last executing test programs: 3.867355114s ago: executing program 1 (id=419): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) shmctl$SHM_STAT_ANY(0xffffffffffffffff, 0xf, 0x0) (async, rerun: 32) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) (async, rerun: 32) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x4000) (async, rerun: 32) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x1000) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x1, 0x2) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000000)={0xa8}, 0x4) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="68020000210001000000000000000000ff0200000000000000000000000000017f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000a001000060000000000000008000b00000000002c001300e0000001000000000000000000000000fc0000000000000000000000000000000000000000000000cc0111"], 0x268}}, 0x0) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000040)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @local}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000ac0)="ee", 0x1}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) (async) sendto$inet6(r1, &(0x7f0000000100)="12dcd17426fca6b46dc3c774787e9a4151e1dbf0b3b5e90dcc84b63f1355bb29811a5521a861b9cd321dd6cab4a7b80e4f22cfe436b57edad237a8ca77c698b49e60ce54e2339d1d5a60f91e34293e8843fb39fa8d9ee8d2fb67428da06ac3a30342b6", 0x63, 0x10, &(0x7f0000000180)={0xa, 0x4e21, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}, 0x1c) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) mknodat$null(r4, &(0x7f00000001c0)='./file0\x00', 0x1, 0x103) write$binfmt_script(r4, &(0x7f0000000000), 0xfea7) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0x1, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x48, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xc, 0x10}, {0xc, 0x9, {0xf5}}}}]}]}, 0x70}}, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) (async) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) (rerun: 64) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r6, @ANYBLOB="0100000000ffffff800001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5426c010880f4000020060005000180000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002001bc715ee4868b12a49f4df11bc05475489f6a27c4d6483ad2fa5e45903b0ce8514000400e76a686bac1414aa00000000000000008c00098028000080060001000a00000014000200ff020000000000000000000000000001050003000000000028000080060001000a000000140002000000000000000000000000000000000105000300030000001c000080060001000200da0008000200e000000105000300000000001c000080060001000200000008000200ac141400050003000000000074000080200004000a004e2200000000fc0000000000000000000000000000000400000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000100000024000200cde20bc0d9b90ac13642d7b66459dd9db5e20b4b16d3d23f2cb03a8aa417dce6080007000000000014000200776730"], 0x1c8}}, 0x0) 3.867161785s ago: executing program 1 (id=420): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000a0)='./proc\x00', &(0x7f00000000e0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/mptcp/pm_type\x00', 0x1, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x3c, r3, 0x211, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}}, 0x0) (fail_nth: 8) 2.933745212s ago: executing program 1 (id=430): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x1000, 0x2000, &(0x7f0000010000/0x2000)=nil}) ioctl(r1, 0x4048aec9, &(0x7f0000000600)="010000000000000001") ioctl(r2, 0x4048aecb, &(0x7f0000000700)="00f8000000000000002000") 2.82459557s ago: executing program 1 (id=432): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, 0x0, 0x4800) 2.824311133s ago: executing program 1 (id=433): mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000080)={r1}, 0x0, 0x0, 0x0) (fail_nth: 8) 2.701307118s ago: executing program 1 (id=434): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a20100"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x80800) ioctl$HIDIOCGUSAGES(r1, 0xd01c4813, &(0x7f0000000540)={{0x3, 0xffffffff, 0x2, 0xfffffff9, 0x0, 0x4}, 0x266, [0x1, 0x10, 0x5, 0x4, 0x9, 0x5, 0x5, 0x0, 0xb72a, 0x7, 0x3, 0x0, 0x1, 0x5, 0xe4e, 0x5, 0x4, 0x5, 0x6, 0x1, 0x5, 0xe30, 0xb7, 0x5, 0x0, 0x0, 0xb33c, 0xc, 0x0, 0x7, 0x101, 0x5, 0x6, 0xffffffff, 0x0, 0x48, 0x0, 0x1, 0x2, 0x80000001, 0x9, 0xfd, 0xfffffbff, 0xa, 0x10001, 0x10000, 0xeb46, 0x23, 0x0, 0x6be, 0x9, 0xe0000000, 0x9, 0x1, 0x0, 0x4, 0x9, 0x2, 0xfffffff9, 0x8000, 0xffff, 0x80000001, 0x10, 0xffff, 0xa, 0x1, 0x9, 0x8, 0x800, 0x8, 0x5, 0x8, 0xfa9, 0x5, 0x307, 0x4, 0x3f46, 0x5, 0x2, 0xa, 0x200, 0x7f, 0x1, 0x53540, 0xeb9, 0x0, 0xd2a, 0x7, 0xfffffffd, 0xffff, 0x5, 0x4, 0x428, 0xb2a, 0x0, 0x401, 0x8001, 0x6000000, 0xff, 0x7, 0x9, 0x9, 0x10, 0x6, 0x7, 0x9, 0x3, 0x9, 0x5b8, 0x7, 0x3, 0x1, 0x40, 0x48ee, 0x75, 0xca, 0x0, 0x152, 0x100, 0x4, 0x7, 0x2, 0x8001, 0x3, 0x8001, 0x40, 0x6, 0x5, 0x7ff, 0x80000001, 0x4, 0x2, 0x2, 0x8, 0x4, 0x9, 0x0, 0x40, 0x1, 0xf, 0x3, 0x7f0, 0x2, 0x4, 0xfffffffa, 0x55, 0xe, 0x8001, 0x10, 0x0, 0x0, 0x80000000, 0x12c, 0x8000, 0x1, 0x3, 0x7, 0x5, 0x5, 0x8, 0x80, 0x3, 0x2, 0x81, 0x2, 0x71, 0x7, 0x2, 0xfffffffb, 0xa, 0x0, 0x0, 0x3, 0x7fff, 0xffffffff, 0x3, 0x9, 0x9, 0xa, 0x4, 0xf8d, 0x3, 0x9, 0x2, 0xffffffff, 0x0, 0x3, 0x0, 0x6, 0xfffffffc, 0x8, 0x8, 0x8, 0xfffffffd, 0x1, 0x4, 0x7fff, 0xb, 0xc, 0x1, 0x8, 0x0, 0xfff, 0x4, 0x1982, 0x8, 0x8, 0x9, 0x1, 0x0, 0x6, 0x3, 0x6, 0x63, 0x8001, 0x5, 0x800, 0x3, 0x4, 0x200, 0x8, 0xfffffffb, 0x7, 0xffffffff, 0x9, 0xa, 0x0, 0x7fffffff, 0xd, 0x0, 0x8, 0x8, 0xffff, 0xc169, 0x3ff, 0xba, 0x101, 0x6, 0x1, 0x3, 0xfaa, 0x1, 0x4, 0x2, 0xd68, 0x7, 0x0, 0x4b, 0x44, 0x6, 0x4, 0x3, 0x80, 0x3, 0x7, 0x101, 0x80000001, 0x1, 0x32, 0x4, 0x9, 0x30, 0xffff14b3, 0x8, 0x6b29, 0x6, 0x80, 0x7c71, 0x3, 0x7, 0x9, 0xe, 0x7, 0x425, 0xfffffff7, 0x3, 0x392, 0x9, 0xe, 0x0, 0xd, 0x4, 0x0, 0xb8e, 0x7, 0xd, 0xd4c4, 0x4, 0x768, 0x6, 0x40, 0x3, 0x7, 0x1f04, 0xfff, 0x40, 0x7, 0x7, 0x6, 0x0, 0x3, 0x1000, 0xf38, 0x1, 0x3, 0xfff, 0x0, 0x3, 0x6, 0x51ad, 0x80000001, 0x6, 0x8, 0x6, 0x3, 0x3, 0x7f, 0x6, 0xd, 0x4d5, 0x3, 0x6, 0x2e, 0x8, 0x2, 0x3, 0x0, 0x4, 0x2, 0x8, 0x80, 0x7, 0x10000, 0x1ff, 0x2, 0x80000000, 0x3f, 0x5, 0xa, 0x0, 0x9, 0x9d, 0x5, 0x7fffffff, 0x80, 0xf02, 0x80000000, 0x8, 0x100, 0xff, 0x6, 0x18000000, 0xf, 0x8, 0xfffffff9, 0x6, 0x9, 0x85, 0x6, 0x282b, 0x9, 0x10, 0x10000, 0x2, 0x2, 0x4, 0xe94, 0x5, 0x7f, 0xa5c4, 0x3, 0x0, 0x3, 0xfffffc00, 0x8, 0x6, 0x80000000, 0x40, 0x1, 0x9, 0x6, 0x2, 0x1, 0xfffffff9, 0x1, 0x1b5, 0x2, 0x8, 0xa, 0x9, 0x4, 0x8000, 0x5, 0x389, 0x9, 0x5, 0x56c2, 0x8, 0x2, 0x2, 0x1, 0x6, 0x7, 0x2, 0xe6, 0x1f40, 0x7, 0x1, 0x3bd, 0x0, 0x8, 0x3, 0x7160, 0x8, 0x1, 0x1ff, 0x3, 0x1a07, 0x6, 0x10001, 0x2, 0x9, 0x0, 0x80, 0xf, 0x1, 0x7e, 0x40, 0x80, 0x9, 0x6, 0x3, 0x4, 0x5, 0x4, 0x6, 0x3, 0x6, 0xadb4, 0xccb, 0x3, 0x0, 0xe, 0x6, 0x6, 0x686, 0x10, 0x84, 0x2, 0x1df, 0x3, 0x8001, 0x4, 0x155a, 0x80, 0x9, 0x8, 0xfff, 0x1, 0x23, 0x3, 0x81, 0x10001, 0x6d, 0x4, 0x6, 0x2a6, 0x7f, 0x0, 0x10, 0x1, 0x200, 0x100, 0x7f, 0xfffffff9, 0x6, 0xe, 0x4, 0x7, 0x2, 0x7, 0x3, 0x2, 0xa, 0x3c2, 0x4, 0x2, 0x10001, 0x1, 0x3, 0xe, 0xf, 0x6, 0x7fffffff, 0x1, 0x3, 0x40, 0x1, 0x6, 0x9, 0x5, 0x0, 0x5, 0x1000, 0x6, 0x3, 0x0, 0x6, 0x1000, 0x8d, 0x4, 0x7, 0x1, 0x2f, 0xd62, 0xdb19, 0x9, 0x9, 0x59, 0x6, 0x2, 0x3, 0x7db9, 0x401, 0x122, 0x4, 0x4, 0xa6, 0x9, 0x6, 0x35, 0x8, 0xb, 0x9, 0x3, 0x3, 0xfffffff8, 0x3, 0x5b69, 0x101, 0x9, 0x2, 0x617, 0x6, 0x48f9, 0x2, 0x9, 0x9, 0x5, 0x5, 0x6, 0x55ae, 0x2, 0x6, 0x646, 0x2, 0xe069, 0x109320ac, 0x2, 0x10001, 0x7f, 0x0, 0x2, 0x2, 0x1c93, 0xff, 0x3, 0x4, 0x1, 0x4, 0x6, 0x1400, 0x3, 0x0, 0x37b0, 0xfffffeff, 0x401, 0x80000001, 0x8, 0x4, 0x7, 0x3, 0x0, 0x8, 0x6, 0x6, 0x80, 0x1, 0x0, 0x4, 0x9, 0xa, 0xb11, 0x97, 0x18000, 0x71d9, 0xc, 0x33, 0xd, 0x2, 0x4, 0x1, 0x0, 0x3, 0x1, 0x8, 0x6, 0xb, 0x0, 0x1, 0x90ca, 0x9, 0x6d5, 0xfffffe01, 0x7fffffff, 0x8, 0x4, 0xe66, 0xfff80000, 0x2, 0x5d8ca33f, 0x1e3, 0x7f, 0xb, 0x5, 0x9, 0xfffffff9, 0x7f, 0x7, 0x0, 0x0, 0x7657, 0x5, 0x7, 0x4, 0x1520, 0x559, 0x0, 0xfffffeff, 0x1, 0x4, 0x7fffffff, 0x2, 0x0, 0x9, 0x6, 0x1, 0x6, 0x5, 0xc, 0xc, 0x4, 0xd, 0x7, 0x0, 0x6, 0x4, 0x4d, 0x5f20, 0x1e91, 0x1, 0x0, 0x6, 0x6, 0x6, 0x2, 0xffffff7e, 0xfffffffd, 0x5, 0x3, 0x7, 0xffff, 0xfffffffd, 0x5, 0x3, 0x431, 0x8, 0x5, 0x2, 0x400, 0x2, 0x6, 0x7ff, 0x8, 0xfffffff1, 0xb0000000, 0x40, 0x4, 0x1, 0x4, 0x80000000, 0x54c6, 0xb1a5, 0x3, 0x3, 0x2, 0x10001, 0x8, 0x10, 0x746c1fba, 0xc, 0x1, 0x1, 0x3, 0x80, 0xaa6e, 0x0, 0x7, 0xd1, 0x7c000000, 0xfffffffc, 0xd, 0xfffffffb, 0x4, 0x3, 0x8, 0x4, 0x3, 0x6ed, 0x1, 0x9, 0xe, 0x870, 0x7fc8, 0x5, 0x308, 0x1, 0x0, 0x7, 0xffffff00, 0xfffffffd, 0x3, 0x1, 0x1, 0x4, 0xfffffffe, 0x9, 0x4, 0xffff, 0xfffffffd, 0x5, 0x80000000, 0x4, 0x80, 0x40, 0xd, 0x8, 0x6, 0x1, 0x3, 0x1, 0xe77, 0x8, 0x2, 0x0, 0x4, 0x1, 0x2, 0x1, 0x7, 0x1ff, 0x5, 0x0, 0x4, 0x1, 0x800, 0x1000, 0x5, 0x5, 0x9, 0x2, 0xfff, 0x4, 0x7, 0x0, 0x6, 0x9, 0x44, 0x7, 0x2, 0x8001, 0x0, 0x2, 0x80000000, 0x5, 0x2, 0x920, 0x438, 0x3, 0x4852, 0x6, 0x8, 0x6, 0x14, 0x8001, 0x4, 0x3, 0x9, 0xffffffff, 0x9, 0x1, 0x8000000, 0x0, 0xb40, 0xd, 0xd9f7, 0x9, 0x9, 0x7fffffff, 0x2, 0x7f, 0x8, 0x46, 0x0, 0x1, 0x401, 0x5aa, 0x6, 0x200000, 0x1b, 0x32a6, 0x26da092e, 0x4, 0x9, 0x7, 0xb5, 0xf07d, 0xfffffff6, 0x10000, 0x7, 0x7, 0x2, 0x6, 0xf, 0x9, 0x3, 0x9c4, 0x3, 0xfffffff8, 0x7, 0xfffffffd, 0x4, 0xf, 0x9fa6, 0xb4c, 0x6, 0x422ff693, 0x800, 0x6, 0x5915, 0x7ff, 0x80000001, 0xb, 0x0, 0x0, 0x0, 0x10, 0x5, 0x1ff, 0x5df, 0x265b, 0x5, 0xf, 0x9, 0x2, 0x6, 0x8000, 0x400, 0x0, 0x8, 0xfc9, 0x6, 0xf, 0x7fcd, 0x1e0, 0x5, 0x0, 0x1, 0x7f, 0x80000000, 0x2, 0x100, 0xd1c, 0x200, 0x0, 0x7d3, 0x6, 0x1, 0x5, 0x2, 0x9, 0x7fff, 0x2, 0xfee, 0x200, 0xc, 0x0, 0xe755, 0x4, 0x0, 0x2a8, 0xfff, 0x7, 0x40, 0x6, 0xd, 0xffff819d, 0x0, 0x2, 0x60000000, 0x81, 0x1, 0x3, 0x1, 0x8a, 0x0, 0xd62, 0x8e0, 0x4, 0x80, 0x8, 0xfffffff7, 0x9, 0xda, 0x3, 0x3, 0x4, 0x8, 0x3, 0x1ed, 0x5, 0x8, 0x40, 0xffff, 0x3, 0x50ca0819, 0x0, 0xffff6a42, 0x4c76b22c, 0xf, 0x7, 0x2, 0x6, 0x2, 0xffffffff, 0x8, 0x2, 0x8, 0x80000000, 0x5, 0x2, 0x101, 0x7fff, 0x2, 0x8917, 0xfffffffb, 0x1, 0x8000, 0x5, 0xe90, 0x8, 0x10000, 0x80000000, 0x5, 0x6, 0x200, 0x7fff, 0x10001, 0x8, 0x7, 0x9, 0x339cb468, 0x7, 0x1, 0x2, 0x8, 0x2, 0x0, 0x3, 0x401, 0x0, 0x4, 0x0, 0x7, 0xfffffff1, 0x7, 0xbd7e, 0x7, 0x7fffffff, 0x1, 0x6, 0xff, 0x0, 0x5, 0x2, 0xffffffc0, 0xfffffff8, 0x9, 0x7be, 0x2, 0x9, 0x4, 0x3, 0xfffff800, 0x40, 0xd18000, 0x3, 0x0, 0x977, 0x5, 0x6, 0x7, 0x6f7adc6c, 0x101, 0xfffffffc, 0xfff, 0xe700000, 0x80000001, 0x2, 0x4, 0xffffffff, 0x100, 0x83d, 0xbc7]}) 1.263590278s ago: executing program 0 (id=447): connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 1.234546652s ago: executing