } for pid=5739 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 53.303561][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.306381][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.308734][ T5731] bridge_slave_0: entered allmulticast mode [ 53.311468][ T5731] bridge_slave_0: entered promiscuous mode [ 53.324287][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.326827][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.329216][ T5731] bridge_slave_1: entered allmulticast mode [ 53.331949][ T5731] bridge_slave_1: entered promiscuous mode [ 53.379121][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.404293][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.436160][ T5731] team0: Port device team_slave_0 added [ 53.442873][ T5731] team0: Port device team_slave_1 added [ 53.461753][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.465074][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.473319][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.490688][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.495077][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.503256][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.627686][ T5731] hsr_slave_0: entered promiscuous mode [ 53.630598][ T5731] hsr_slave_1: entered promiscuous mode [ 53.668752][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.672141][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.675556][ T5739] bridge_slave_0: entered allmulticast mode [ 53.679664][ T5739] bridge_slave_0: entered promiscuous mode [ 53.691276][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.694057][ T5732] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.696589][ T5732] bridge_slave_0: entered allmulticast mode [ 53.699404][ T5732] bridge_slave_0: entered promiscuous mode [ 53.714106][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.717476][ T5732] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.720386][ T5732] bridge_slave_1: entered allmulticast mode [ 53.723535][ T5732] bridge_slave_1: entered promiscuous mode [ 53.732277][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.734894][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.737393][ T5739] bridge_slave_1: entered allmulticast mode [ 53.740209][ T5739] bridge_slave_1: entered promiscuous mode [ 53.760749][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.763785][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.766960][ T5733] bridge_slave_0: entered allmulticast mode [ 53.771132][ T5733] bridge_slave_0: entered promiscuous mode [ 53.798393][ T5732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.807554][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.810092][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.813573][ T5733] bridge_slave_1: entered allmulticast mode [ 53.817291][ T5733] bridge_slave_1: entered promiscuous mode [ 53.821897][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.827985][ T5732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.858517][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.873658][ T5732] team0: Port device team_slave_0 added [ 53.894093][ T5732] team0: Port device team_slave_1 added [ 53.898062][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.911374][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.931189][ T5739] team0: Port device team_slave_0 added [ 53.946151][ T5739] team0: Port device team_slave_1 added [ 53.961895][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.964402][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.972409][ T5732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.982179][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.984379][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.992406][ T5732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.008927][ T5733] team0: Port device team_slave_0 added [ 54.015638][ T5733] team0: Port device team_slave_1 added [ 54.022850][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.025755][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.036536][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.057872][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.060720][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.071323][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.109044][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.111882][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.122113][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.128708][ T5732] hsr_slave_0: entered promiscuous mode [ 54.131008][ T5732] hsr_slave_1: entered promiscuous mode [ 54.133206][ T5732] debugfs: 'hsr0' already exists in 'hsr' [ 54.135060][ T5732] Cannot create hsr debugfs directory [ 54.157711][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.159889][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.168397][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.202338][ T5739] hsr_slave_0: entered promiscuous mode [ 54.204618][ T5739] hsr_slave_1: entered promiscuous mode [ 54.206808][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 54.208721][ T5739] Cannot create hsr debugfs directory [ 54.307359][ T5733] hsr_slave_0: entered promiscuous mode [ 54.310668][ T5733] hsr_slave_1: entered promiscuous mode [ 54.313899][ T5733] debugfs: 'hsr0' already exists in 'hsr' [ 54.316993][ T5733] Cannot create hsr debugfs directory [ 54.361576][ T5731] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 54.371315][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 54.403681][ T5731] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 54.410591][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 54.414395][ T5731] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 54.420870][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 54.457830][ T5731] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 54.465410][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 54.592349][ T5732] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 54.597474][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 54.600683][ T5732] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 54.607141][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 54.613102][ T5732] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 54.617179][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 54.623440][ T5732] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 54.629809][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 54.702725][ T5739] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 54.707865][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 54.719449][ T5739] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 54.724794][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 54.735727][ T5739] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 54.740144][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 54.746523][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.761305][ T5739] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 54.765785][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 54.806966][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.812254][ T5733] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 54.817212][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 54.820596][ T5733] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 54.825636][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 54.833289][ T5733] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 54.837746][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 54.840676][ T5733] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 54.844466][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 54.852819][ T5743] Bluetooth: hci1: command tx timeout [ 54.852825][ T5737] Bluetooth: hci0: command tx timeout [ 54.852888][ T5092] Bluetooth: hci2: command tx timeout [ 54.853114][ T62] Bluetooth: hci3: command tx timeout [ 54.859132][ T1233] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.863161][ T1233] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.877635][ T1233] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.880070][ T1233] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.905539][ T5732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.944457][ T5732] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.956061][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.959085][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.983687][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.986167][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.997345][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.027062][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.033857][ T1233] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.036239][ T1233] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.053215][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.055691][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.074476][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.112826][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.125363][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.128575][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.140116][ T85] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.142613][ T85] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.228802][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.256953][ T5731] veth0_vlan: entered promiscuous mode [ 55.269389][ T5731] veth1_vlan: entered promiscuous mode [ 55.290231][ T5731] veth0_macvtap: entered promiscuous mode [ 55.295565][ T5731] veth1_macvtap: entered promiscuous mode [ 55.304807][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.311448][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.328480][ T1168] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.332448][ T1168] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.347283][ T1168] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.350043][ T1168] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.356704][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.422571][ T1233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.428327][ T1233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.448151][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.460212][ T5732] veth0_vlan: entered promiscuous mode [ 55.469656][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.475410][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.476007][ T5732] veth1_vlan: entered promiscuous mode [ 55.505169][ T5732] veth0_macvtap: entered promiscuous mode [ 55.511570][ T5732] veth1_macvtap: entered promiscuous mode [ 55.521368][ T5731] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 55.526612][ T5739] veth0_vlan: entered promiscuous mode [ 55.538131][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.551468][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.556105][ T5739] veth1_vlan: entered promiscuous mode [ 55.568328][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.587300][ T1163] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.591598][ T1163] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.601760][ T1163] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.605630][ T1163] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.627624][ T5879] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 55.666848][ T5739] veth0_macvtap: entered promiscuous mode [ 55.688321][ T5733] veth0_vlan: entered promiscuous mode [ 55.691054][ T5739] veth1_macvtap: entered promiscuous mode [ 55.695408][ T1233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.700463][ T1233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.712668][ T5733] veth1_vlan: entered promiscuous mode [ 55.730285][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.734625][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.739505][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.752122][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.779263][ T1163] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.784320][ T1163] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.795055][ T5733] veth0_macvtap: entered promiscuous mode [ 55.799534][ T1163] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.803438][ T1163] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.806011][ T5883] loop9: detected capacity change from 0 to 4096 [ 55.819021][ T5733] veth1_macvtap: entered promiscuous mode [ 55.847744][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.871636][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.898300][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.902319][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.914612][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.924721][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.927516][ T59] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.930551][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.965087][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.968218][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.023351][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.027967][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.032425][ T5092] Bluetooth: hci0: Malformed LE Event: 0x0b [ 56.080804][ T1233] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.085236][ T1233] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.098873][ T5899] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 56.238103][ T5913] netlink: 80 bytes leftover after parsing attributes in process `syz.2.13'. [ 56.449558][ T5092] Bluetooth: hci3: Malformed LE Event: 0x0b [ 56.520382][ T5092] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 56.682980][ T5955] syz_tun: entered allmulticast mode [ 56.690734][ T5955] dvmrp8: entered allmulticast mode [ 56.694690][ T5954] syz_tun: left allmulticast mode [ 56.718457][ T5958] ======================================================= [ 56.718457][ T5958] WARNING: The mand mount option has been deprecated and [ 56.718457][ T5958] and is ignored by this kernel. Remove the mand [ 56.718457][ T5958] option from the mount to silence this warning. [ 56.718457][ T5958] ======================================================= [ 56.733823][ T5958] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 56.737777][ T5958] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 56.741189][ T5958] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 56.808529][ T5962] syzkaller0: entered promiscuous mode [ 56.811127][ T5962] syzkaller0: entered allmulticast mode [ 56.910927][ T5969] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 56.921154][ T5969] CIFS mount error: No usable UNC path provided in device string! [ 56.921154][ T5969] [ 56.924741][ T5969] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 56.932739][ T5092] Bluetooth: hci1: command tx timeout [ 56.942751][ T5743] Bluetooth: hci3: command tx timeout [ 56.942882][ T5737] Bluetooth: hci2: command tx timeout [ 56.946443][ T5092] Bluetooth: hci0: command tx timeout [ 57.218248][ T5977] Bluetooth: MGMT ver 1.23 [ 57.219808][ T5977] Bluetooth: hci0: invalid len left 7, exp >= 51 [ 57.327881][ T5979] warning: `syz.0.32' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 57.333005][ T5979] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.32'. [ 57.336818][ T5979] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 57.532221][ T5893] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 57.706775][ T5983] netlink: 'syz.1.36': attribute type 20 has an invalid length. [ 57.709374][ T5983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.36'. [ 57.715790][ T5893] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 57.718579][ T5893] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 57.722176][ T5893] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 57.727306][ T5893] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 57.727377][ T46] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 57.727466][ T5983] netlink: 'syz.1.36': attribute type 20 has an invalid length. [ 57.727483][ T5983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.36'. [ 57.729923][ T5893] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 57.733064][ T46] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 57.733085][ T46] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 57.733103][ T46] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 57.733849][ T5983] Zero length message leads to an empty skb [ 57.736711][ T5893] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 57.759842][ T5893] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 57.763419][ T5893] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 57.767981][ T5893] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 57.775906][ T5893] usb 8-1: string descriptor 0 read error: -22 [ 57.778557][ T5893] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 57.781604][ T5893] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.794344][ T5893] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 57.812679][ T40] kauditd_printk_skb: 104 callbacks suppressed [ 57.812689][ T40] audit: type=1400 audit(1778552257.196:272): avc: denied { unmount } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 57.915779][ T5989] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 58.051468][ T5092] Bluetooth: hci3: Malformed LE Event: 0x0b [ 58.065838][ T5893] usb 8-1: USB disconnect, device number 2 [ 58.119801][ T40] audit: type=1400 audit(1778552257.496:273): avc: denied { create } for pid=5996 comm="syz.1.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 58.128248][ T40] audit: type=1400 audit(1778552257.496:274): avc: denied { sys_admin } for pid=5996 comm="syz.1.41" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 58.147997][ T40] audit: type=1400 audit(1778552257.526:275): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 58.232643][ T40] audit: type=1400 audit(1778552257.616:276): avc: denied { read write } for pid=6002 comm="syz.2.44" name="0:0:0:0" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 58.234798][ T6005] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 58.240669][ T40] audit: type=1400 audit(1778552257.616:277): avc: denied { open } for pid=6002 comm="syz.2.44" path="/dev/bsg/0:0:0:0" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 58.252636][ T40] audit: type=1400 audit(1778552257.616:278): avc: denied { ioctl } for pid=6002 comm="syz.2.44" path="/dev/bsg/0:0:0:0" dev="devtmpfs" ino=723 ioctlcmd=0x2202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 58.266458][ T6007] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 58.271471][ T6005] kvm: pic: level sensitive irq not supported [ 58.271961][ T6005] kvm: pic: non byte read [ 58.278275][ T6007] kvm: pic: level sensitive irq not supported [ 58.278533][ T6007] kvm: pic: non byte read [ 58.279463][ T6005] kvm: pic: level sensitive irq not supported [ 58.281479][ T6007] kvm: pic: level sensitive irq not supported [ 58.284948][ T6005] kvm: pic: non byte read [ 58.285551][ T6007] kvm: pic: non byte read [ 58.288087][ T6005] kvm: pic: level sensitive irq not supported [ 58.290547][ T6005] kvm: pic: non byte read [ 58.294962][ T6005] kvm: pic: level sensitive irq not supported [ 58.295197][ T6005] kvm: pic: non byte read [ 58.299359][ T6005] kvm: pic: level sensitive irq not supported [ 58.299598][ T6005] kvm: pic: non byte read [ 58.305404][ T6005] kvm: pic: level sensitive irq not supported [ 58.305634][ T6005] kvm: pic: non byte read [ 58.309972][ T6005] kvm: pic: level sensitive irq not supported [ 58.310204][ T6005] kvm: pic: non byte read [ 58.314666][ T6005] kvm: pic: level sensitive irq not supported [ 58.314940][ T6005] kvm: pic: non byte read [ 58.416825][ T40] audit: type=1400 audit(1778552257.796:279): avc: denied { write } for pid=6020 comm="syz.0.48" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 58.427176][ T6021] netlink: 'syz.0.48': attribute type 1 has an invalid length. [ 58.444216][ T6024] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 58.616871][ T40] audit: type=1400 audit(1778552257.996:280): avc: denied { write } for pid=6029 comm="syz.0.51" name="vlan0" dev="proc" ino=4026533677 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 58.715876][ T40] audit: type=1400 audit(1778552258.096:281): avc: denied { unmount } for pid=5731 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 58.790345][ T6045] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 58.790617][ T6044] netlink: 'syz.3.55': attribute type 10 has an invalid length. [ 58.802934][ T6044] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 59.012292][ T5092] Bluetooth: hci3: command tx timeout [ 59.014046][ T5092] Bluetooth: hci2: command tx timeout [ 59.014101][ T5743] Bluetooth: hci0: command tx timeout [ 59.016499][ T5092] Bluetooth: hci1: command tx timeout [ 59.019909][ T6052] capability: warning: `syz.0.59' uses deprecated v2 capabilities in a way that may be insecure [ 59.082157][ T2325] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 59.243606][ T2325] usb 8-1: Using ep0 maxpacket: 8 [ 59.246707][ T2325] usb 8-1: config 1 interface 0 has no altsetting 0 [ 59.250444][ T2325] usb 8-1: New USB device found, idVendor=054c, idProduct=0374, bcdDevice= 0.40 [ 59.256187][ T2325] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.260063][ T2325] usb 8-1: Product: syz [ 59.261858][ T2325] usb 8-1: Manufacturer: syz [ 59.264083][ T2325] usb 8-1: SerialNumber: syz [ 59.485716][ T2325] usbhid 8-1:1.0: can't add hid device: -71 [ 59.488014][ T2325] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 59.493728][ T2325] usb 8-1: USB disconnect, device number 3 [ 59.594592][ T6088] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 59.714501][ T6107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.75'. [ 59.729309][ T6107] team1: entered promiscuous mode [ 59.731095][ T6107] team1: entered allmulticast mode [ 59.750255][ T6103] binder: 6101:6103 ioctl c00c620f 200000000100 returned -22 [ 59.833981][ T6115] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 59.890596][ T6128] comedi comedi4: bad chanlist[0]=0x0400001f chan=31 range length=2 [ 59.979483][ T6135] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 60.024014][ T6144] netlink: 'syz.3.90': attribute type 2 has an invalid length. [ 60.029434][ T6144] netlink: 'syz.3.90': attribute type 1 has an invalid length. [ 60.040880][ T6151] netlink: 4 bytes leftover after parsing attributes in process `syz.1.91'. [ 60.055112][ T6153] F2FS-fs (nbd3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 60.058209][ T6153] F2FS-fs (nbd3): Can't find valid F2FS filesystem in 1th superblock [ 60.060934][ T6153] F2FS-fs (nbd3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 60.064940][ T6153] F2FS-fs (nbd3): Can't find valid F2FS filesystem in 2th superblock [ 60.075289][ T6153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.92'. [ 60.078503][ T6153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.92'. [ 60.118140][ T6160] netlink: 'syz.0.94': attribute type 3 has an invalid length. [ 60.120572][ T6160] netlink: 'syz.0.94': attribute type 1 has an invalid length. [ 60.124571][ T6151] netlink: 4 bytes leftover after parsing attributes in process `syz.1.91'. [ 60.125646][ T6160] netlink: 224 bytes leftover after parsing attributes in process `syz.0.94'. [ 60.131913][ T6160] NCSI netlink: No device for ifindex 33022 [ 60.177939][ T6165] syzkaller0: entered promiscuous mode [ 60.180720][ T6165] syzkaller0: entered allmulticast mode [ 60.184740][ T6165] 0: reclassify loop, rule prio 0, protocol 800 [ 60.354829][ T6181] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 60.399468][ T6185] bond1: entered promiscuous mode [ 60.401453][ T6185] 8021q: adding VLAN 0 to HW filter on device bond1 [ 60.405299][ T6188] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6188 comm=syz.0.104 [ 60.417914][ T6185] bond1: (slave sit1): refused to change device type [ 60.471812][ T6194] fuse: Unknown parameter 'ÿÿ0x0000000000000009' [ 60.578447][ T2325] IPVS: starting estimator thread 0... [ 60.672135][ T6202] IPVS: using max 45 ests per chain, 108000 per kthread [ 60.731160][ T6210] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 60.896255][ T6220] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 61.053682][ T5092] Bluetooth: hci0: Malformed LE Event: 0x0b [ 61.091386][ T6229] macvlan2: entered promiscuous mode [ 61.093585][ T5092] Bluetooth: hci0: command tx timeout [ 61.093608][ T5092] Bluetooth: hci2: command tx timeout [ 61.093621][ T5092] Bluetooth: hci3: command tx timeout [ 61.099922][ T6229] bridge0: entered promiscuous mode [ 61.102406][ T5743] Bluetooth: hci1: command tx timeout [ 61.173916][ T6235] netlink: 'syz.0.121': attribute type 13 has an invalid length. [ 61.186966][ T6235] gretap0: refused to change device tx_queue_len [ 61.189731][ T6235] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 61.304776][ T5743] Bluetooth: hci3: Malformed LE Event: 0x0b [ 61.321177][ T6251] __nla_validate_parse: 5 callbacks suppressed [ 61.321189][ T6251] netlink: 12 bytes leftover after parsing attributes in process `syz.0.127'. [ 61.330561][ T6251] netlink: 120 bytes leftover after parsing attributes in process `syz.0.127'. [ 61.387544][ T6257] process 'syz.2.128' launched '/dev/fd/5' with NULL argv: empty string added [ 61.455030][ T6269] binder: 6267:6269 ioctl c0306201 0 returned -14 [ 61.491184][ T5743] Bluetooth: hci3: Malformed LE Event: 0x0b [ 61.546285][ T6278] binder: 6268:6278 ioctl c0189373 200000000180 returned -22 [ 61.549379][ T6282] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 61.551892][ T6282] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 61.560282][ T6282] vhci_hcd vhci_hcd.0: Device attached [ 61.564507][ T6282] ªªªªªª: renamed from hsr0 (while UP) [ 61.678543][ T6293] rdma_op ffff8880585279f0 conn xmit_rdma 0000000000000000 [ 61.695925][ T6296] syz_tun: entered allmulticast mode [ 61.701854][ T6295] syz_tun: left allmulticast mode [ 61.723720][ T6283] vhci_hcd: connection closed [ 61.728013][ T1168] vhci_hcd vhci_hcd.1: stop threads [ 61.730988][ T5743] Bluetooth: hci0: Malformed LE Event: 0x0b [ 61.734810][ T1168] vhci_hcd vhci_hcd.1: release socket [ 61.739694][ T1168] vhci_hcd vhci_hcd.1: disconnect device [ 61.761286][ T6301] IPv6: syztnl0: Disabled Multicast RS [ 61.792397][ T24] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 61.794887][ T24] usb 39-1: enqueue for inactive port 0 [ 61.818588][ T6303] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 61.827049][ T6307] FAULT_INJECTION: forcing a failure. [ 61.827049][ T6307] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 61.833584][ T6307] CPU: 0 UID: 0 PID: 6307 Comm: syz.2.149 Not tainted syzkaller #0 PREEMPT(full) [ 61.833600][ T6307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.833607][ T6307] Call Trace: [ 61.833610][ T6307] [ 61.833615][ T6307] dump_stack_lvl+0x100/0x190 [ 61.833632][ T6307] should_fail_ex.cold+0x5/0xa [ 61.833647][ T6307] _copy_from_user+0x2e/0xd0 [ 61.833663][ T6307] comedi_unlocked_ioctl+0xf3f/0x3310 [ 61.833679][ T6307] ? tomoyo_path_number_perm+0x188/0x580 [ 61.833694][ T6307] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 61.833711][ T6307] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 61.833725][ T6307] ? do_vfs_ioctl+0x226/0x13e0 [ 61.833736][ T6307] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 61.833747][ T6307] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 61.833765][ T6307] ? __fget_files+0x215/0x3d0 [ 61.833778][ T6307] ? hook_file_ioctl_common+0x149/0x410 [ 61.833797][ T6307] ? selinux_file_ioctl+0x13b/0x290 [ 61.833810][ T6307] ? selinux_file_ioctl+0xb6/0x290 [ 61.833825][ T6307] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 61.833840][ T6307] __x64_sys_ioctl+0x18e/0x210 [ 61.833852][ T6307] do_syscall_64+0x10b/0xf80 [ 61.833865][ T6307] ? clear_bhb_loop+0x40/0x90 [ 61.833878][ T6307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.833889][ T6307] RIP: 0033:0x7fa31959cdd9 [ 61.833898][ T6307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.833907][ T6307] RSP: 002b:00007fa31a501028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.833918][ T6307] RAX: ffffffffffffffda RBX: 00007fa319815fa0 RCX: 00007fa31959cdd9 [ 61.833924][ T6307] RDX: 0000200000000000 RSI: 000000008028640c RDI: 0000000000000003 [ 61.833930][ T6307] RBP: 00007fa31a501090 R08: 0000000000000000 R09: 0000000000000000 [ 61.833936][ T6307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 61.833941][ T6307] R13: 00007fa319816038 R14: 00007fa319815fa0 R15: 00007ffc2a3e7688 [ 61.833954][ T6307] [ 61.862114][ T24] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 61.987260][ T2325] IPVS: starting estimator thread 0... [ 62.036940][ T6270] syz.3.135 (6270): drop_caches: 2 [ 62.040899][ T6270] syz.3.135 (6270): drop_caches: 2 [ 62.092135][ T6316] IPVS: using max 45 ests per chain, 108000 per kthread [ 62.125753][ T6328] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 62.234546][ T6331] tipc: Started in network mode [ 62.236989][ T6331] tipc: Node identity daa4a53c69bb, cluster identity 4711 [ 62.239419][ T6331] tipc: Enabled bearer , priority 0 [ 62.243427][ T6331] tipc: Resetting bearer [ 62.253926][ T6337] netlink: 'syz.1.160': attribute type 39 has an invalid length. [ 62.340832][ T6342] bond0: (slave bond_slave_0): Releasing backup interface [ 62.431941][ T6342] bond_slave_0: entered promiscuous mode [ 62.434847][ T6342] bond_slave_0: entered allmulticast mode [ 62.444065][ T6357] [U] ˜ÑjüSm¾ãÓÔ”¿H¨} [ 62.447415][ T6357] [U] íÇr©d¥ó±¶åiˆP@ɤ³ƒ­c%\Šºœ¥SÓò–ÑEBzª]i:±£Ó [ 62.450448][ T6357] [U] ˜ÑjüSm¾ãÓÔ”¿H¨} [ 62.455956][ T6356] [U] íÇr©d¥ó±¶åiˆP@ɤ³ƒ­c%\Šºœ¥SÓò–ÑEBzª]i:±£Ó [ 62.501353][ T6361] netlink: 64 bytes leftover after parsing attributes in process `syz.2.167'. [ 62.521078][ T5743] Bluetooth: hci1: Malformed LE Event: 0x0b [ 62.708358][ T6384] netlink: 68 bytes leftover after parsing attributes in process `syz.1.173'. [ 62.713092][ T6384] netlink: 68 bytes leftover after parsing attributes in process `syz.1.173'. [ 62.797223][ T6393] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 62.836279][ T6395] netlink: 12 bytes leftover after parsing attributes in process `syz.1.177'. [ 62.839875][ T6395] netlink: 4 bytes leftover after parsing attributes in process `syz.1.177'. [ 62.956173][ T6330] tipc: Disabling bearer [ 62.965030][ T6403] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 62.981384][ T40] kauditd_printk_skb: 126 callbacks suppressed [ 62.981395][ T40] audit: type=1400 audit(1778552262.356:408): avc: denied { ioctl } for pid=6400 comm="syz.0.179" path="socket:[13694]" dev="sockfs" ino=13694 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 63.046846][ T6409] FAULT_INJECTION: forcing a failure. [ 63.046846][ T6409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.053277][ T6409] CPU: 2 UID: 0 PID: 6409 Comm: syz.2.181 Not tainted syzkaller #0 PREEMPT(full) [ 63.053300][ T6409] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.053311][ T6409] Call Trace: [ 63.053316][ T6409] [ 63.053322][ T6409] dump_stack_lvl+0x100/0x190 [ 63.053362][ T6409] should_fail_ex.cold+0x5/0xa [ 63.053399][ T6409] _copy_to_user+0x32/0xd0 [ 63.053426][ T6409] simple_read_from_buffer+0xcb/0x170 [ 63.053448][ T6409] proc_fail_nth_read+0x1af/0x230 [ 63.053467][ T6409] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 63.053487][ T6409] ? rw_verify_area+0xce/0x6d0 [ 63.053501][ T6409] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 63.053518][ T6409] vfs_read+0x1e4/0xb30 [ 63.053545][ T6409] ? __pfx_vfs_read+0x10/0x10 [ 63.053563][ T6409] ? __fget_files+0x215/0x3d0 [ 63.053587][ T6409] ? __fget_files+0x21f/0x3d0 [ 63.053610][ T6409] ksys_read+0x12a/0x250 [ 63.053626][ T6409] ? __pfx_ksys_read+0x10/0x10 [ 63.053645][ T6409] ? rcu_is_watching+0x12/0xc0 [ 63.053675][ T6409] do_syscall_64+0x10b/0xf80 [ 63.053699][ T6409] ? clear_bhb_loop+0x40/0x90 [ 63.053721][ T6409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.053739][ T6409] RIP: 0033:0x7fa31955d60e [ 63.053755][ T6409] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 63.053770][ T6409] RSP: 002b:00007fa31a500fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 63.053788][ T6409] RAX: ffffffffffffffda RBX: 00007fa31a5016c0 RCX: 00007fa31955d60e [ 63.053799][ T6409] RDX: 000000000000000f RSI: 00007fa31a5010a0 RDI: 0000000000000004 [ 63.053809][ T6409] RBP: 00007fa31a501090 R08: 0000000000000000 R09: 0000000000000000 [ 63.053819][ T6409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 63.053829][ T6409] R13: 00007fa319816038 R14: 00007fa319815fa0 R15: 00007ffc2a3e7688 [ 63.053852][ T6409] [ 63.160000][ T40] audit: type=1400 audit(1778552262.536:409): avc: denied { create } for pid=6413 comm="syz.1.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 63.172094][ T40] audit: type=1400 audit(1778552262.536:410): avc: denied { read } for pid=6413 comm="syz.1.