program 0 (id=448): r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x5, 0x3, 0x29}) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x48, 0x2, 0x2, 0x201, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_EXPECT_NAT={0x2c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @CTA_EXPECT_NAT_TUPLE={0x20, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000000140)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000002c0)={0x9, &(0x7f0000000240)=[{0xbf1e, 0xe, 0x3, 0xa54}, {0x9, 0x5, 0x4, 0xfffffff7}, {0x7ff, 0x7, 0x18, 0x7}, {0x101, 0x8, 0x8, 0xb}, {0xd, 0x4, 0x3}, {0x197b, 0x4, 0x64}, {0xe, 0x6, 0x35, 0x1}, {0x8, 0x79, 0xfc, 0x1}, {0x1, 0x59, 0x1, 0xff}]}) r5 = syz_open_dev$usbfs(&(0x7f0000000700), 0x2000000000000, 0x141002) r6 = syz_open_dev$dri(&(0x7f0000000140), 0x2, 0x103000) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r6, 0xc01864d0, &(0x7f00000003c0)={0x2b, 0x0, 0x0, 0xb0b0b0b0}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0xc0185500, &(0x7f0000000040)={0x82, 0x100000, "aa2fe1a243fcd9abf29cc3391c06b86f68e7f73d4f0bff9669a8e82040ccb44d75131fb06cade553a6bdc314438ce0af11c38cd724980b087a7a16f9295be0a69db51576e7a06ef6bcabc67b52ba82e73504fa842ec2f0c06bf006f3e5bcdd5057997bf171c60d96a538b02ee9f4b573457498ca09cb417b1fbe6dc3b0c27ab0693ac57aff136748f7740dfc33f3a902b670f8933aec28869e637c18379d6d0b4d844b732cb1932733dfcec2f69f8b6df76ba84e1f001ad29105230471f466b6f9d7d2b05a57fe16e7363e5ecebc2c74539ca55c7ce3a175061adedd20532a9de97379f4dd5baeeae835946311e6e4e2361355c54b3bd500"}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0x7fff}, {0x400000b1, 0x0, 0x89}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.030416995s ago: executing program 0 (id=452): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) r1 = syz_open_dev$swradio(&(0x7f0000000280), 0x1, 0x2) ioctl$VIDIOC_S_TUNER(r1, 0x4054561e, &(0x7f0000000300)={0x2, "134c4092b0389292017cc6c63ab926b1b73591a170e6b48aefc8a77ade5efc8e", 0x0, 0x20, 0x2, 0x81, 0x1, 0x2, 0xc, 0x6}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1a080045000028006700000206907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5cc200000000ac00"], 0x0) r2 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r2, &(0x7f0000000140)="9c91d7798c7f1b4ca046b42f0c3d", 0xe, 0x800, &(0x7f0000000040)={0x2, 0x4e22, @remote}, 0x10) 950.86005ms ago: executing program 0 (id=453): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000800", @ANYRES32, @ANYBLOB="000000000000e000000000001000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_io_uring_setup(0x6aed, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x4, 0x51}, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x6, 0x5, 0xffff, 0x0, 0x0, 0x10000, 0x0, 0x400}, 0x0, &(0x7f00000002c0)={0x5, 0x3, 0xc, 0x8000000000000001, 0x1000000002, 0x3, 0x3, 0x10000000003}, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000180)={0x20, r1, 0x1, 0x0, &(0x7f0000000600)=[{}]}) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000340), 0x0, 0x8042) r4 = gettid() syz_open_procfs(r4, &(0x7f0000000040)='timerslack_ns\x00') r5 = getpid() syz_pidfd_open(r5, 0x0) r6 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r7 = syz_ublk_setup_io_uring(0x7c92, &(0x7f0000000040)={0x0, 0x9f0f, 0x0, 0x3, 0x80000000}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0, &(0x7f00000005c0)=0x0) r11 = syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x0, 0x0, r6, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)) syz_io_uring_submit$UBLK(r8, r9, r10, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r6, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r11, 0xffff, 0x70, &(0x7f0000000680)={0x70, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x9222}, {0x0, 0x2}, {0x0, 0x0, 0x7f}}}}) syz_io_uring_complete(r8, r9) syz_open_dev$ublk_chdev(&(0x7f0000002000), r11, 0x2) r12 = getpid() syz_io_uring_submit$UBLK(r8, r9, r10, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r6, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r11, 0xffff, 0x0, 0x0, r12}}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf253100000008000300", @ANYRES32=0x0, @ANYBLOB='\b\x00R\x00', @ANYRES32=0x0, @ANYBLOB="0800db00", @ANYRES32=r2, @ANYBLOB='\b\x00R\x00', @ANYRES32=r5, @ANYBLOB='\b\x00R\x00', @ANYRES32=r12, @ANYBLOB="0c009900010000005400000008000300", @ANYRES32=0x0, @ANYBLOB="080001003c00000008000300", @ANYRES32=r13, @ANYBLOB="60650cde26fd21a84bf6ecd580bd27ac3cc82551b76719ccff79852cde4a5cc3966adad374b1ef766ab45f707cfbc9c97f484d4bf39561c4f411857263ce55cedc96f8c7b02f67f7bff5c12b8f227f722327f7180659e2b7f555cd818b30b288ec64fc030000000000000083e59e294b6dcac9bcc07bc81ecbbb4b0126170983907fbfa5cc0649d4c9a4e281baaa3cd99cfce25b9db84b9468507704df8e604267298d9c3491a86cbb63995e55e36442756c5f00ccbe0d3cc97f57b60aa12f9a8055315be041c64f0216295cb239906425a514ca3fb8f849b6f6ad787c8ee44e0954edc31e2f224cdcee038153c546d154ce3622193383510f8fce146ab10c97e1a148d1932d21cf50e0bb61a8ab64b9bf575ea6a3edf2ae027925cb31ee846616c2b8544a2fc85f72aed941fe1a156b347b02eec703c7f1380ca475f4fa70ad583d06630a84869362da68ac470aa0ba5a18a0aef2c723"], 0x6c}}, 0x0) ppoll(&(0x7f0000000000)=[{r3, 0x2}], 0x1, &(0x7f0000000080)={0x0, 0x3938700}, 0x0, 0x0) write$FUSE_NOTIFY_RESEND(r3, &(0x7f0000000000)={0x14}, 0x14) ioctl(r2, 0xc138fc09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d79706f") stat(&(0x7f0000000140)='./dev/mapper/control\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000240)='./dev/mapper/control\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r2, &(0x7f0000000100)='./dev/mapper/control\x00', r14, r15, 0x400) 576.272369ms ago: executing program 2 (id=458): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/machinecheck/machinecheck0/bank1\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x700, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0xf0}]) 525.612846ms ago: executing program 3 (id=459): r0 = open(&(0x7f00000001c0)='./file1\x00', 0x14da7e, 0x20) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000240)=0x10) copy_file_range(r0, 0x0, r0, 0x0, 0xb51, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r1) tkill(r1, 0x12) ptrace(0x4208, r1) tkill(r1, 0x12) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$CDROMREADAUDIO(r2, 0x31e, &(0x7f0000000040)={@msf={0x34, 0xb, 0xe}, 0x0, 0x0, 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000001000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x54}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000040) sendmsg$nl_route(r3, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)=@ipv4_deladdr={0x58, 0x15, 0x400, 0x70bd28, 0x25dfdbfb, {0x2, 0x0, 0x8c, 0xc8, r5}, [@IFA_FLAGS={0x8}, @IFA_RT_PRIORITY={0x8, 0x9, 0x7fffffff}, @IFA_LABEL={0x14, 0x3, 'gre0\x00'}, @IFA_CACHEINFO={0x14, 0x6, {0x4, 0x3, 0x4, 0x6}}, @IFA_BROADCAST={0x8, 0x4, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x48000}, 0x4000045) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) setuid(0xee00) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5800000042000100000000000000000003010000000000002600010000010000005566778899aabb0800450000140000000001170000010203040506070800000c00020006000600894f00000c0003"], 0x58}}, 0x0) 348.532131ms ago: executing program 3 (id=460): mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f00000000c0), 0x10) sendto$l2tp(r0, &(0x7f0000000280)="e5786a0d000000000000003b", 0xc, 0x8000, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000040)=0xfffffffd, 0x4) recvmsg(r0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x23, 0x0, 0xffffffffffffff22}, 0x40002020) (fail_nth: 8) 348.386949ms ago: executing program 2 (id=461): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x80500, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000100)=0x1) ioctl$PPPIOCATTCHAN(r0, 0x80047453, 0x0) 347.917992ms ago: executing program 2 (id=462): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./proc/net/pppol2tp\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r0, &(0x7f0000003000), 0x100) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x109880, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x800, 0x0, 0x0, 0x41000, 0x5a, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r2, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x4], 0x0, 0x0, 0x1, 0x1}}, 0x40) write$P9_RSTATu(r2, &(0x7f00000006c0)=ANY=[@ANYBLOB="bd0100007d1c000000a10103000500000000010000000800000000000000000000400d0000000700000007000000000000000100998f000034bea398bb562254fd2da7fe731bae609471adfdb92b9fd254d2f4a239f3ae38703cde36594b7ef5c8e1e9f57627d769f278beed14357643336d3a98c64781de0db2c949f319c012489b9a2ae8d44ca6c11bde5470cd42bcba004d2c075ad1bf0ccb1918ad29b52f93f8e504000000c9ac0268ced46b137403df9c86bbf6f4afa2f382bac597791700d811bbf0fa730017e05f7c732feccf1e7c7ef42a774958be5b07cd5f12d47a5a73562fa23fbc3d824fc7f7f10dd00614bbf1bb99aadbf1f0e3df1c167b220c8c30d049ff02293a39e7a69e7ea9a3f7aa572900961b6d2bcbf1bf0eaad67c22f733722b4610f250cc1fd77ffc0e2c78e5105efff91200000000004f00fced6798610b3a3a977102fe1af7eff5aaf8401bb5105b5dac228926c1bb0063fa48900309a440dde32b5cc083c0f62834facf5c6a3bfa6afe4af8ca8a70b82ed2e236cb7ee81826bc5807269a000000000000000045a8bfd7ec5816c74b6c75a555c3be25d5720f98b530070097feef857a0386", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x1bd) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) read(r0, &(0x7f0000004000), 0x100) 291.622964ms ago: executing program 3 (id=463): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newtaction={0xb4, 0x30, 0x871a15abc695fb3f, 0x70bd2d, 0x25dfdbfe, {}, [{0xa0, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xffff, 0x5, 0x8000007, 0xfff}, 0x200}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_vlan={0x4c, 0x2, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x1, 0x4, 0x5, 0xd, 0x90bd}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x1}, 0x4000054) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_PORT={0x6, 0x5, 0x4e20}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}, @IFLA_MTU={0x8, 0x4, 0xb2}]}, 0x48}}, 0x40800) 291.339731ms ago: executing program 2 (id=464): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001a000100000000000000000081"], 0x30}}, 0x0) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) syz_emit_vhci(&(0x7f00000005c0)=ANY=[@ANYBLOB="02c9300a000007e2e787cb63000000"], 0xf) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0xffffffffffffffa8, &(0x7f0000000000)={&(0x7f0000000280)=@newqdisc={0x54, 0x24, 0x0, 0x40000, 0x0, {0x0, 0x0, 0x0, r2, {0x9, 0xe}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xa, 0x4000029, 0xc0, 0x9, 