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 63.224819][ T6420] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 63.228189][ T6420] syzkaller0: entered promiscuous mode [ 63.229998][ T6420] syzkaller0: entered allmulticast mode [ 63.238243][ T6420] tipc: Started in network mode [ 63.240047][ T6420] tipc: Node identity 3e3aa119556b, cluster identity 4711 [ 63.244887][ T6420] tipc: Enabled bearer , priority 0 [ 63.249370][ T6419] tipc: Resetting bearer [ 63.259779][ T6419] tipc: Disabling bearer [ 63.278136][ T40] audit: type=1400 audit(1778552262.656:411): avc: denied { ioctl } for pid=6421 comm="syz.3.186" path="socket:[12926]" dev="sockfs" ino=12926 ioctlcmd=0x8941 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 63.348894][ T40] audit: type=1400 audit(1778552262.726:412): avc: denied { create } for pid=6424 comm="syz.2.187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 63.410053][ T40] audit: type=1400 audit(1778552262.786:413): avc: denied { name_connect } for pid=6424 comm="syz.2.187" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 63.490472][ T6437] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 63.497191][ T6437] validate_nla: 1 callbacks suppressed [ 63.497193][ T6438] netlink: 'syz.2.191': attribute type 3 has an invalid length. [ 63.497206][ T6437] netlink: 'syz.2.191': attribute type 3 has an invalid length. [ 63.542812][ T6444] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 63.545871][ T6444] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 63.553622][ T40] audit: type=1400 audit(1778552262.936:414): avc: denied { bind } for pid=6442 comm="syz.3.193" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 63.560896][ T40] audit: type=1400 audit(1778552262.936:415): avc: denied { name_bind } for pid=6442 comm="syz.3.193" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 63.568450][ T40] audit: type=1400 audit(1778552262.936:416): avc: denied { node_bind } for pid=6442 comm="syz.3.193" saddr=172.20.20.43 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 63.586777][ T6443] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 63.593043][ T40] audit: type=1400 audit(1778552262.976:417): avc: denied { lock } for pid=6446 comm="syz.3.194" path="/dev/video0" dev="devtmpfs" ino=955 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 63.738059][ T6453] pic_ioport_write: 4 callbacks suppressed [ 63.738076][ T6453] kvm: pic: level sensitive irq not supported [ 64.019020][ T6473] 9pnet_fd: p9_fd_create_tcp (6473): problem binding to privport [ 64.089226][ T6478] sg_write: data in/out 16777180/10 bytes for SCSI command 0x0-- guessing data in; [ 64.089226][ T6478] program syz.3.203 not setting count and/or reply_len properly [ 64.123273][ T6482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.204'. [ 64.128250][ T6482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.204'. [ 64.164533][ T6488] netlink: 348 bytes leftover after parsing attributes in process `syz.3.206'. [ 64.247019][ T6496] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=6496 comm=syz.3.209 [ 64.295140][ T6503] nbd: must specify at least one socket [ 64.316762][ T6502] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 64.337799][ T6502] picdev_read: 5 callbacks suppressed [ 64.337811][ T6502] kvm: pic: non byte read [ 64.343845][ T6502] kvm: pic: level sensitive irq not supported [ 64.344082][ T6502] kvm: pic: non byte read [ 64.348918][ T6502] kvm: pic: level sensitive irq not supported [ 64.349152][ T6502] kvm: pic: non byte read [ 64.354017][ T6502] kvm: pic: level sensitive irq not supported [ 64.354277][ T6502] kvm: pic: non byte read [ 64.365474][ T6502] kvm: pic: level sensitive irq not supported [ 64.365718][ T6502] kvm: pic: non byte read [ 64.369907][ T6502] kvm: pic: level sensitive irq not supported [ 64.370140][ T6502] kvm: pic: non byte read [ 64.374140][ T6502] kvm: pic: level sensitive irq not supported [ 64.374380][ T6502] kvm: pic: non byte read [ 64.378672][ T6502] kvm: pic: level sensitive irq not supported [ 64.378903][ T6502] kvm: pic: non byte read [ 64.382951][ T6502] kvm: pic: level sensitive irq not supported [ 64.383182][ T6502] kvm: pic: non byte read [ 64.387235][ T6502] kvm: pic: level sensitive irq not supported [ 64.387467][ T6502] kvm: pic: non byte read [ 64.503895][ T6517] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 64.792715][ T6549] nbd: illegal input index -2146435068 [ 64.845476][ T6553] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 65.060497][ T6561] : entered promiscuous mode [ 65.276582][ T6594] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.279915][ T6594] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.294769][ T6596] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 65.343831][ T6594] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.350679][ T6594] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.445979][ T1163] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.449853][ T1163] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.456121][ T1163] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.459305][ T1163] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.462628][ T2325] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 65.624767][ T2325] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 65.627895][ T2325] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 65.630938][ T2325] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 65.637213][ T2325] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 65.640112][ T2325] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 65.642851][ T2325] usb 5-1: Product: syz [ 65.644198][ T2325] usb 5-1: Manufacturer: syz [ 65.645726][ T2325] usb 5-1: SerialNumber: syz [ 65.706150][ T6624] netlink: 'syz.2.248': attribute type 10 has an invalid length. [ 65.710076][ T6624] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 65.800624][ T6630] netlink: 'syz.1.245': attribute type 1 has an invalid length. [ 65.816351][ T6630] 8021q: adding VLAN 0 to HW filter on device bond2 [ 65.827254][ T6630] option changes via remount are deprecated (pid=6629 comm=syz.1.245) [ 65.829924][ T6630] cgroup: option or name mismatch, new: 0x0 "none", old: 0x0 "" [ 65.854826][ T2325] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 65.869033][ T6633] netlink: 'syz.1.250': attribute type 21 has an invalid length. [ 66.112340][ T5609] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 66.292214][ T5609] usb 7-1: Using ep0 maxpacket: 32 [ 66.299167][ T6635] netlink: 'syz.2.251': attribute type 4 has an invalid length. [ 66.316725][ T6635] netlink: 'syz.2.251': attribute type 4 has an invalid length. [ 66.330244][ T5609] usb 7-1: unable to get BOS descriptor or descriptor too short [ 66.334452][ T5609] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 66.339053][ T5609] usb 7-1: can't read configurations, error -71 [ 66.516593][ T6648] block nbd3: shutting down sockets [ 66.574863][ T5823] usb 5-1: USB disconnect, device number 2 [ 66.584803][ T5823] usblp0: removed [ 66.641788][ T6655] cgroup: fork rejected by pids controller in /syz0 [ 67.001318][ T6781] __nla_validate_parse: 2 callbacks suppressed [ 67.001330][ T6781] netlink: 4 bytes leftover after parsing attributes in process `syz.1.268'. [ 67.025226][ T85] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.044538][ T6781] tmpfs: Bad value for 'mpol' [ 67.060999][ T6783] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 67.066242][ T6783] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 67.119821][ T85] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.179416][ T5092] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.180621][ T6799] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 67.184519][ T5092] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.188124][ T5092] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.189335][ T6799] bond3 (unregistering): Released all slaves [ 67.191356][ T5092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.196436][ T5092] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.213476][ T85] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.215570][ T6804] netlink: 8 bytes leftover after parsing attributes in process `syz.1.273'. [ 67.220509][ T6804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.273'. [ 67.331977][ T85] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.355610][ T6817] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6817 comm=syz.1.276 [ 67.407489][ T6823] netlink: 44 bytes leftover after parsing attributes in process `syz.1.277'. [ 67.411049][ T6823] netlink: 43 bytes leftover after parsing attributes in process `syz.1.277'. [ 67.420018][ T6823] netlink: 'syz.1.277': attribute type 6 has an invalid length. [ 67.422739][ T6823] netlink: 'syz.1.277': attribute type 5 has an invalid length. [ 67.425665][ T6823] netlink: 43 bytes leftover after parsing attributes in process `syz.1.277'. [ 67.550770][ T85] bridge_slave_1: left allmulticast mode [ 67.552993][ T85] bridge_slave_1: left promiscuous mode [ 67.555544][ T85] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.558568][ T6798] netlink: 348 bytes leftover after parsing attributes in process `syz.3.274'. [ 67.563664][ T85] bridge_slave_0: left allmulticast mode [ 67.565688][ T85] bridge_slave_0: left promiscuous mode [ 67.567886][ T85] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.604566][ T6837] netlink: 8 bytes leftover after parsing attributes in process `syz.1.279'. [ 67.728911][ T85] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 67.735219][ T85] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 67.739291][ T85] bond0 (unregistering): Released all slaves [ 67.743848][ T85] bond1 (unregistering): Released all slaves [ 67.760257][ T6837] bridge_slave_1: left allmulticast mode [ 67.762808][ T6837] bridge_slave_1: left promiscuous mode [ 67.766310][ T6837] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.774594][ T6837] bridge_slave_0: left allmulticast mode [ 67.776921][ T6837] bridge_slave_0: left promiscuous mode [ 67.779352][ T6837] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.863509][ T5444] 8021q: adding VLAN 0 to HW filter on device eth2 [ 67.991566][ T6801] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.994848][ T6801] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.998017][ T6801] bridge_slave_0: entered allmulticast mode [ 68.001953][ T6801] bridge_slave_0: entered promiscuous mode [ 68.007501][ T6801] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.010673][ T6801] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.013828][ T6801] bridge_slave_1: entered allmulticast mode [ 68.017762][ T6801] bridge_slave_1: entered promiscuous mode [ 68.027596][ T40] kauditd_printk_skb: 55 callbacks suppressed [ 68.027606][ T40] audit: type=1400 audit(1778552267.406:473): avc: denied { write } for pid=6844 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.080360][ T40] audit: type=1400 audit(1778552267.456:474): avc: denied { write } for pid=6849 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.101763][ T6801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.106422][ T6801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.116158][ T5444] 8021q: adding VLAN 0 to HW filter on device eth3 [ 68.126086][ T6801] team0: Port device team_slave_0 added [ 68.129961][ T6801] team0: Port device team_slave_1 added [ 68.152625][ T6801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.154965][ T6801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.164916][ T6801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.169179][ T6801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.171421][ T6801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.180811][ T6801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.218720][ T85] hsr_slave_0: left promiscuous mode [ 68.221030][ T85] hsr_slave_1: left promiscuous mode [ 68.224100][ T85] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 68.226560][ T85] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.229686][ T85] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 68.234532][ T85] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.236890][ T40] audit: type=1400 audit(1778552267.616:475): avc: denied { write } for pid=6856 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.251748][ T85] veth1_macvtap: left promiscuous mode [ 68.255499][ T85] veth0_macvtap: left promiscuous mode [ 68.257989][ T85] veth1_vlan: left promiscuous mode [ 68.260470][ T85] veth0_vlan: left promiscuous mode [ 68.301501][ T40] audit: type=1400 audit(1778552267.676:476): avc: denied { write } for pid=6862 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.376357][ T40] audit: type=1400 audit(1778552267.756:477): avc: denied { read } for pid=6870 comm="syz.3.285" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 68.385043][ T40] audit: type=1400 audit(1778552267.756:478): avc: denied { open } for pid=6870 comm="syz.3.285" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 68.437851][ T85] team0 (unregistering): Port device team_slave_1 removed [ 68.450817][ T85] team0 (unregistering): Port device team_slave_0 removed [ 68.533939][ T6801] hsr_slave_0: entered promiscuous mode [ 68.536668][ T6801] hsr_slave_1: entered promiscuous mode [ 68.538886][ T6801] debugfs: 'hsr0' already exists in 'hsr' [ 68.540760][ T6801] Cannot create hsr debugfs directory [ 68.547360][ T5444] 8021q: adding VLAN 0 to HW filter on device eth4 [ 68.576967][ T6864] syzkaller0: entered promiscuous mode [ 68.579073][ T6864] syzkaller0: entered allmulticast mode [ 69.089086][ T40] audit: type=1400 audit(1778552268.466:479): avc: denied { connect } for pid=6882 comm="syz.1.287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 69.095425][ T40] audit: type=1400 audit(1778552268.466:480): avc: denied { write } for pid=6882 comm="syz.1.287" path="socket:[15772]" dev="sockfs" ino=15772 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 69.214845][ T6872] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 69.220132][ T6872] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 69.232311][ T6872] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 69.252155][ T5743] Bluetooth: hci0: command tx timeout [ 69.263858][ T6872] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 69.266007][ T6872] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 69.273430][ T6872] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 69.291796][ T6872] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 69.293820][ T6872] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 69.311293][ T6872] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 69.321642][ T6872] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 69.325397][ T6872] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 69.337514][ T6872] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 69.408110][ T6889] overlayfs: overlapping lowerdir path [ 69.626956][ T40] audit: type=1400 audit(1778552269.006:481): avc: denied { read } for pid=6893 comm="syz.3.290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 69.650788][ T40] audit: type=1400 audit(1778552269.026:482): avc: denied { write } for pid=6896 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.706068][ T6903] netlink: 40 bytes leftover after parsing attributes in process `syz.2.292'. [ 69.711840][ T6900] netlink: 20 bytes leftover after parsing attributes in process `syz.3.291'. [ 69.838716][ T85] IPVS: stop unused estimator thread 0... [ 69.910048][ T6933] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 69.998251][ T6942] syzkaller1: entered promiscuous mode [ 70.000041][ T6942] syzkaller1: entered allmulticast mode [ 70.127551][ T6954] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6954 comm=syz.2.304 [ 70.132641][ T6954] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6954 comm=syz.2.304 [ 70.178672][ T6801] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.187699][ T6801] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.190506][ T6801] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.195083][ T6801] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.197795][ T6801] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.202412][ T6801] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.204973][ T6801] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.208783][ T6801] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.223529][ T6958] binder: 6957:6958 unknown command 1 [ 70.226817][ T6958] binder: 6957:6958 ioctl c0306201 200000000040 returned -22 [ 70.249741][ T6801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.262122][ T6801] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.267277][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.269619][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.279095][ T85] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.281405][ T85] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.351393][ T6982] binder: 6980:6982 ioctl c0306201 200000000080 returned -14 [ 70.358477][ T6982] binder: 6980:6982 ioctl c0306201 2000000003c0 returned -14 [ 70.422016][ T6993] 8021q: adding VLAN 0 to HW filter on device bond1 [ 70.441354][ T6993] 8021q: adding VLAN 0 to HW filter on device bond2 [ 70.451263][ T6993] bond1: (slave bond2): Enslaving as an active interface with an up link [ 70.514345][ T7000] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 70.580893][ T6801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.605151][ T7009] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 70.606112][ T6801] veth0_vlan: entered promiscuous mode [ 70.613308][ T6801] veth1_vlan: entered promiscuous mode [ 70.627872][ T6801] veth0_macvtap: entered promiscuous mode [ 70.632287][ T6801] veth1_macvtap: entered promiscuous mode [ 70.641901][ T6801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.649309][ T6801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.655780][ T1233] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.659278][ T1233] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.665335][ T1233] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.671219][ T1233] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.692777][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 70.723056][ T1233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.728559][ T1233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.746344][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.751533][ T7016] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 70.752146][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.900084][ T7034] program syz.2.318 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 71.134920][ T7057] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 71.161581][ T7062] bridge_slave_1: default FDB implementation only supports local addresses [ 71.265624][ T7062] mmap: syz.1.325 (7062) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 71.337999][ T7076] random: crng reseeded on system resumption [ 71.342485][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 71.344135][ T5092] Bluetooth: hci3: command 0x0c1a tx timeout [ 71.344858][ T62] Bluetooth: hci2: command 0x0c1a tx timeout [ 71.368382][ T7077] overlay: Bad value for 'workdir' [ 71.456733][ T7087] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 71.632266][ T7099] ubi31: attaching mtd0 [ 71.634925][ T7099] ubi31: scanning is finished [ 71.636457][ T7099] ubi31: empty MTD device detected [ 71.904652][ T7099] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 71.908867][ T7099] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 71.911991][ T7099] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 71.916180][ T7099] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 71.919440][ T7099] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 71.922275][ T7099] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 71.923700][ T7110] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 71.925617][ T7099] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 242468046 [ 71.933710][ T7099] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 71.938249][ T7112] ubi31: background thread "ubi_bgt31d" started, PID 7112 [ 72.041476][ T7119] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 72.074356][ T7122] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 72.096035][ T7124] __nla_validate_parse: 5 callbacks suppressed [ 72.096052][ T7124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.344'. [ 72.521761][ T7140] gfs2: not a GFS2 filesystem [ 72.782179][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 72.854124][ T7149] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 72.936796][ T7153] veth3: entered promiscuous mode [ 72.973569][ T7156] netlink: 4 bytes leftover after parsing attributes in process `syz.1.355'. [ 72.977210][ T7156] netlink: 80 bytes leftover after parsing attributes in process `syz.1.355'. [ 73.007008][ T7155] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 73.058104][ T7159] netlink: 'syz.1.357': attribute type 3 has an invalid length. [ 73.061451][ T7159] netlink: 'syz.1.357': attribute type 1 has an invalid length. [ 73.066172][ T7159] netlink: 4 bytes leftover after parsing attributes in process `syz.1.357'. [ 73.141385][ T40] kauditd_printk_skb: 51 callbacks suppressed [ 73.141396][ T40] audit: type=1400 audit(1778552272.516:534): avc: denied { mount } for pid=7160 comm="syz.1.358" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 73.159546][ T40] audit: type=1400 audit(1778552272.536:535): avc: denied { ioctl } for pid=7160 comm="syz.1.358" path="socket:[19584]" dev="sockfs" ino=19584 ioctlcmd=0x8924 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 73.168916][ T7161] Bluetooth: MGMT ver 1.23 [ 73.214315][ T40] audit: type=1400 audit(1778552272.596:536): avc: denied { connect } for pid=7168 comm="syz.2.