0xffffffff, 0x80091b1}}}}, @TCA_EGRESS_BLOCK={0x8}]}, 0x54}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/file0\x00', 0x1df) 242.81997ms ago: executing program 3 (id=465): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x401, 0x0, 0x0, {0x1, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x3, "00010202020202020202020202020202"}}}]}, 0x48}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000390400"/20, @ANYRES32=r4, @ANYBLOB="03cc040003130000240012800b000100697036746e6c00001400028008004b00", @ANYRES32=r4, @ANYBLOB="060012004e230000"], 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=@gettclass={0x24, 0x2a, 0x800, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xffff, 0x4}, {0xfff3, 0x3}, {0xffe0, 0xe}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f0000000700)="0000000000010000000000028100000a08004500002000000000401100007f0000017f00000112341234000c000000000000", 0x32, 0x0, &(0x7f0000000800)={0x11, 0x3, 0x1, 0x1, 0x0, 0x6, @random="000000000001"}, 0x14) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c00028008000140000000080800034000000110"], 0xc4}}, 0x20050890) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='clear_refs\x00') set_mempolicy(0x1, &(0x7f0000000080)=0x5, 0x8) ioctl$FE_DISHNETWORK_SEND_LEGACY_CMD(r9, 0x6f50, 0x6) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000200)="b805000000b9fa0000000f01d9660f78c4020a3ef32e650f09b805000000b90000c0fe0fae41d901000000b87f8b7f26ba000000000f30660fc775022e0fba600c980f320f3566b857000f20c035000000800f22c0", 0x55}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x401, 0x0, 0x0, {0x1, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x3, "00010202020202020202020202020202"}}}]}, 0x48}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000390400"/20, @ANYRES32=r4, @ANYBLOB="03cc040003130000240012800b000100697036746e6c00001400028008004b00", @ANYRES32=r4, @ANYBLOB="060012004e230000"], 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=@gettclass={0x24, 0x2a, 0x800, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xffff, 0x4}, {0xfff3, 0x3}, {0xffe0, 0xe}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}}, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) sendto$packet(r5, &(0x7f0000000700)="0000000000010000000000028100000a08004500002000000000401100007f0000017f00000112341234000c000000000000", 0x32, 0x0, &(0x7f0000000800)={0x11, 0x3, 0x1, 0x1, 0x0, 0x6, @random="000000000001"}, 0x14) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c00028008000140000000080800034000000110"], 0xc4}}, 0x20050890) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='clear_refs\x00') (async) set_mempolicy(0x1, &(0x7f0000000080)=0x5, 0x8) (async) ioctl$FE_DISHNETWORK_SEND_LEGACY_CMD(r9, 0x6f50, 0x6) (async) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000200)="b805000000b9fa0000000f01d9660f78c4020a3ef32e650f09b805000000b90000c0fe0fae41d901000000b87f8b7f26ba000000000f30660fc775022e0fba600c980f320f3566b857000f20c035000000800f22c0", 0x55}], 0x1, 0x10, 0x0, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) 242.569253ms ago: executing program 2 (id=466): syz_emit_ethernet(0x56, &(0x7f0000000880)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "01044a", 0x20, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, '\x00?\x00\x00\x00\x00'}]}}}}}}, 0x0) 151.784353ms ago: executing program 2 (id=467): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/cgroup', 0x0, 0x0) getdents(r0, &(0x7f00000001c0)=""/240, 0xf0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000005f40), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000006000)={&(0x7f0000000040)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="19022bbd7000fedbdf25200000000c00050000000000000000020a0001007770616e3100000009001f0070687931"], 0x38}, 0x1, 0x0, 0x0, 0xc0}, 0x4080) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='add 1-1', 0x7) write(r3, &(0x7f0000000180)='add 2', 0x5) write(r3, &(0x7f00000001c0), 0x0) write(r3, 0x0, 0x0) write(r3, &(0x7f0000000240)='add 5-', 0x6) write(r3, &(0x7f0000000280), 0x0) write(r3, &(0x7f00000002c0), 0x0) write(r3, &(0x7f0000000300), 0x0) getdents64(r0, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r6 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0xfffffffc, 0x0, 0xffffffff, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r7, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 71.119511ms ago: executing program 0 (id=468): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) syz_clone(0x81100800, &(0x7f0000000080)="8844325d4ed7bcb0ff65023ea6045832248897d300ab4f160c7818e2e05ab1612e7ee2af1792ce585ae41e944808f4fb93c98c0301466ff40d942b99349f227da02ef1c01a2ea4e51e9d19790c6aae554c84dc6daf7ce8d8321ddc11c1ea4ddc5e66297616c02167087febd33fda5e69", 0x70, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-1/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='isp1301 0x2', 0xb) 70.941186ms ago: executing program 3 (id=469): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1, 0xffffffffffffffff}, 0x4) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x9}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000400)={&(0x7f0000000140)="6b7b8c75d4bc3ab9485d895afda8ae710ba7ad7f7d1919e4675c133e317a8f4c534dd19805d8a55836d0d7ae6918340342ea2a9fdae282dafef2bdf5ea19bf0f31fbf988a55498fb41544d504698139ffcab8398d8e23ff26e048b989a43f35e577018dc75472ccf927cf924f5451798c7967ff8cf9c", &(0x7f00000001c0)=""/107, &(0x7f0000000240)="3afc61956f80dcde8855bbe8dbaa7477d6c83eb3da82559aaf449dcefb837bce937dfb1f06721c25358e4b84f75d0153fc5aeb4f1b2a368b984d35252c388b76", &(0x7f0000000300)="caa345896aecf8ae4c42a93e9e225d8753f6eff292a4c98d9544cb7b92a815441975978d0a5f0284cd15d0368aaf3516605809535e702011b43eeba3448d1d47e726885b71f36889bd9ae69d22f2c25eb23ba4029144516bc2097c31dead2cb609d1cd16edc1f76559dfddab882ccd1d4a", 0x9, r2}, 0x38) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000040), &(0x7f00000000c0)='%pi6 \x00'}, 0x20) (async) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f00000002c0)={0x0, 0x5a}) 333.366µs ago: executing program 0 (id=470): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0/control/extensions/xu.0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.0/control/extensions/xu.0/bNumControls\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='5\n', 0x2) sendmsg$nl_route(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="600000001000010427bd70000000000000000000", @ANYRES16=r0, @ANYBLOB="00000000000000000a0001000180c20000000000140012800b0001006c6f7770616e"], 0x60}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f00000000c0)=0x40) r3 = socket(0x10, 0x803, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000140)=0x200, 0x4) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}}, 0x4008880) getsockname$packet(r3, 0x0, &(0x7f0000000200)) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r4, r4, 0x0, 0x200000) cachestat(r4, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) sendmsg$can_raw(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xfffffffffffffe3b}, 0x2, 0x0, 0x0, 0x200008d1}, 0x20040041) r6 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x68, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x9}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x3}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x6}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x44080) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x5, 0xffffffffffffffff, 0x80001}) r8 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_INSN(r8, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x48, 0x0, 0x0, 0x2}) socket$kcm(0x11, 0x3, 0x0) 0s ago: executing program 3 (id=471): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = landlock_create_ruleset(&(0x7f00000000c0)={0x4100, 0x8, 0x1, 0x400, 0xd, 0x2}, 0x30, 0x1) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/machinecheck/machinecheck0/bank1\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0xf0}]) kernel console output (not intermixed with test programs): /0x580 [ 77.595484][ T6480] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 77.595535][ T6480] ? find_held_lock+0x2b/0x80 [ 77.595551][ T6480] ? __fget_files+0x215/0x3d0 [ 77.595570][ T6480] ? hook_file_ioctl_common+0x140/0x440 [ 77.595589][ T6480] ? __fget_files+0x215/0x3d0 [ 77.595612][ T6480] ? __fget_files+0x21f/0x3d0 [ 77.595634][ T6480] security_file_ioctl+0xd3/0x230 [ 77.595663][ T6480] __x64_sys_ioctl+0xb7/0x210 [ 77.595691][ T6480] do_syscall_64+0x115/0x870 [ 77.595714][ T6480] ? clear_bhb_loop+0x40/0x90 [ 77.595742][ T6480] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.595760][ T6480] RIP: 0033:0x7fab6139e0d9 [ 77.595775][ T6480] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.595793][ T6480] RSP: 002b:00007fab621bd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.595810][ T6480] RAX: ffffffffffffffda RBX: 00007fab61625fa0 RCX: 00007fab6139e0d9 [ 77.595822][ T6480] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 77.595832][ T6480] RBP: 00007fab621bd090 R08: 0000000000000000 R09: 0000000000000000 [ 77.595843][ T6480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.595853][ T6480] R13: 00007fab61626038 R14: 00007fab61625fa0 R15: 00007fff23ac2e08 [ 77.595877][ T6480] [ 77.595885][ T6480] ERROR: Out of memory at tomoyo_realpath_from_path. [ 77.612681][ T6476] 8021q: adding VLAN 0 to HW filter on device bond1 [ 77.702443][ T6478] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 77.715974][ T6487] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 77.732333][ T6487] ip6t_REJECT: ECHOREPLY is not supported [ 77.841538][ T6501] FAULT_INJECTION: forcing a failure. [ 77.841538][ T6501] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.841572][ T6501] CPU: 0 UID: 0 PID: 6501 Comm: syz.3.224 Tainted: G L syzkaller #0 PREEMPT(full) [ 77.841597][ T6501] Tainted: [L]=SOFTLOCKUP [ 77.841603][ T6501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.841614][ T6501] Call Trace: [ 77.841620][ T6501] [ 77.841627][ T6501] dump_stack_lvl+0x100/0x190 [ 77.841654][ T6501] should_fail_ex.cold+0x5/0xa [ 77.841695][ T6501] _copy_from_user+0x2e/0xd0 [ 77.841728][ T6501] move_addr_to_kernel+0x65/0x170 [ 77.841749][ T6501] __sys_sendto+0x1b8/0x4e0 [ 77.841772][ T6501] ? __pfx___sys_sendto+0x10/0x10 [ 77.841800][ T6501] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 77.841848][ T6501] ? ksys_write+0x1ac/0x250 [ 77.841866][ T6501] ? __pfx_ksys_write+0x10/0x10 [ 77.841885][ T6501] __x64_sys_sendto+0xe0/0x1c0 [ 77.841906][ T6501] ? do_syscall_64+0x90/0x870 [ 77.841928][ T6501] ? lockdep_hardirqs_on+0x78/0x100 [ 77.841950][ T6501] do_syscall_64+0x115/0x870 [ 77.841970][ T6501] ? clear_bhb_loop+0x40/0x90 [ 77.841992][ T6501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.842010][ T6501] RIP: 0033:0x7f586679e0d9 [ 77.842025][ T6501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.842043][ T6501] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 77.842061][ T6501] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 77.842073][ T6501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 77.842083][ T6501] RBP: 00007f5867733090 R08: 0000200000000100 R09: 0000000000000014 [ 77.842094][ T6501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.842119][ T6501] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 77.842143][ T6501] [ 77.917596][ T6512] FAULT_INJECTION: forcing a failure. [ 77.917596][ T6512] name failslab, interval 1, probability 0, space 0, times 0 [ 77.918615][ T5743] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 77.930110][ T6512] CPU: 1 UID: 0 PID: 6512 Comm: syz.2.228 Tainted: G L syzkaller #0 PREEMPT(full) [ 77.930140][ T6512] Tainted: [L]=SOFTLOCKUP [ 77.930145][ T6512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.930152][ T6512] Call Trace: [ 77.930156][ T6512] [ 77.930160][ T6512] dump_stack_lvl+0x100/0x190 [ 77.930195][ T6512] should_fail_ex.cold+0x5/0xa [ 77.930207][ T6512] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 77.930226][ T6512] should_failslab+0xc2/0x120 [ 77.930240][ T6512] kmem_cache_alloc_noprof+0x91/0x6a0 [ 77.930254][ T6512] ? skb_clone+0x190/0x400 [ 77.930272][ T6512] skb_clone+0x190/0x400 [ 77.930286][ T6512] netlink_deliver_tap+0xaed/0xcc0 [ 77.930301][ T6512] netlink_unicast+0x62b/0x850 [ 77.930314][ T6512] ? __pfx_netlink_unicast+0x10/0x10 [ 77.930329][ T6512] netlink_sendmsg+0x8b0/0xda0 [ 77.930343][ T6512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.930356][ T6512] ? selinux_socket_sendmsg+0x198/0x2f0 [ 77.930375][ T6512] ____sys_sendmsg+0xa4d/0xbe0 [ 77.930391][ T6512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.930404][ T6512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.930426][ T6512] ___sys_sendmsg+0x190/0x1e0 [ 77.930438][ T6512] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.930448][ T6512] ? __lock_acquire+0x49f/0x1a40 [ 77.930461][ T6512] ? get_pid_task+0x106/0x250 [ 77.930486][ T6512] __sys_sendmsg+0x160/0x210 [ 77.930501][ T6512] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.930522][ T6512] do_syscall_64+0x115/0x870 [ 77.930536][ T6512] ? clear_bhb_loop+0x40/0x90 [ 77.930549][ T6512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.930560][ T6512] RIP: 0033:0x7f9f9359e0d9 [ 77.930570][ T6512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.930580][ T6512] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.930592][ T6512] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 77.930599][ T6512] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000007 [ 77.930605][ T6512] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 77.930611][ T6512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.930617][ T6512] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 77.930631][ T6512] [ 78.077540][ T6516] FAULT_INJECTION: forcing a failure. [ 78.077540][ T6516] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 78.083543][ T6516] CPU: 3 UID: 0 PID: 6516 Comm: syz.0.229 Tainted: G L syzkaller #0 PREEMPT(full) [ 78.083572][ T6516] Tainted: [L]=SOFTLOCKUP [ 78.083579][ T6516] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.083590][ T6516] Call Trace: [ 78.083597][ T6516] [ 78.083603][ T6516] dump_stack_lvl+0x100/0x190 [ 78.083632][ T6516] should_fail_ex.cold+0x5/0xa [ 78.083655][ T6516] _copy_to_user+0x32/0xd0 [ 78.083682][ T6516] simple_read_from_buffer+0xcb/0x170 [ 78.083703][ T6516] proc_fail_nth_read+0x1af/0x230 [ 78.083732][ T6516] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 78.083758][ T6516] ? rw_verify_area+0xce/0x6d0 [ 78.083781][ T6516] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 78.083806][ T6516] vfs_read+0x1e4/0xb40 [ 78.083841][ T6516] ? __pfx_vfs_read+0x10/0x10 [ 78.083865][ T6516] ? __fget_files+0x215/0x3d0 [ 78.083886][ T6516] ? __fget_files+0x21f/0x3d0 [ 78.083911][ T6516] ksys_read+0x12a/0x250 [ 78.083937][ T6516] ? __pfx_ksys_read+0x10/0x10 [ 78.083970][ T6516] do_syscall_64+0x115/0x870 [ 78.083993][ T6516] ? clear_bhb_loop+0x40/0x90 [ 78.084015][ T6516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.084034][ T6516] RIP: 0033:0x7fab6135e90e [ 78.084049][ T6516] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 78.084066][ T6516] RSP: 002b:00007fab621bcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 78.084083][ T6516] RAX: ffffffffffffffda RBX: 00007fab621bd6c0 RCX: 00007fab6135e90e [ 78.084095][ T6516] RDX: 000000000000000f RSI: 00007fab621bd0a0 RDI: 0000000000000007 [ 78.084105][ T6516] RBP: 00007fab621bd090 R08: 0000000000000000 R09: 0000000000000000 [ 78.084115][ T6516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.084126][ T6516] R13: 00007fab61626038 R14: 00007fab61625fa0 R15: 00007fff23ac2e08 [ 78.084150][ T6516] [ 78.148948][ T5818] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 78.229769][ T6522] netlink: 44 bytes leftover after parsing attributes in process `syz.0.232'. [ 78.269914][ T6522] ptrace attach of "/syz-executor exec"[5747] was attempted by " [ 78.318249][ T5818] usb 6-1: Using ep0 maxpacket: 16 [ 78.352716][ T5818] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 78.358387][ T5818] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 78.362348][ T5818] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.365508][ T5818] usb 6-1: Product: syz [ 78.367294][ T5818] usb 6-1: Manufacturer: syz [ 78.369626][ T5818] usb 6-1: SerialNumber: syz [ 78.372982][ T5818] usb 6-1: config 0 descriptor?? [ 78.379593][ T5818] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 78.383362][ T5818] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 78.801351][ T6536] FAULT_INJECTION: forcing a failure. [ 78.801351][ T6536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 78.806050][ T6536] CPU: 0 UID: 0 PID: 6536 Comm: syz.2.238 Tainted: G L syzkaller #0 PREEMPT(full) [ 78.806079][ T6536] Tainted: [L]=SOFTLOCKUP [ 78.806085][ T6536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.806096][ T6536] Call Trace: [ 78.806103][ T6536] [ 78.806110][ T6536] dump_stack_lvl+0x100/0x190 [ 78.806138][ T6536] should_fail_ex.cold+0x5/0xa [ 78.806161][ T6536] strncpy_from_user+0x3b/0x2d0 [ 78.806189][ T6536] do_getname+0x78/0x390 [ 78.806215][ T6536] __x64_sys_rmdir+0x36/0x70 [ 78.806235][ T6536] do_syscall_64+0x115/0x870 [ 78.806259][ T6536] ? clear_bhb_loop+0x40/0x90 [ 78.806281][ T6536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.806300][ T6536] RIP: 0033:0x7f9f9359e0d9 [ 78.806321][ T6536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.806339][ T6536] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 78.806358][ T6536] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 78.806370][ T6536] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 78.806381][ T6536] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 78.806392][ T6536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.806404][ T6536] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 78.806428][ T6536] [ 78.814579][ T6538] netlink: 24 bytes leftover after parsing attributes in process `syz.3.239'. [ 78.936598][ T6542] netlink: 104 bytes leftover after parsing attributes in process `syz.3.241'. [ 78.979984][ T6547] SELinux: policydb magic number 0x4 does not match expected magic number 0xf97cff8c [ 78.980589][ T5818] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 78.983920][ T6547] SELinux: failed to load policy [ 79.031498][ T6549] openvswitch: netlink: IP tunnel dst address not specified [ 79.034342][ T6549] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 79.060047][ T6551] netlink: 'syz.3.245': attribute type 2 has an invalid length. [ 79.063569][ T6551] netlink: 151 bytes leftover after parsing attributes in process `syz.3.245'. [ 79.089490][ T6553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.246'. [ 79.379781][ T6559] netlink: 4 bytes leftover after parsing attributes in process `syz.0.249'. [ 79.383557][ T6559] netlink: 4 bytes leftover after parsing attributes in process `syz.0.249'. [ 79.394884][ T5818] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 79.397825][ T5818] em28xx 6-1:0.0: board has no eeprom [ 79.429861][ T60] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 79.458260][ T5818] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 79.460831][ T5818] em28xx 6-1:0.0: dvb set to bulk mode. [ 79.463659][ T34] em28xx 6-1:0.0: Binding DVB extension [ 79.472713][ T5818] usb 6-1: USB disconnect, device number 6 [ 79.497408][ T34] em28xx 6-1:0.0: Registering input extension [ 79.501101][ T5818] em28xx 6-1:0.0: Disconnecting em28xx [ 79.503815][ T5818] em28xx 6-1:0.0: Closing input extension [ 79.524451][ T5818] em28xx 6-1:0.0: Freeing device [ 79.578655][ T60] usb 8-1: Using ep0 maxpacket: 8 [ 79.583450][ T60] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 79.587246][ T60] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 79.591513][ T60] usb 8-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 79.595884][ T60] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 79.600197][ T60] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 79.604206][ T60] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 79.609559][ T60] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 79.613321][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.699119][ T6575] netlink: 8 bytes leftover after parsing attributes in process `syz.0.255'. [ 79.822134][ T60] usb 8-1: GET_CAPABILITIES returned 0 [ 79.824578][ T60] usbtmc 8-1:16.0: can't read capabilities [ 80.023959][ T6557] FAULT_INJECTION: forcing a failure. [ 80.023959][ T6557] name failslab, interval 1, probability 0, space 0, times 0 [ 80.028651][ T6557] CPU: 3 UID: 0 PID: 6557 Comm: syz.3.248 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.028670][ T6557] Tainted: [L]=SOFTLOCKUP [ 80.028673][ T6557] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.028680][ T6557] Call Trace: [ 80.028685][ T6557] [ 80.028690][ T6557] dump_stack_lvl+0x100/0x190 [ 80.028708][ T6557] should_fail_ex.cold+0x5/0xa [ 80.028722][ T6557] should_failslab+0xc2/0x120 [ 80.028737][ T6557] __kmalloc_noprof+0xfc/0x820 [ 80.028749][ T6557] ? rcu_is_watching+0x12/0xc0 [ 80.028766][ T6557] ? tomoyo_realpath_from_path+0xb6/0x690 [ 80.028781][ T6557] tomoyo_realpath_from_path+0xb6/0x690 [ 80.028795][ T6557] tomoyo_path_number_perm+0x23c/0x580 [ 80.028810][ T6557] ? tomoyo_path_number_perm+0x22e/0x580 [ 80.028826][ T6557] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 80.028854][ T6557] ? find_held_lock+0x2b/0x80 [ 80.028864][ T6557] ? __fget_files+0x215/0x3d0 [ 80.028875][ T6557] ? hook_file_ioctl_common+0x140/0x440 [ 80.028887][ T6557] ? __fget_files+0x215/0x3d0 [ 80.028900][ T6557] ? __fget_files+0x21f/0x3d0 [ 80.028913][ T6557] security_file_ioctl+0xd3/0x230 [ 80.028931][ T6557] __x64_sys_ioctl+0xb7/0x210 [ 80.028947][ T6557] do_syscall_64+0x115/0x870 [ 80.028961][ T6557] ? clear_bhb_loop+0x40/0x90 [ 80.028975][ T6557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.028986][ T6557] RIP: 0033:0x7f586679e0d9 [ 80.028995][ T6557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.029006][ T6557] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.029017][ T6557] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 80.029024][ T6557] RDX: 0000200000002000 RSI: 00000000c0145b0e RDI: 0000000000000004 [ 80.029043][ T6557] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 80.029051][ T6557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.029057][ T6557] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 80.029071][ T6557] [ 80.029789][ T6557] ERROR: Out of memory at tomoyo_realpath_from_path. [ 80.115293][ T60] usb 8-1: USB disconnect, device number 6 [ 80.451484][ T6603] tipc: Enabling not permitted [ 80.453558][ T6603] tipc: Enabling of bearer rejected, failed to enable media [ 80.506927][ T6605] FAULT_INJECTION: forcing a failure. [ 80.506927][ T6605] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 80.512516][ T6605] CPU: 1 UID: 0 PID: 6605 Comm: syz.2.269 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.512544][ T6605] Tainted: [L]=SOFTLOCKUP [ 80.512550][ T6605] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.512558][ T6605] Call Trace: [ 80.512563][ T6605] [ 80.512569][ T6605] dump_stack_lvl+0x100/0x190 [ 80.512592][ T6605] should_fail_ex.cold+0x5/0xa [ 80.512607][ T6605] ? prepare_alloc_pages+0x16d/0x5f0 [ 80.512627][ T6605] should_fail_alloc_page+0xeb/0x140 [ 80.512647][ T6605] prepare_alloc_pages+0x1f0/0x5f0 [ 80.512669][ T6605] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 80.512688][ T6605] ? rcu_is_watching+0x12/0xc0 [ 80.512709][ T6605] ? trace_mm_page_alloc+0x164/0x1c0 [ 80.512733][ T6605] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 80.512754][ T6605] ? is_bpf_text_address+0x8a/0x1a0 [ 80.512779][ T6605] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 80.512799][ T6605] ? is_bpf_text_address+0x94/0x1a0 [ 80.512816][ T6605] ? kernel_text_address+0x8d/0x100 [ 80.512836][ T6605] ? __kernel_text_address+0xd/0x30 [ 80.512856][ T6605] ? unwind_get_return_address+0x59/0xa0 [ 80.512873][ T6605] ? arch_stack_walk+0xa6/0xf0 [ 80.512900][ T6605] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 80.512923][ T6605] ? stack_trace_save+0x8e/0xc0 [ 80.512941][ T6605] ? __pfx_stack_trace_save+0x10/0x10 [ 80.512969][ T6605] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 80.512995][ T6605] ? policy_nodemask+0xed/0x4f0 [ 80.513022][ T6605] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 80.513051][ T6605] __kasan_populate_vmalloc+0xf0/0x210 [ 80.513076][ T6605] alloc_vmap_area+0x95d/0x2bb0 [ 80.513100][ T6605] ? kasan_save_track+0x14/0x30 [ 80.513120][ T6605] ? __kasan_kmalloc+0xaa/0xb0 [ 80.513141][ T6605] ? __pfx_alloc_vmap_area+0x10/0x10 [ 80.513165][ T6605] ? __get_vm_area_node+0x101/0x330 [ 80.513198][ T6605] __get_vm_area_node+0x1ca/0x330 [ 80.513227][ T6605] __vmalloc_node_range_noprof+0x228/0x1630 [ 80.513254][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.513273][ T6605] ? rcu_is_watching+0x12/0xc0 [ 80.513307][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.513332][ T6605] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 80.513356][ T6605] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 80.513383][ T6605] ? trace_kmem_cache_alloc+0xdd/0x100 [ 80.513432][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.513451][ T6605] __vmalloc_node_noprof+0xad/0xf0 [ 80.513473][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.513492][ T6605] copy_process+0x7fb/0x8030 [ 80.513528][ T6605] ? __pfx_copy_process+0x10/0x10 [ 80.513554][ T6605] ? __kasan_kmalloc+0xaa/0xb0 [ 80.513577][ T6605] ? lockdep_init_map_type+0x5c/0x250 [ 80.513602][ T6605] ? lockdep_init_map_type+0x5c/0x250 [ 80.513625][ T6605] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 80.513649][ T6605] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 80.513677][ T6605] vhost_task_create+0x1db/0x370 [ 80.513692][ T6605] ? __pfx_vhost_task_create+0x10/0x10 [ 80.513713][ T6605] ? __pfx_vhost_task_fn+0x10/0x10 [ 80.513730][ T6605] ? __pfx___mutex_lock+0x10/0x10 [ 80.513748][ T6605] ? kasan_quarantine_put+0x104/0x240 [ 80.513768][ T6605] kvm_mmu_post_init_vm+0x1b3/0x360 [ 80.513789][ T6605] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 80.513809][ T6605] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 80.513828][ T6605] kvm_vcpu_ioctl+0x730/0x1700 [ 80.513845][ T6605] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.513860][ T6605] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.513877][ T6605] ? do_vfs_ioctl+0x226/0x13e0 [ 80.513898][ T6605] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 80.513918][ T6605] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 80.513946][ T6605] ? __fget_files+0x215/0x3d0 [ 80.513959][ T6605] ? hook_file_ioctl_common+0x140/0x440 [ 80.513980][ T6605] ? selinux_file_ioctl+0x13b/0x290 [ 80.514000][ T6605] ? selinux_file_ioctl+0xb6/0x290 [ 80.514022][ T6605] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.514038][ T6605] __x64_sys_ioctl+0x18e/0x210 [ 80.514059][ T6605] do_syscall_64+0x115/0x870 [ 80.514075][ T6605] ? clear_bhb_loop+0x40/0x90 [ 80.514097][ T6605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.514115][ T6605] RIP: 0033:0x7f9f9359e0d9 [ 80.514132][ T6605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.514150][ T6605] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.514173][ T6605] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 80.514185][ T6605] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 80.514196][ T6605] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 80.514207][ T6605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.514218][ T6605] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 80.514243][ T6605] [ 80.514513][ T6605] syz.2.269: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 80.673322][ T6607] netlink: 'syz.3.270': attribute type 32 has an invalid length. [ 80.676295][ T6605] ,cpuset= [ 80.697526][ T42] kauditd_printk_skb: 48 callbacks suppressed [ 80.697542][ T42] audit: type=1400 audit(1786548710.251:544): avc: denied { watch } for pid=6606 comm="syz.3.270" path="/53/bus" dev="tmpfs" ino=306 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 80.699650][ T6605] / [ 80.702129][ T42] audit: type=1400 audit(1786548710.251:545): avc: denied { watch_sb watch_reads } for pid=6606 comm="syz.3.270" path="/53/bus" dev="tmpfs" ino=306 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 80.705165][ T6605] ,mems_allowed=0-1 [ 80.711721][ T6609] FAULT_INJECTION: forcing a failure. [ 80.711721][ T6609] name failslab, interval 1, probability 0, space 0, times 0 [ 80.719247][ T6605] [ 80.719883][ T6609] CPU: 2 UID: 0 PID: 6609 Comm: syz.1.271 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.719901][ T6609] Tainted: [L]=SOFTLOCKUP [ 80.719905][ T6609] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.719912][ T6609] Call Trace: [ 80.719917][ T6609] [ 80.719921][ T6609] dump_stack_lvl+0x100/0x190 [ 80.719939][ T6609] should_fail_ex.cold+0x5/0xa [ 80.719953][ T6609] should_failslab+0xc2/0x120 [ 80.719967][ T6609] __kmalloc_noprof+0xfc/0x820 [ 80.719981][ T6609] ? ethnl_default_doit+0x1d0/0x1520 [ 80.719996][ T6609] ethnl_default_doit+0x1d0/0x1520 [ 80.720009][ T6609] ? __pfx_ethnl_default_doit+0x10/0x10 [ 80.720020][ T6609] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 80.720034][ T6609] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 80.720050][ T6609] genl_family_rcv_msg_doit+0x214/0x300 [ 80.720065][ T6609] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 80.720079][ T6609] ? genl_get_cmd+0x3e7/0x760 [ 80.720095][ T6609] ? __dev_queue_xmit+0xa33/0x4970 [ 80.720107][ T6609] ? __radix_tree_lookup+0x217/0x2b0 [ 80.720124][ T6609] genl_rcv_msg+0x560/0x800 [ 80.720138][ T6609] ? __pfx_genl_rcv_msg+0x10/0x10 [ 80.720152][ T6609] ? __pfx_ethnl_default_doit+0x10/0x10 [ 80.720167][ T6609] netlink_rcv_skb+0x159/0x420 [ 80.720178][ T6609] ? __pfx_genl_rcv_msg+0x10/0x10 [ 80.720192][ T6609] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 80.720210][ T6609] ? netlink_deliver_tap+0x1ae/0xcc0 [ 80.720224][ T6609] genl_rcv+0x28/0x40 [ 80.720237][ T6609] netlink_unicast+0x585/0x850 [ 80.720250][ T6609] ? __pfx_netlink_unicast+0x10/0x10 [ 80.720261][ T6609] ? __pfx_sock_has_perm+0x10/0x10 [ 80.720279][ T6609] netlink_sendmsg+0x8b0/0xda0 [ 80.720293][ T6609] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.720306][ T6609] ? selinux_socket_sendmsg+0x198/0x2f0 [ 80.720324][ T6609] ____sys_sendmsg+0xa4d/0xbe0 [ 80.720341][ T6609] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.720353][ T6609] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.720376][ T6609] ___sys_sendmsg+0x190/0x1e0 [ 80.720388][ T6609] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.720398][ T6609] ? __lock_acquire+0x49f/0x1a40 [ 80.720412][ T6609] ? get_pid_task+0x106/0x250 [ 80.720435][ T6609] __sys_sendmsg+0x160/0x210 [ 80.720450][ T6609] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.720471][ T6609] do_syscall_64+0x115/0x870 [ 80.720484][ T6609] ? clear_bhb_loop+0x40/0x90 [ 80.720497][ T6609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.720509][ T6609] RIP: 0033:0x7f255c79e0d9 [ 80.720519][ T6609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.720529][ T6609] RSP: 002b:00007f255d606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.720540][ T6609] RAX: ffffffffffffffda RBX: 00007f255ca25fa0 RCX: 00007f255c79e0d9 [ 80.720546][ T6609] RDX: 0000000000004800 RSI: 0000200000000200 RDI: 0000000000000003 [ 80.720552][ T6609] RBP: 00007f255d606090 R08: 0000000000000000 R09: 0000000000000000 [ 