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 73.221296][ T7169] netlink: 4388 bytes leftover after parsing attributes in process `syz.1.361'. [ 73.222388][ T7170] dummy0: entered allmulticast mode [ 73.224531][ T7169] netlink: 4388 bytes leftover after parsing attributes in process `syz.1.361'. [ 73.304533][ T7178] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 73.354601][ T40] audit: type=1400 audit(1778552272.736:537): avc: denied { listen } for pid=7184 comm="syz.1.365" lport=20002 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 73.414460][ T5092] Bluetooth: hci3: command 0x0c1a tx timeout [ 73.414524][ T5743] Bluetooth: hci2: command 0x0c1a tx timeout [ 73.416747][ T62] Bluetooth: hci0: command 0x040f tx timeout [ 73.427422][ T10] cfg80211: failed to load regulatory.db [ 73.455161][ T7191] netlink: 'syz.1.367': attribute type 39 has an invalid length. [ 73.502143][ T55] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 73.524068][ T7196] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 73.632143][ T55] usb 5-1: device descriptor read/64, error -71 [ 73.705031][ T40] audit: type=1400 audit(1778552273.086:538): avc: denied { ioctl } for pid=7207 comm="syz.2.373" path="socket:[19857]" dev="sockfs" ino=19857 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 73.882101][ T55] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 73.904776][ T7214] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 74.000088][ T7218] netlink: 8 bytes leftover after parsing attributes in process `syz.1.375'. [ 74.003193][ T7218] netlink: 12 bytes leftover after parsing attributes in process `syz.1.375'. [ 74.006323][ T7218] netlink: 8 bytes leftover after parsing attributes in process `syz.1.375'. [ 74.009229][ T7218] netlink: 12 bytes leftover after parsing attributes in process `syz.1.375'. [ 74.022144][ T55] usb 5-1: device descriptor read/64, error -71 [ 74.134023][ T55] usb usb5-port1: attempt power cycle [ 74.300973][ T40] audit: type=1400 audit(1778552273.676:539): avc: denied { write } for pid=7229 comm="syz.1.379" name="ppp" dev="devtmpfs" ino=730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 74.308937][ T40] audit: type=1400 audit(1778552273.676:540): avc: denied { ioctl } for pid=7229 comm="syz.1.379" path="/dev/ppp" dev="devtmpfs" ino=730 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 74.366721][ T40] audit: type=1400 audit(1778552273.746:541): avc: denied { getopt } for pid=7234 comm="syz.2.381" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 74.426939][ T7246] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7246 comm=syz.2.384 [ 74.431884][ T7238] kvm: pic: level sensitive irq not supported [ 74.432531][ T7238] kvm: pic: non byte read [ 74.434153][ T7246] netlink: 'syz.2.384': attribute type 1 has an invalid length. [ 74.435727][ T7238] kvm: pic: level sensitive irq not supported [ 74.439507][ T7238] kvm: pic: non byte read [ 74.457657][ T7246] bond3: (slave bridge1): making interface the new active one [ 74.461218][ T7246] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 74.472494][ T55] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 74.475737][ T7246] gfs2: error -5 reading superblock [ 74.492503][ T55] usb 5-1: device descriptor read/8, error -71 [ 74.583954][ T40] audit: type=1400 audit(1778552273.956:542): avc: denied { unlink } for pid=7249 comm="syz.2.385" name="#1" dev="tmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 74.586027][ T7251] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 74.687500][ T40] audit: type=1400 audit(1778552274.066:543): avc: denied { create } for pid=7258 comm="syz.3.387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 74.707018][ T7259] batman_adv: batadv0: Adding interface: dummy0 [ 74.709375][ T7259] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.718488][ T7259] batman_adv: batadv0: Interface activated: dummy0 [ 74.732755][ T55] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 74.752647][ T55] usb 5-1: device descriptor read/8, error -71 [ 74.759675][ T7262] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 74.762484][ T7262] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 74.767991][ T7262] vhci_hcd vhci_hcd.0: Device attached [ 74.862221][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 74.862525][ T55] usb usb5-port1: unable to enumerate USB device [ 75.032310][ T9] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 75.042119][ T5823] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 75.204900][ T5823] usb 8-1: config index 0 descriptor too short (expected 247, got 96) [ 75.209553][ T5823] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 75.214222][ T5823] usb 8-1: config 0 has no interfaces? [ 75.217903][ T5823] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 75.220864][ T5823] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 75.224426][ T5823] usb 8-1: Product: syz [ 75.225797][ T5823] usb 8-1: Manufacturer: syz [ 75.229350][ T5823] usb 8-1: config 0 descriptor?? [ 75.440465][ T7288] usb 8-1: USB disconnect, device number 4 [ 75.444097][ T7263] vhci_hcd: connection reset by peer [ 75.448468][ T1233] vhci_hcd vhci_hcd.3: stop threads [ 75.452687][ T1233] vhci_hcd vhci_hcd.3: release socket [ 75.455371][ T1233] vhci_hcd vhci_hcd.3: disconnect device [ 75.474145][ T7288] hub 8-0:1.0: USB hub found [ 75.476692][ T7288] hub 8-0:1.0: 1 port detected [ 75.492248][ T62] Bluetooth: hci0: command 0x040f tx timeout [ 75.492303][ T5743] Bluetooth: hci3: command 0x0c1a tx timeout [ 75.502345][ T5743] Bluetooth: hci2: command 0x0c1a tx timeout [ 75.525580][ T7293] netlink: 'syz.1.394': attribute type 30 has an invalid length. [ 75.574455][ T7293] netlink: 'syz.1.394': attribute type 30 has an invalid length. [ 75.752137][ T6050] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 75.923026][ T6050] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 75.927617][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.931612][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.936446][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.940516][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.944450][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.949211][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.953303][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.957272][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.962294][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.966018][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.968971][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.972773][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.975936][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.978861][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.983414][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.987653][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.990799][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 75.994523][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 75.997364][ T7296] syzkaller0: entered promiscuous mode [ 75.997520][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 75.999144][ T7296] syzkaller0: entered allmulticast mode [ 76.002621][ T7296] tipc: Enabled bearer , priority 0 [ 76.004380][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 76.011103][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 76.014856][ T6050] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 76.017125][ T7296] netlink: 'syz.3.395': attribute type 4 has an invalid length. [ 76.018502][ T6050] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 76.026128][ T6050] usb 7-1: config 0 interface 0 has no altsetting 0 [ 76.031419][ T6050] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 76.035538][ T6050] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 76.039371][ T6050] usb 7-1: Product: syz [ 76.041308][ T6050] usb 7-1: Manufacturer: syz [ 76.043581][ T6050] usb 7-1: SerialNumber: syz [ 76.050393][ T6050] usb 7-1: config 0 descriptor?? [ 76.055280][ T6050] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 76.215949][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.218528][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.267021][ T5609] usb 7-1: USB disconnect, device number 4 [ 76.279249][ T5609] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 76.399404][ T7310] create_pit_timer: 3 callbacks suppressed [ 76.399421][ T7310] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 76.420193][ T7313] team0: entered promiscuous mode [ 76.422672][ T7313] team_slave_0: entered promiscuous mode [ 76.425349][ T7313] team_slave_1: entered promiscuous mode [ 76.520131][ T7315] 9pnet_fd: Insufficient options for proto=fd [ 76.915837][ T7329] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 76.921426][ T7329] kvm: pic: level sensitive irq not supported [ 76.921687][ T7329] kvm: pic: non byte read [ 76.926980][ T7329] kvm: pic: level sensitive irq not supported [ 76.927287][ T7329] kvm: pic: non byte read [ 77.115830][ T7342] netlink: 'syz.3.408': attribute type 16 has an invalid length. [ 77.119071][ T7342] __nla_validate_parse: 3 callbacks suppressed [ 77.119080][ T7342] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.408'. [ 77.126435][ T55] tipc: Node number set to 3005195580 [ 77.185301][ T7351] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 77.221805][ T7361] sctp: [Deprecated]: syz.3.414 (pid 7361) Use of struct sctp_assoc_value in delayed_ack socket option. [ 77.221805][ T7361] Use struct sctp_sack_info instead [ 77.251023][ T7363] netlink: 'syz.3.415': attribute type 1 has an invalid length. [ 77.259051][ T7363] netlink: 12 bytes leftover after parsing attributes in process `syz.3.415'. [ 77.440444][ T7369] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 77.582204][ T62] Bluetooth: hci0: command 0x040f tx timeout [ 77.615005][ T7372] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 77.630474][ T7372] kvm: pic: level sensitive irq not supported [ 77.630829][ T7372] kvm: pic: non byte read [ 77.631304][ T7376] netlink: 20 bytes leftover after parsing attributes in process `syz.0.419'. [ 77.636791][ T7372] kvm: pic: level sensitive irq not supported [ 77.640545][ T7372] kvm: pic: non byte read [ 77.647317][ T7372] kvm: pic: level sensitive irq not supported [ 77.647845][ T7372] kvm: pic: non byte read [ 77.654998][ T7372] kvm: pic: level sensitive irq not supported [ 77.655359][ T7372] kvm: pic: non byte read [ 77.661944][ T7372] kvm: pic: level sensitive irq not supported [ 77.662209][ T7372] kvm: pic: non byte read [ 77.666277][ T7372] kvm: pic: level sensitive irq not supported [ 77.666510][ T7372] kvm: pic: non byte read [ 77.675458][ T7382] binder: 7380:7382 ioctl c0306201 200000000080 returned -14 [ 77.680589][ T7382] binder: 7380:7382 ioctl c0306201 2000000003c0 returned -14 [ 77.747394][ T7389] ecryptfs_validate_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 77.752741][ T7389] Error validating options; rc = [-22] [ 77.753235][ T7390] fuse: Bad value for 'group_id' [ 77.756267][ T7390] fuse: Bad value for 'group_id' [ 77.826032][ T7394] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 77.861596][ T7399] syzkaller1: entered promiscuous mode [ 77.864342][ T7399] syzkaller1: entered allmulticast mode [ 78.011448][ T7417] netlink: 'syz.1.429': attribute type 4 has an invalid length. [ 78.036159][ T7417] tmpfs: Unknown parameter '01777777777777777777777' [ 78.147818][ T7428] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 78.244366][ T7436] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 78.274169][ T7438] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 78.487652][ T7448] netlink: 56 bytes leftover after parsing attributes in process `syz.0.438'. [ 78.520330][ T40] kauditd_printk_skb: 21 callbacks suppressed [ 78.520340][ T40] audit: type=1400 audit(1778552277.896:565): avc: denied { write } for pid=7449 comm="syz.3.439" name="/" dev="9p" ino=76570073 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 78.616339][ T7456] loop4: detected capacity change from 0 to 2640 [ 78.626159][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.631287][ T5742] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.635571][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.639132][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.643153][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.645969][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.648823][ T5742] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.652951][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.656336][ T7456] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.659099][ T5742] Buffer I/O error on dev loop4, logical block 0, async page read [ 78.662911][ T7456] ldm_validate_partition_table(): Disk read failed. [ 78.665003][ T7456] Dev loop4: unable to read RDB block 0 [ 78.666463][ T40] audit: type=1400 audit(1778552278.046:566): avc: denied { map } for pid=7455 comm="syz.0.442" path="/dev/loop4" dev="devtmpfs" ino=662 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 78.667703][ T7456] loop4: unable to read partition table [ 78.674559][ T40] audit: type=1400 audit(1778552278.046:567): avc: denied { execute } for pid=7455 comm="syz.0.442" path="/dev/loop4" dev="devtmpfs" ino=662 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 78.680001][ T7456] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 78.705183][ T40] audit: type=1400 audit(1778552278.086:568): avc: denied { create } for pid=7459 comm="syz.2.