80.720558][ T6609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.720564][ T6609] R13: 00007f255ca26038 R14: 00007f255ca25fa0 R15: 00007ffed58282b8 [ 80.720578][ T6609] [ 80.775489][ T42] audit: type=1400 audit(1786548710.331:546): avc: denied { ioctl } for pid=6612 comm="syz.1.273" path="socket:[12768]" dev="sockfs" ino=12768 ioctlcmd=0x582d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 80.777406][ T847] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 80.782173][ T6605] CPU: 0 UID: 0 PID: 6605 Comm: syz.2.269 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.782192][ T6605] Tainted: [L]=SOFTLOCKUP [ 80.782196][ T6605] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.782203][ T6605] Call Trace: [ 80.782208][ T6605] [ 80.782212][ T6605] dump_stack_lvl+0x100/0x190 [ 80.782231][ T6605] warn_alloc.cold+0x94/0xa8 [ 80.782251][ T6605] ? __pfx_warn_alloc+0x10/0x10 [ 80.782262][ T6605] ? lockdep_hardirqs_on+0x78/0x100 [ 80.782279][ T6605] ? __get_vm_area_node+0x2cd/0x330 [ 80.782297][ T6605] ? __get_vm_area_node+0x208/0x330 [ 80.782315][ T6605] __vmalloc_node_range_noprof+0xccd/0x1630 [ 80.782331][ T6605] ? rcu_is_watching+0x12/0xc0 [ 80.782353][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.782369][ T6605] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 80.782387][ T6605] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 80.782413][ T6605] ? trace_kmem_cache_alloc+0xdd/0x100 [ 80.782438][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.782457][ T6605] __vmalloc_node_noprof+0xad/0xf0 [ 80.782483][ T6605] ? vhost_task_create+0x1db/0x370 [ 80.782505][ T6605] copy_process+0x7fb/0x8030 [ 80.782547][ T6605] ? __pfx_copy_process+0x10/0x10 [ 80.782569][ T6605] ? __kasan_kmalloc+0xaa/0xb0 [ 80.782608][ T6605] ? lockdep_init_map_type+0x5c/0x250 [ 80.782633][ T6605] ? lockdep_init_map_type+0x5c/0x250 [ 80.782656][ T6605] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 80.782678][ T6605] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 80.782708][ T6605] vhost_task_create+0x1db/0x370 [ 80.782729][ T6605] ? __pfx_vhost_task_create+0x10/0x10 [ 80.782754][ T6605] ? __pfx_vhost_task_fn+0x10/0x10 [ 80.782777][ T6605] ? __pfx___mutex_lock+0x10/0x10 [ 80.782798][ T6605] ? kasan_quarantine_put+0x104/0x240 [ 80.782824][ T6605] kvm_mmu_post_init_vm+0x1b3/0x360 [ 80.782851][ T6605] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 80.782877][ T6605] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 80.782902][ T6605] kvm_vcpu_ioctl+0x730/0x1700 [ 80.782924][ T6605] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.782944][ T6605] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.782964][ T6605] ? do_vfs_ioctl+0x226/0x13e0 [ 80.782991][ T6605] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 80.783017][ T6605] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 80.783048][ T6605] ? __fget_files+0x215/0x3d0 [ 80.783062][ T6605] ? hook_file_ioctl_common+0x140/0x440 [ 80.783090][ T6605] ? selinux_file_ioctl+0x13b/0x290 [ 80.783107][ T6605] ? selinux_file_ioctl+0xb6/0x290 [ 80.783125][ T6605] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.783138][ T6605] __x64_sys_ioctl+0x18e/0x210 [ 80.783155][ T6605] do_syscall_64+0x115/0x870 [ 80.783168][ T6605] ? clear_bhb_loop+0x40/0x90 [ 80.783180][ T6605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.783192][ T6605] RIP: 0033:0x7f9f9359e0d9 [ 80.783202][ T6605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.783213][ T6605] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.783224][ T6605] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 80.783231][ T6605] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 80.783242][ T6605] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 80.783249][ T6605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.783255][ T6605] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 80.783269][ T6605] [ 80.783310][ T6605] Mem-Info: [ 80.849056][ T6620] FAULT_INJECTION: forcing a failure. [ 80.849056][ T6620] name failslab, interval 1, probability 0, space 0, times 0 [ 80.850524][ T6605] active_anon:8948 inactive_anon:0 isolated_anon:0 [ 80.850524][ T6605] active_file:0 inactive_file:64292 isolated_file:0 [ 80.850524][ T6605] unevictable:1768 dirty:1022 writeback:0 [ 80.850524][ T6605] slab_reclaimable:11366 slab_unreclaimable:66985 [ 80.850524][ T6605] mapped:25023 shmem:2324 pagetables:1302 [ 80.850524][ T6605] sec_pagetables:297 bounce:0 [ 80.850524][ T6605] kernel_misc_reclaimable:0 [ 80.850524][ T6605] free:449519 free_pcp:13357 free_cma:0 [ 80.851659][ T6620] CPU: 2 UID: 0 PID: 6620 Comm: syz.3.276 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.851676][ T6620] Tainted: [L]=SOFTLOCKUP [ 80.851680][ T6620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.851687][ T6620] Call Trace: [ 80.851691][ T6620] [ 80.851696][ T6620] dump_stack_lvl+0x100/0x190 [ 80.851713][ T6620] should_fail_ex.cold+0x5/0xa [ 80.851727][ T6620] should_failslab+0xc2/0x120 [ 80.851742][ T6620] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 80.851757][ T6620] ? mptcp_pm_nl_add_addr_doit+0x1e5/0xc30 [ 80.851774][ T6620] kmemdup_noprof+0x29/0x60 [ 80.851787][ T6620] mptcp_pm_nl_add_addr_doit+0x1e5/0xc30 [ 80.851804][ T6620] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 80.851819][ T6620] ? rcu_is_watching+0x12/0xc0 [ 80.851835][ T6620] ? trace_kmalloc+0xeb/0x110 [ 80.851849][ T6620] ? __kasan_kmalloc+0xaa/0xb0 [ 80.851866][ T6620] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 80.851882][ T6620] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 80.851899][ T6620] genl_family_rcv_msg_doit+0x214/0x300 [ 80.851914][ T6620] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 80.851932][ T6620] ? bpf_lsm_capable+0x9/0x10 [ 80.851943][ T6620] ? security_capable+0x80/0x260 [ 80.851958][ T6620] ? ns_capable+0xd2/0xf0 [ 80.851972][ T6620] genl_rcv_msg+0x560/0x800 [ 80.851986][ T6620] ? __pfx_genl_rcv_msg+0x10/0x10 [ 80.852000][ T6620] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 80.852019][ T6620] netlink_rcv_skb+0x159/0x420 [ 80.852030][ T6620] ? __pfx_genl_rcv_msg+0x10/0x10 [ 80.852044][ T6620] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 80.852060][ T6620] ? netlink_deliver_tap+0x1ae/0xcc0 [ 80.852073][ T6620] genl_rcv+0x28/0x40 [ 80.852084][ T6620] netlink_unicast+0x585/0x850 [ 80.852097][ T6620] ? __pfx_netlink_unicast+0x10/0x10 [ 80.852113][ T6620] netlink_sendmsg+0x8b0/0xda0 [ 80.852126][ T6620] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.852139][ T6620] ? selinux_socket_sendmsg+0x198/0x2f0 [ 80.852161][ T6620] ____sys_sendmsg+0xa4d/0xbe0 [ 80.852177][ T6620] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.852190][ T6620] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.852213][ T6620] ___sys_sendmsg+0x190/0x1e0 [ 80.852224][ T6620] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.852234][ T6620] ? __lock_acquire+0x49f/0x1a40 [ 80.852247][ T6620] ? get_pid_task+0x106/0x250 [ 80.852271][ T6620] __sys_sendmsg+0x160/0x210 [ 80.852286][ T6620] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.852307][ T6620] do_syscall_64+0x115/0x870 [ 80.852320][ T6620] ? clear_bhb_loop+0x40/0x90 [ 80.852333][ T6620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.852344][ T6620] RIP: 0033:0x7f586679e0d9 [ 80.852354][ T6620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.852364][ T6620] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.852376][ T6620] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 80.852383][ T6620] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000005 [ 80.852391][ T6620] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 80.852400][ T6620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.852408][ T6620] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 80.852430][ T6620] [ 81.141702][ T6605] Node 0 active_anon:36004kB inactive_anon:0kB active_file:0kB inactive_file:256972kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:108392kB dirty:2004kB writeback:44kB shmem:5756kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13344kB pagetables:5180kB sec_pagetables:1188kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 81.153860][ T6605] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 81.164687][ T6605] Node 0 DMA free:15360kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 81.174399][ T6605] lowmem_reserve[]: 0 1225 1225 1225 1225 [ 81.176319][ T6605] Node 0 DMA32 free:150716kB boost:0kB min:27396kB low:34244kB high:41092kB reserved_highatomic:0KB free_highatomic:0KB active_anon:35992kB inactive_anon:0kB active_file:0kB inactive_file:256972kB unevictable:3536kB writepending:2048kB zspages:0kB present:2080628kB managed:1255220kB mlocked:0kB bounce:0kB free_pcp:41804kB local_pcp:13280kB free_cma:0kB [ 81.186856][ T6605] lowmem_reserve[]: 0 0 0 0 0 [ 81.188619][ T6605] Node 1 Normal free:1637268kB boost:0kB min:39840kB low:49800kB high:59760kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:3536kB writepending:4kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:8368kB local_pcp:8192kB free_cma:0kB [ 81.200225][ T6605] lowmem_reserve[]: 0 0 0 0 0 [ 81.202387][ T6605] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 81.207197][ T6605] Node 0 DMA32: 612*4kB (UME) 846*8kB (UME) 475*16kB (UME) 364*32kB (UME) 136*64kB (UME) 66*128kB (UME) 44*256kB (UME) 23*512kB (UME) 10*1024kB (UME) 7*2048kB (UME) 14*4096kB (UM) = 150576kB [ 81.213485][ T6605] Node 1 Normal: 3*4kB (M) 1*8kB (U) 8*16kB (UM) 18*32kB (UM) 9*64kB (UM) 9*128kB (UM) 0*256kB 3*512kB (M) 1*1024kB (U) 1*2048kB (M) 398*4096kB (M) = 1637268kB [ 81.219875][ T847] usb 5-1: Using ep0 maxpacket: 16 [ 81.221935][ T6605] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 81.225551][ T6605] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 81.230075][ T6605] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 81.233920][ T6605] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 81.237392][ T6605] 66613 total pagecache pages [ 81.239411][ T6605] 0 pages in swap cache [ 81.241089][ T6605] Free swap = 124996kB [ 81.242752][ T847] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 81.242849][ T6605] Total swap = 124996kB [ 81.247679][ T6605] 1048443 pages RAM [ 81.248283][ T847] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 81.249468][ T6605] 0 pages HighMem/MovableOnly [ 81.252311][ T847] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.253855][ T6605] 285327 pages reserved [ 81.259128][ T847] usb 5-1: Product: syz [ 81.259403][ T6605] 0 pages cma reserved [ 81.260751][ T847] usb 5-1: Manufacturer: syz [ 81.264033][ T847] usb 5-1: SerialNumber: syz [ 81.269824][ T847] usb 5-1: config 0 descriptor?? [ 81.274251][ T847] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 81.277815][ T847] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 81.352845][ T42] audit: type=1400 audit(1786548710.911:547): avc: denied { create } for pid=6628 comm="syz.2.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 81.356638][ T6629] comedi: No check for data length of config insn id 8 is implemented [ 81.360595][ T42] audit: type=1400 audit(1786548710.911:548): avc: denied { setopt } for pid=6628 comm="syz.2.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 81.362939][ T6629] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 81.370428][ T42] audit: type=1400 audit(1786548710.911:549): avc: denied { mount } for pid=6628 comm="syz.2.278" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 81.381880][ T6629] comedi: Assuming n=15 is correct [ 81.405095][ T42] audit: type=1400 audit(1786548710.961:550): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 81.810467][ T42] audit: type=1400 audit(1786548711.360:551): avc: denied { mounton } for pid=6647 comm="syz.1.284" path="/77/file0" dev="tmpfs" ino=431 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 81.845151][ T41] cfg80211: failed to load regulatory.db [ 81.855924][ T42] audit: type=1400 audit(1786548711.408:552): avc: denied { execute } for pid=6650 comm="syz.3.286" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 81.898268][ T847] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 81.977612][ T42] audit: type=1400 audit(1786548711.525:553): avc: denied { append } for pid=6654 comm="syz.3.287" name="nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 81.980068][ T6655] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 82.198852][ T6666] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 82.204274][ T6666] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 82.211247][ T6666] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 82.215185][ T6666] overlayfs: d_ino too big (., ino=4611686018427387926, xinobits=3) [ 82.218228][ T6666] overlayfs: d_ino too big (gadget, ino=4611686018427391801, xinobits=3) [ 82.221457][ T6666] overlayfs: d_ino too big (snd_seq, ino=4611686018427391992, xinobits=3) [ 82.228843][ T6666] overlayfs: d_ino too big (netdevsim, ino=4611686018427415615, xinobits=3) [ 82.232375][ T6666] overlayfs: d_ino too big (serio, ino=4611686018427391818, xinobits=3) [ 82.235112][ T6666] overlayfs: d_ino too big (ulpi, ino=4611686018427391755, xinobits=3) [ 82.237751][ T6666] overlayfs: d_ino too big (coreboot, ino=4611686018427391904, xinobits=3) [ 82.240424][ T6666] overlayfs: d_ino too big (hdaudio, ino=4611686018427391998, xinobits=3) [ 82.243229][ T6666] overlayfs: d_ino too big (iio, ino=4611686018427391934, xinobits=3) [ 82.245913][ T6666] overlayfs: d_ino too big (firewire, ino=4611686018427415629, xinobits=3) [ 82.281241][ T6668] FAULT_INJECTION: forcing a failure. [ 82.281241][ T6668] name failslab, interval 1, probability 0, space 0, times 0 [ 82.285810][ T6668] CPU: 2 UID: 0 PID: 6668 Comm: syz.2.292 Tainted: G L syzkaller #0 PREEMPT(full) [ 82.285837][ T6668] Tainted: [L]=SOFTLOCKUP [ 82.285843][ T6668] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.285854][ T6668] Call Trace: [ 82.285860][ T6668] [ 82.285866][ T6668] dump_stack_lvl+0x100/0x190 [ 82.285893][ T6668] should_fail_ex.cold+0x5/0xa [ 82.285915][ T6668] should_failslab+0xc2/0x120 [ 82.285937][ T6668] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 82.285958][ T6668] ? __alloc_skb+0x5b7/0x710 [ 82.285979][ T6668] ? __alloc_skb+0x140/0x710 [ 82.286001][ T6668] __alloc_skb+0x140/0x710 [ 82.286020][ T6668] ? __alloc_skb+0x5b7/0x710 [ 82.286040][ T6668] ? __pfx___alloc_skb+0x10/0x10 [ 82.286064][ T6668] netlink_ack+0x117/0xb80 [ 82.286083][ T6668] ? avc_has_perm_noaudit+0x145/0x3b0 [ 82.286109][ T6668] netlink_rcv_skb+0x333/0x420 [ 82.286127][ T6668] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 82.286152][ T6668] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 82.286180][ T6668] ? ns_capable+0xd2/0xf0 [ 82.286204][ T6668] nfnetlink_rcv+0x1b3/0x440 [ 82.286226][ T6668] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 82.286247][ T6668] ? netlink_deliver_tap+0x1ae/0xcc0 [ 82.286269][ T6668] netlink_unicast+0x585/0x850 [ 82.286295][ T6668] ? __pfx_netlink_unicast+0x10/0x10 [ 82.286320][ T6668] netlink_sendmsg+0x8b0/0xda0 [ 82.286341][ T6668] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.286362][ T6668] ? selinux_socket_sendmsg+0x198/0x2f0 [ 82.286389][ T6668] ____sys_sendmsg+0xa4d/0xbe0 [ 82.286413][ T6668] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.286434][ T6668] ? __pfx_____sys_sendmsg+0x10/0x10 [ 82.286468][ T6668] ___sys_sendmsg+0x190/0x1e0 [ 82.286488][ T6668] ? __pfx____sys_sendmsg+0x10/0x10 [ 82.286503][ T6668] ? __lock_acquire+0x49f/0x1a40 [ 82.286524][ T6668] ? get_pid_task+0x106/0x250 [ 82.286563][ T6668] __sys_sendmsg+0x160/0x210 [ 82.286586][ T6668] ? __pfx___sys_sendmsg+0x10/0x10 [ 82.286618][ T6668] do_syscall_64+0x115/0x870 [ 82.286653][ T6668] ? clear_bhb_loop+0x40/0x90 [ 82.286675][ T6668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.286692][ T6668] RIP: 0033:0x7f9f9359e0d9 [ 82.286709][ T6668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.286724][ T6668] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 82.286742][ T6668] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 82.286752][ T6668] RDX: 0000000004000080 RSI: 0000200000000000 RDI: 0000000000000003 [ 82.286763][ T6668] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 82.286773][ T6668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.286782][ T6668] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 82.286804][ T6668] [ 82.393922][ T847] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 82.397420][ T847] em28xx 5-1:0.0: board has no eeprom [ 82.415952][ T6671] jffs2: notice: (6671) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 82.467407][ T6674] __nla_validate_parse: 9 callbacks suppressed [ 82.467420][ T6674] netlink: 8 bytes leftover after parsing attributes in process `syz.2.294'. [ 82.470232][ T847] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 82.475792][ T847] em28xx 5-1:0.0: dvb set to bulk mode. [ 82.480744][ T55] em28xx 5-1:0.0: Binding DVB extension [ 82.486503][ T847] usb 5-1: USB disconnect, device number 9 [ 82.491422][ T847] em28xx 5-1:0.0: Disconnecting em28xx [ 82.520186][ T55] em28xx 5-1:0.0: Registering input extension [ 82.522794][ T847] em28xx 5-1:0.0: Closing input extension [ 82.537557][ T847] em28xx 5-1:0.0: Freeing device [ 82.810153][ T60] usb 7-1: new low-speed USB device number 7 using dummy_hcd [ 82.987465][ T60] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 82.993991][ T60] usb 7-1: config 0 has no interface number 0 [ 82.997523][ T60] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 83.001424][ T60] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 83.006478][ T60] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 83.012056][ T60] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 12408, setting to 8 [ 83.015772][ T60] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 83.021217][ T60] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 83.024905][ T60] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.029436][ T60] usb 7-1: config 0 descriptor?? [ 83.032779][ T6679] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 83.035668][ T6679] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 83.042059][ T60] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 83.179759][ T6699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.303'. [ 83.247744][ T6679] ldusb 7-1:0.55: Write buffer overflow, 2 bytes dropped [ 83.252316][ T55] usb 7-1: USB disconnect, device number 7 [ 83.257455][ T55] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 83.582911][ T60] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 83.736888][ T60] usb 5-1: Using ep0 maxpacket: 16 [ 83.739885][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 83.745229][ T60] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 83.749600][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.752887][ T60] usb 5-1: Product: syz [ 83.754601][ T60] usb 5-1: Manufacturer: syz [ 83.756493][ T60] usb 5-1: SerialNumber: syz [ 83.760758][ T60] usb 5-1: config 0 descriptor?? [ 83.766489][ T60] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 83.769976][ T60] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 83.808985][ T6710] o2hb: Heartbeat mode set to global [ 83.885574][ T6714] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 84.388791][ T60] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 84.449966][ T6721] netlink: 8 bytes leftover after parsing attributes in process `syz.3.312'. [ 84.744226][ T5818] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 84.810314][ T60] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 84.813297][ T60] em28xx 5-1:0.0: board has no eeprom [ 84.877671][ T60] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 84.880637][ T60] em28xx 5-1:0.0: dvb set to bulk mode. [ 84.882415][ T34] em28xx 5-1:0.0: Binding DVB extension [ 84.887650][ T60] usb 5-1: USB disconnect, device number 10 [ 84.890374][ T60] em28xx 5-1:0.0: Disconnecting em28xx [ 84.899551][ T5818] usb 8-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 84.904894][ T5818] usb 8-1: config 2 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 84.912271][ T34] em28xx 5-1:0.0: Registering input extension [ 84.915092][ T5818] usb 8-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 84.919550][ T60] em28xx 5-1:0.0: Closing input extension [ 84.922098][ T5818] usb 8-1: config 2 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 84.935061][ T5818] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 84.941004][ T5818] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.946347][ T60] em28xx 5-1:0.0: Freeing device [ 84.949816][ T5818] usb 8-1: Product: syz [ 84.951633][ T5818] usb 8-1: Manufacturer: syz [ 84.954341][ T5818] usb 8-1: SerialNumber: syz [ 84.969110][ T5818] ti_usb_3410_5052 8-1:2.0: required endpoints missing [ 85.119484][ T6730] netlink: 32 bytes leftover after parsing attributes in process `syz.1.316'. [ 85.123241][ T6730] vlan2: entered allmulticast mode [ 85.125249][ T6730] gretap0: entered allmulticast