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 78.711571][ T7460] netlink: 16 bytes leftover after parsing attributes in process `syz.2.443'. [ 78.714802][ T40] audit: type=1400 audit(1778552278.086:569): avc: denied { write } for pid=7459 comm="syz.2.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 78.840872][ T7469] lo speed is unknown, defaulting to 1000 [ 78.845798][ T7469] lo speed is unknown, defaulting to 1000 [ 78.849309][ T7469] lo speed is unknown, defaulting to 1000 [ 78.851947][ T7469] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 78.859469][ T7469] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 78.864445][ T7469] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 78.869716][ T7469] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 78.875781][ T7471] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 78.881687][ T7469] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 78.910864][ T7469] lo speed is unknown, defaulting to 1000 [ 78.916869][ T7479] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 78.920943][ T7469] lo speed is unknown, defaulting to 1000 [ 78.924686][ T7469] lo speed is unknown, defaulting to 1000 [ 78.927729][ T7469] lo speed is unknown, defaulting to 1000 [ 78.995953][ T7488] overlayfs: workdir and upperdir must reside under the same mount [ 79.003175][ T7488] netlink: 200032 bytes leftover after parsing attributes in process `syz.3.449'. [ 79.008780][ T40] audit: type=1400 audit(1778552278.386:570): avc: denied { append } for pid=7489 comm="syz.0.450" name="sg0" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 79.074701][ T40] audit: type=1400 audit(1778552278.456:571): avc: denied { setopt } for pid=7497 comm="syz.0.454" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.091599][ T40] audit: type=1400 audit(1778552278.466:572): avc: denied { create } for pid=7495 comm=04 name="#6" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 79.094665][ T7496] overlayfs: failed lookup in lower (newroot/122, name='file1', err=-40): overlapping layers [ 79.099369][ T40] audit: type=1400 audit(1778552278.466:573): avc: denied { link } for pid=7495 comm=04 name="#6" dev="tmpfs" ino=673 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 79.108433][ T40] audit: type=1400 audit(1778552278.466:574): avc: denied { rename } for pid=7495 comm=04 name="#7" dev="tmpfs" ino=673 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 79.196741][ T7507] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 79.439846][ T7529] FAULT_INJECTION: forcing a failure. [ 79.439846][ T7529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.445476][ T7529] CPU: 1 UID: 0 PID: 7529 Comm: syz.0.466 Not tainted syzkaller #0 PREEMPT(full) [ 79.445491][ T7529] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.445497][ T7529] Call Trace: [ 79.445501][ T7529] [ 79.445505][ T7529] dump_stack_lvl+0x100/0x190 [ 79.445531][ T7529] should_fail_ex.cold+0x5/0xa [ 79.445548][ T7529] _copy_from_user+0x2e/0xd0 [ 79.445570][ T7529] copy_msghdr_from_user+0x9f/0x4f0 [ 79.445589][ T7529] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 79.445609][ T7529] ___sys_sendmsg+0x106/0x1e0 [ 79.445623][ T7529] ? __pfx____sys_sendmsg+0x10/0x10 [ 79.445665][ T7529] __sys_sendmsg+0x170/0x220 [ 79.445678][ T7529] ? __pfx___sys_sendmsg+0x10/0x10 [ 79.445693][ T7529] ? rcu_is_watching+0x12/0xc0 [ 79.445711][ T7529] do_syscall_64+0x10b/0xf80 [ 79.445731][ T7529] ? clear_bhb_loop+0x40/0x90 [ 79.445744][ T7529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.445755][ T7529] RIP: 0033:0x7f7526d9cdd9 [ 79.445764][ T7529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.445774][ T7529] RSP: 002b:00007f7527c45028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.445788][ T7529] RAX: ffffffffffffffda RBX: 00007f7527015fa0 RCX: 00007f7526d9cdd9 [ 79.445794][ T7529] RDX: 0000000008000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 79.445800][ T7529] RBP: 00007f7527c45090 R08: 0000000000000000 R09: 0000000000000000 [ 79.445806][ T7529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.445812][ T7529] R13: 00007f7527016038 R14: 00007f7527015fa0 R15: 00007ffd816a7b18 [ 79.445825][ T7529] [ 79.520560][ T7531] netlink: 12 bytes leftover after parsing attributes in process `syz.2.467'. [ 79.654468][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 79.691695][ T7543] program syz.0.472 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 79.918363][ T7560] FAULT_INJECTION: forcing a failure. [ 79.918363][ T7560] name failslab, interval 1, probability 0, space 0, times 1 [ 79.922372][ T7560] CPU: 0 UID: 0 PID: 7560 Comm: syz.0.478 Not tainted syzkaller #0 PREEMPT(full) [ 79.922386][ T7560] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.922393][ T7560] Call Trace: [ 79.922401][ T7560] [ 79.922405][ T7560] dump_stack_lvl+0x100/0x190 [ 79.922426][ T7560] should_fail_ex.cold+0x5/0xa [ 79.922441][ T7560] should_failslab+0xc2/0x120 [ 79.922452][ T7560] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 79.922469][ T7560] ? __alloc_skb+0x140/0x710 [ 79.922488][ T7560] ? __alloc_skb+0x5b7/0x710 [ 79.922506][ T7560] __alloc_skb+0x140/0x710 [ 79.922521][ T7560] ? __alloc_skb+0x5b7/0x710 [ 79.922536][ T7560] ? __pfx___alloc_skb+0x10/0x10 [ 79.922555][ T7560] netlink_alloc_large_skb+0x69/0x150 [ 79.922570][ T7560] netlink_sendmsg+0x680/0xda0 [ 79.922586][ T7560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.922605][ T7560] ? __might_fault+0x50/0x140 [ 79.922625][ T7560] ____sys_sendmsg+0x9e1/0xb70 [ 79.922638][ T7560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.922653][ T7560] ? __pfx_____sys_sendmsg+0x10/0x10 [ 79.922671][ T7560] ___sys_sendmsg+0x190/0x1e0 [ 79.922685][ T7560] ? __pfx____sys_sendmsg+0x10/0x10 [ 79.922713][ T7560] __sys_sendmsg+0x170/0x220 [ 79.922723][ T7560] ? __pfx___sys_sendmsg+0x10/0x10 [ 79.922738][ T7560] ? rcu_is_watching+0x12/0xc0 [ 79.922756][ T7560] do_syscall_64+0x10b/0xf80 [ 79.922775][ T7560] ? clear_bhb_loop+0x40/0x90 [ 79.922788][ T7560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.922798][ T7560] RIP: 0033:0x7f7526d9cdd9 [ 79.922807][ T7560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.922817][ T7560] RSP: 002b:00007f7527c45028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.922827][ T7560] RAX: ffffffffffffffda RBX: 00007f7527015fa0 RCX: 00007f7526d9cdd9 [ 79.922834][ T7560] RDX: 0000000008000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 79.922840][ T7560] RBP: 00007f7527c45090 R08: 0000000000000000 R09: 0000000000000000 [ 79.922845][ T7560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.922851][ T7560] R13: 00007f7527016038 R14: 00007f7527015fa0 R15: 00007ffd816a7b18 [ 79.922863][ T7560] [ 80.132599][ T9] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 80.191003][ T7581] validate_nla: 1 callbacks suppressed [ 80.191014][ T7581] netlink: 'syz.3.487': attribute type 4 has an invalid length. [ 80.196654][ T7581] netlink: 'syz.3.487': attribute type 8 has an invalid length. [ 80.199178][ T7581] netlink: 212 bytes leftover after parsing attributes in process `syz.3.487'. [ 80.260939][ T7589] netlink: 'syz.3.490': attribute type 322 has an invalid length. [ 80.295495][ T7591] netlink: 24 bytes leftover after parsing attributes in process `syz.0.491'. [ 80.399499][ T7604] netlink: 'syz.3.497': attribute type 1 has an invalid length. [ 80.412246][ T7604] bond3: entered promiscuous mode [ 80.414258][ T7604] 8021q: adding VLAN 0 to HW filter on device bond3 [ 80.420150][ T7604] netlink: 28 bytes leftover after parsing attributes in process `syz.3.497'. [ 80.424694][ T7604] bond3: entered allmulticast mode [ 80.468317][ T7612] FAULT_INJECTION: forcing a failure. [ 80.468317][ T7612] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 80.472677][ T7612] CPU: 3 UID: 0 PID: 7612 Comm: syz.0.498 Not tainted syzkaller #0 PREEMPT(full) [ 80.472698][ T7612] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.472707][ T7612] Call Trace: [ 80.472714][ T7612] [ 80.472720][ T7612] dump_stack_lvl+0x100/0x190 [ 80.472742][ T7612] should_fail_ex.cold+0x5/0xa [ 80.472758][ T7612] _copy_from_iter+0x1f4/0x1690 [ 80.472785][ T7612] ? __asan_memset+0x23/0x50 [ 80.472805][ T7612] ? __pfx__copy_from_iter+0x10/0x10 [ 80.472824][ T7612] ? __pfx___alloc_skb+0x10/0x10 [ 80.472845][ T7612] netlink_sendmsg+0x808/0xda0 [ 80.472862][ T7612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.472874][ T7612] ? __might_fault+0x50/0x140 [ 80.472894][ T7612] ____sys_sendmsg+0x9e1/0xb70 [ 80.472907][ T7612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.472921][ T7612] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.472939][ T7612] ___sys_sendmsg+0x190/0x1e0 [ 80.472954][ T7612] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.472982][ T7612] __sys_sendmsg+0x170/0x220 [ 80.472995][ T7612] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.473013][ T7612] ? rcu_is_watching+0x12/0xc0 [ 80.473031][ T7612] do_syscall_64+0x10b/0xf80 [ 80.473046][ T7612] ? clear_bhb_loop+0x40/0x90 [ 80.473059][ T7612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.473069][ T7612] RIP: 0033:0x7f7526d9cdd9 [ 80.473080][ T7612] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.473090][ T7612] RSP: 002b:00007f7527c45028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.473102][ T7612] RAX: ffffffffffffffda RBX: 00007f7527015fa0 RCX: 00007f7526d9cdd9 [ 80.473108][ T7612] RDX: 0000000008000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 80.473114][ T7612] RBP: 00007f7527c45090 R08: 0000000000000000 R09: 0000000000000000 [ 80.473120][ T7612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.473126][ T7612] R13: 00007f7527016038 R14: 00007f7527015fa0 R15: 00007ffd816a7b18 [ 80.473139][ T7612] [ 80.656714][ T7621] syzkaller1: entered promiscuous mode [ 80.658613][ T7621] syzkaller1: entered allmulticast mode [ 80.662962][ T7621] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 80.762823][ T7626] netlink: 'syz.1.502': attribute type 9 has an invalid length. [ 80.783605][ T7626] program syz.1.502 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 80.875956][ T5743] ================================================================== [ 80.878518][ T5743] BUG: KASAN: null-ptr-deref in l2cap_sock_suspend_cb+0x43/0x90 [ 80.880881][ T5743] Write of size 8 at addr 0000000000000590 by task kworker/u33:4/5743 [ 80.884944][ T5743] [ 80.886047][ T5743] CPU: 0 UID: 0 PID: 5743 Comm: kworker/u33:4 Not tainted syzkaller #0 PREEMPT(full) [ 80.886063][ T5743] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.886091][ T5743] Workqueue: hci3 hci_rx_work [ 80.886113][ T5743] Call Trace: [ 80.886118][ T5743] [ 80.886123][ T5743] dump_stack_lvl+0x100/0x190 [ 80.886137][ T5743] kasan_report+0xdf/0x1d0 [ 80.886151][ T5743] ? l2cap_sock_suspend_cb+0x43/0x90 [ 80.886168][ T5743] kasan_check_range+0x10f/0x1e0 [ 80.886182][ T5743] l2cap_sock_suspend_cb+0x43/0x90 [ 80.886198][ T5743] l2cap_chan_ready.part.0+0x1c9/0x240 [ 80.886208][ T5743] l2cap_le_start+0x1ea/0xd20 [ 80.886219][ T5743] ? __pfx___mutex_lock+0x10/0x10 [ 80.886235][ T5743] ? l2cap_global_fixed_chan+0x26f/0x3b0 [ 80.886248][ T5743] ? __pfx_l2cap_le_start+0x10/0x10 [ 80.886258][ T5743] ? do_raw_read_unlock+0x3f/0x70 [ 80.886274][ T5743] ? __pfx_l2cap_global_fixed_chan+0x10/0x10 [ 80.886290][ T5743] ? __l2cap_chan_add+0x486/0xa80 [ 80.886309][ T5743] l2cap_connect_cfm+0x8ce/0xf80 [ 80.886331][ T5743] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 80.886353][ T5743] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 80.886373][ T5743] le_conn_complete_evt+0x197c/0x1f60 [ 80.886394][ T5743] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 80.886409][ T5743] hci_le_conn_complete_evt+0x23c/0x3a0 [ 80.886421][ T5743] ? skb_pull_data+0x15f/0x1e0 [ 80.886435][ T5743] hci_le_meta_evt+0x34a/0x5f0 [ 80.886449][ T5743] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 80.886463][ T5743] hci_event_packet+0x51c/0xcd0 [ 80.886477][ T5743] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 80.886499][ T5743] ? __pfx_hci_event_packet+0x10/0x10 [ 80.886520][ T5743] ? kcov_remote_start+0x374/0x660 [ 80.886545][ T5743] ? lockdep_hardirqs_on+0x78/0x100 [ 80.886561][ T5743] hci_rx_work+0x451/0xfc0 [ 80.886575][ T5743] process_one_work+0xa0e/0x1980 [ 80.886593][ T5743] ? __pfx_process_one_work+0x10/0x10 [ 80.886610][ T5743] ? __pfx_hci_rx_work+0x10/0x10 [ 80.886631][ T5743] worker_thread+0x5ef/0xe50 [ 80.886656][ T5743] ? kthread+0x13a/0x450 [ 80.886675][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 80.886692][ T5743] kthread+0x370/0x450 [ 80.886704][ T5743] ? __pfx_kthread+0x10/0x10 [ 80.886716][ T5743] ret_from_fork+0x72b/0xd50 [ 80.886729][ T5743] ? __pfx_ret_from_fork+0x10/0x10 [ 80.886742][ T5743] ? __switch_to+0x800/0x1100 [ 80.886758][ T5743] ? __pfx_kthread+0x10/0x10 [ 80.886770][ T5743] ret_from_fork_asm+0x1a/0x30 [ 80.886788][ T5743] [ 80.886792][ T5743] ================================================================== [ 80.968822][ T5743] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 80.971063][ T5743] CPU: 0 UID: 0 PID: 5743 Comm: kworker/u33:4 Not tainted syzkaller #0 PREEMPT(full) [ 80.973973][ T5743] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.977159][ T5743] Workqueue: hci3 hci_rx_work [ 80.978621][ T5743] Call Trace: [ 80.979671][ T5743] [ 80.980570][ T5743] dump_stack_lvl+0x100/0x190 [ 80.982008][ T5743] vpanic+0x552/0x970 [ 80.983295][ T5743] ? __pfx_vpanic+0x10/0x10 [ 80.984664][ T5743] ? mark_held_locks+0x40/0x70 [ 80.986206][ T5743] ? l2cap_sock_suspend_cb+0x43/0x90 [ 80.987851][ T5743] panic+0xd1/0xe0 [ 80.989037][ T5743] ? __pfx_panic+0x10/0x10 [ 80.990417][ T5743] ? l2cap_sock_suspend_cb+0x43/0x90 [ 80.992059][ T5743] ? preempt_schedule_common+0x42/0xc0 [ 80.993774][ T5743] check_panic_on_warn.cold+0x19/0x34 [ 80.995458][ T5743] end_report.part.0+0x3a/0x90 [ 80.996976][ T5743] kasan_report.cold+0xe/0x18 [ 80.998470][ T5743] ? l2cap_sock_suspend_cb+0x43/0x90 [ 81.000110][ T5743] kasan_check_range+0x10f/0x1e0 [ 81.001639][ T5743] l2cap_sock_suspend_cb+0x43/0x90 [ 81.003216][ T5743] l2cap_chan_ready.part.0+0x1c9/0x240 [ 81.004895][ T5743] l2cap_le_start+0x1ea/0xd20 [ 81.006487][ T5743] ? __pfx___mutex_lock+0x10/0x10 [ 81.008069][ T5743] ? l2cap_global_fixed_chan+0x26f/0x3b0 [ 81.009797][ T5743] ? __pfx_l2cap_le_start+0x10/0x10 [ 81.011384][ T5743] ? do_raw_read_unlock+0x3f/0x70 [ 81.012880][ T5743] ? __pfx_l2cap_global_fixed_chan+0x10/0x10 [ 81.014738][ T5743] ? __l2cap_chan_add+0x486/0xa80 [ 81.016344][ T5743] l2cap_connect_cfm+0x8ce/0xf80 [ 81.017886][ T5743] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 81.019580][ T5743] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 81.021246][ T5743] le_conn_complete_evt+0x197c/0x1f60 [ 81.022905][ T5743] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 81.024675][ T5743] hci_le_conn_complete_evt+0x23c/0x3a0 [ 81.026423][ T5743] ? skb_pull_data+0x15f/0x1e0 [ 81.027920][ T5743] hci_le_meta_evt+0x34a/0x5f0 [ 81.029388][ T5743] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 81.031233][ T5743] hci_event_packet+0x51c/0xcd0 [ 81.032735][ T5743] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 81.034353][ T5743] ? __pfx_hci_event_packet+0x10/0x10 [ 81.036008][ T5743] ? kcov_remote_start+0x374/0x660 [ 81.037604][ T5743] ? lockdep_hardirqs_on+0x78/0x100 [ 81.039252][ T5743] hci_rx_work+0x451/0xfc0 [ 81.040625][ T5743] process_one_work+0xa0e/0x1980 [ 81.042175][ T5743] ? __pfx_process_one_work+0x10/0x10 [ 81.043854][ T5743] ? __pfx_hci_rx_work+0x10/0x10 [ 81.045394][ T5743] worker_thread+0x5ef/0xe50 [ 81.046891][ T5743] ? kthread+0x13a/0x450 [ 81.048231][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 81.049810][ T5743] kthread+0x370/0x450 [ 81.051065][ T5743] ? __pfx_kthread+0x10/0x10 [ 81.052509][ T5743] ret_from_fork+0x72b/0xd50 [ 81.053928][ T5743] ? __pfx_ret_from_fork+0x10/0x10 [ 81.055492][ T5743] ? __switch_to+0x800/0x1100 [ 81.056949][ T5743] ? __pfx_kthread+0x10/0x10 [ 81.058377][ T5743] ret_from_fork_asm+0x1a/0x30 [ 81.059874][ T5743] [ 81.061451][ T5743] Kernel Offset: disabled [ 81.062784][ T5743] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:18:00 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000035 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff857e5685 RDI=ffffffff9b4741c0 RBP=ffffffff9b474180 RSP=ffffc900016cf0d0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3030303030307257 R12=0000000000000000 R13=0000000000000035 R14=0000000000000010 R15=ffffffff857e5620 RIP=ffffffff857e56af RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d6372000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00002000005b7000 CR3=000000004a5be000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73657479625f6563 69767265735f6f69 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff648b8d36 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff648b8d36 00007fff648b8d3c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5290a3334c ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5290a3338c ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5290a334f0 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5290a3337e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000000fcb9f RBX=ffff88801e6f2500 RCX=ffffffff8b8a9095 RDX=0000000000000000 RSI=ffffffff8df21135 RDI=ffffffff8c1c3800 RBP=0000000000000000 RSP=ffffc90000177df0 R8 =0000000000000001 R9 =ffffed100d4a67b5 R10=ffff88806a533dab R11=0000000000000000 R12=0000000000000001 R13=ffffed1003cde4a0 R14=0000000000000001 R15=ffffffff90d7ae50 RIP=ffffffff8b8a787f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d6472000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000200000604000 CR3=000000002f398000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefffc00 Opmask01=0000000000000054 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005555941797b4 00005555941797b0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd7b1dede80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd7b1dede80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055559417bdf8 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0100000608060608 1f9e108004088285 b98c080001000006 0806060120d20004 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00100005a0030fff ffffffffff040590 0301801000058003 00100005b9820800 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0401 e810000210000580 0400040100000808 06010800100176f8 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 040a013e0072656c 6c616b7a797301ff ffffffffffffffeb 080480030010000f ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 010880040886c5ba c608000100000608 0606011ec6001000 0890030008000888 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0301e80800088003 00100005ba800800 0100000808060601 2094000800001000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0fffffffffffff04 0fffffffffffff04 0480040a013e0072 656c6c616b7a7973 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 01ffffffffffffff ffeb080480030010 000fffffffffffff 0401e81000021000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000001 RBX=ffffffff8e7e54e0 RCX=0000000000000001 RDX=0000000000000046 RSI=ffffffff8defbc27 RDI=ffffffff8c1c3800 RBP=ffff888034b74a00 RSP=ffffc90003897598 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=00000000ffffffff R13=0000000000000246 R14=ffff888034b755b8 R15=0000000000000001 RIP=ffffffff8b8a81b5 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 00007f52918a36c0 ffffffff 00c00000 GS =0000 ffff8880d6572000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fa3195ea4c0 CR3=000000004a5be000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000000003ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31a34d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2a3e7b76 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2a3e7b76 00007ffc2a3e7b7c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963334c ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963338c ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa3196334f0 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963337e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 286d636728363031 346366720012005f 0000000000000010 0004000200003500 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000b000c000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 d3667d2100000060 0000009800000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000080fe0000244e 244e002d0004001c 00cbc738c5000000 00a2b80d14aa4785 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2c00000000000000 00000000000080fe 0000244e244e002d 0004001c00cbc738 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 c500000000a2b80d 14aa4785d3667d21 0000006000000098 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000029 29736561286d6367 2836303134636672 0012005f00000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000080873 RBX=ffff88801ee92500 RCX=ffffffff8b8a9095 RDX=0000000000000000 RSI=ffffffff8df21135 RDI=ffffffff8c1c3800 RBP=0000000000000000 RSP=ffffc90000197df0 R8 =0000000000000001 R9 =ffffed100d4e67b5 R10=ffff88806a733dab R11=0000000000000000 R12=0000000000000003 R13=ffffed1003dd24a0 R14=0000000000000003 R15=ffffffff90d7ae50 RIP=ffffffff8b8a787f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d6672000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f52918a3d58 CR3=0000000026c8b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6576697372756365 725f64656772656d ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2a3e7b76 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2a3e7b76 00007ffc2a3e7b7c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963334c ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963338c ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa3196334f0 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa31963337e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000