mode [ 85.325764][ T6740] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.332105][ T6741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.332450][ T6740] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.335344][ T6741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.393022][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 85.397243][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 85.400791][ T6750] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 85.404898][ T6750] UDF-fs: Scanning with blocksize 512 failed [ 85.408107][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 85.411723][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 85.415140][ T6750] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 85.417934][ T6750] UDF-fs: Scanning with blocksize 1024 failed [ 85.420665][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 85.424355][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 85.427855][ T6750] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 85.430692][ T6750] UDF-fs: Scanning with blocksize 2048 failed [ 85.433958][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 85.437451][ T6750] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 85.440675][ T6750] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 85.444262][ T6750] UDF-fs: Scanning with blocksize 4096 failed [ 85.446375][ T6750] UDF-fs: warning (device nbd2): udf_fill_super: No partition found (1) [ 85.453007][ T6750] binder_alloc: 6749: binder_alloc_buf size 24560 failed, no address space [ 85.455854][ T6750] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) [ 85.606268][ T41] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 85.770208][ T41] usb 5-1: Using ep0 maxpacket: 32 [ 85.774100][ T41] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 85.778402][ T41] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 85.782224][ T41] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 85.785763][ T41] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.792215][ T41] usb 5-1: config 0 descriptor?? [ 85.969453][ T6765] netlink: 8 bytes leftover after parsing attributes in process `syz.1.329'. [ 86.252901][ T5493] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 86.405590][ T5493] usb 6-1: Using ep0 maxpacket: 16 [ 86.409300][ T5493] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 86.415311][ T5493] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 86.418842][ T5493] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.422059][ T5493] usb 6-1: Product: syz [ 86.423552][ T5493] usb 6-1: Manufacturer: syz [ 86.425066][ T5493] usb 6-1: SerialNumber: syz [ 86.428226][ T5493] usb 6-1: config 0 descriptor?? [ 86.432440][ T5493] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 86.435341][ T5493] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 86.530232][ T6772] FAULT_INJECTION: forcing a failure. [ 86.530232][ T6772] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 86.534586][ T6772] CPU: 3 UID: 0 PID: 6772 Comm: syz.2.332 Tainted: G L syzkaller #0 PREEMPT(full) [ 86.534605][ T6772] Tainted: [L]=SOFTLOCKUP [ 86.534608][ T6772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.534615][ T6772] Call Trace: [ 86.534620][ T6772] [ 86.534624][ T6772] dump_stack_lvl+0x100/0x190 [ 86.534642][ T6772] should_fail_ex.cold+0x5/0xa [ 86.534660][ T6772] _copy_to_user+0x32/0xd0 [ 86.534677][ T6772] simple_read_from_buffer+0xcb/0x170 [ 86.534690][ T6772] proc_fail_nth_read+0x1af/0x230 [ 86.534707][ T6772] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 86.534725][ T6772] ? rw_verify_area+0xce/0x6d0 [ 86.534739][ T6772] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 86.534755][ T6772] vfs_read+0x1e4/0xb40 [ 86.534773][ T6772] ? __pfx_vfs_read+0x10/0x10 [ 86.534789][ T6772] ? __fget_files+0x215/0x3d0 [ 86.534803][ T6772] ? __fget_files+0x21f/0x3d0 [ 86.534817][ T6772] ksys_read+0x12a/0x250 [ 86.534833][ T6772] ? __pfx_ksys_read+0x10/0x10 [ 86.534853][ T6772] do_syscall_64+0x115/0x870 [ 86.534868][ T6772] ? clear_bhb_loop+0x40/0x90 [ 86.534881][ T6772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.534893][ T6772] RIP: 0033:0x7f9f9355e90e [ 86.534903][ T6772] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 86.534914][ T6772] RSP: 002b:00007f9f943ebfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 86.534926][ T6772] RAX: ffffffffffffffda RBX: 00007f9f943ec6c0 RCX: 00007f9f9355e90e [ 86.534932][ T6772] RDX: 000000000000000f RSI: 00007f9f943ec0a0 RDI: 0000000000000004 [ 86.534938][ T6772] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 86.534944][ T6772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 86.534951][ T6772] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 86.534964][ T6772] [ 86.706946][ T42] kauditd_printk_skb: 35 callbacks suppressed [ 86.706963][ T42] audit: type=1400 audit(1786548716.127:589): avc: denied { ioctl } for pid=6773 comm="syz.2.333" path="socket:[15534]" dev="sockfs" ino=15534 ioctlcmd=0x42c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 87.050380][ T5493] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 87.396958][ T42] audit: type=1400 audit(1786548716.791:590): avc: denied { read } for pid=6782 comm="syz.2.337" name="msr" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 87.404944][ T42] audit: type=1400 audit(1786548716.791:591): avc: denied { open } for pid=6782 comm="syz.2.337" path="/dev/cpu/3/msr" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 87.441555][ T6788] netlink: 8 bytes leftover after parsing attributes in process `syz.2.338'. [ 87.469448][ T5493] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 87.472569][ T5493] em28xx 6-1:0.0: board has no eeprom [ 87.531289][ T5493] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 87.534273][ T5493] em28xx 6-1:0.0: dvb set to bulk mode. [ 87.536503][ T41] em28xx 6-1:0.0: Binding DVB extension [ 87.540067][ T5493] usb 6-1: USB disconnect, device number 7 [ 87.542834][ T5493] em28xx 6-1:0.0: Disconnecting em28xx [ 87.563161][ T41] em28xx 6-1:0.0: Registering input extension [ 87.565328][ T5493] em28xx 6-1:0.0: Closing input extension [ 87.573455][ T5493] em28xx 6-1:0.0: Freeing device [ 87.583454][ T5888] usb 8-1: USB disconnect, device number 7 [ 87.643291][ T42] audit: type=1400 audit(1786548717.036:592): avc: denied { accept } for pid=6795 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 87.649887][ T42] audit: type=1400 audit(1786548717.045:593): avc: denied { write } for pid=6795 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 87.659695][ T42] audit: type=1400 audit(1786548717.055:594): avc: denied { read } for pid=6795 comm="syz.3.341" name="loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 87.667690][ T42] audit: type=1400 audit(1786548717.055:595): avc: denied { open } for pid=6795 comm="syz.3.341" path="/dev/loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 87.678711][ T42] audit: type=1400 audit(1786548717.055:596): avc: denied { ioctl } for pid=6795 comm="syz.3.341" path="/dev/loop-control" dev="devtmpfs" ino=657 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 87.716555][ T42] audit: type=1400 audit(1786548717.114:597): avc: denied { create } for pid=6795 comm="syz.3.341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 87.834845][ T6801] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 87.873811][ T6803] i2c i2c-1: new_device: Can't parse I2C address [ 88.161765][ T6809] netlink: 8 bytes leftover after parsing attributes in process `syz.1.347'. [ 88.379667][ T6818] FAULT_INJECTION: forcing a failure. [ 88.379667][ T6818] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 88.388491][ T6818] CPU: 1 UID: 0 PID: 6818 Comm: syz.1.351 Tainted: G L syzkaller #0 PREEMPT(full) [ 88.388522][ T6818] Tainted: [L]=SOFTLOCKUP [ 88.388528][ T6818] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.388540][ T6818] Call Trace: [ 88.388547][ T6818] [ 88.388554][ T6818] dump_stack_lvl+0x100/0x190 [ 88.388583][ T6818] should_fail_ex.cold+0x5/0xa [ 88.388604][ T6818] ? prepare_alloc_pages+0x16d/0x5f0 [ 88.388632][ T6818] should_fail_alloc_page+0xeb/0x140 [ 88.388659][ T6818] prepare_alloc_pages+0x1f0/0x5f0 [ 88.388690][ T6818] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 88.388717][ T6818] ? __update_page_owner_handle+0x390/0x530 [ 88.388751][ T6818] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 88.388777][ T6818] ? __lock_acquire+0x49f/0x1a40 [ 88.388813][ T6818] ? find_held_lock+0x2b/0x80 [ 88.388830][ T6818] ? is_bpf_text_address+0x8a/0x1a0 [ 88.388855][ T6818] ? is_bpf_text_address+0x8a/0x1a0 [ 88.388880][ T6818] ? bpf_ksym_find+0x128/0x1c0 [ 88.388907][ T6818] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 88.388932][ T6818] ? policy_nodemask+0xed/0x4f0 [ 88.388961][ T6818] alloc_pages_mpol+0x1fb/0x540 [ 88.388987][ T6818] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 88.389020][ T6818] folio_alloc_mpol_noprof+0x36/0x260 [ 88.389051][ T6818] shmem_alloc_folio+0x135/0x160 [ 88.389081][ T6818] shmem_alloc_and_add_folio+0x371/0xd40 [ 88.389107][ T6818] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 88.389129][ T6818] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 88.389160][ T6818] shmem_get_folio_gfp+0x6ad/0x1910 [ 88.389184][ T6818] ? filemap_map_pages+0x112d/0x1fe0 [ 88.389214][ T6818] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 88.389233][ T6818] ? __pfx_filemap_map_pages+0x10/0x10 [ 88.389262][ T6818] ? filemap_map_pages+0x1137/0x1fe0 [ 88.389294][ T6818] shmem_fault+0x1f9/0xa20 [ 88.389313][ T6818] ? __lock_acquire+0x49f/0x1a40 [ 88.389337][ T6818] ? __pfx_shmem_fault+0x10/0x10 [ 88.389360][ T6818] ? __pfx_filemap_map_pages+0x10/0x10 [ 88.389423][ T6818] ? find_held_lock+0x2b/0x80 [ 88.389460][ T6818] __do_fault+0x10b/0x440 [ 88.389486][ T6818] do_fault+0xa99/0x1750 [ 88.389511][ T6818] ? __pmd_alloc+0x3fb/0x950 [ 88.389538][ T6818] __handle_mm_fault+0x187d/0x2a00 [ 88.389572][ T6818] ? mt_find+0x45e/0x8e0 [ 88.389601][ T6818] ? __pfx___handle_mm_fault+0x10/0x10 [ 88.389629][ T6818] ? __pfx_mt_find+0x10/0x10 [ 88.389669][ T6818] ? find_vma+0xbf/0x140 [ 88.389690][ T6818] ? __pfx_find_vma+0x10/0x10 [ 88.389715][ T6818] handle_mm_fault+0x37b/0xa30 [ 88.389750][ T6818] do_user_addr_fault+0x74c/0x12f0 [ 88.389788][ T6818] exc_page_fault+0x6f/0xd0 [ 88.389812][ T6818] asm_exc_page_fault+0x26/0x30 [ 88.389831][ T6818] RIP: 0010:copy_iovec_from_user+0xcf/0x140 [ 88.389858][ T6818] Code: 0f 85 87 00 00 00 4c 89 6b 08 49 83 ec 01 31 ff 48 83 c5 10 4c 89 e6 48 83 c3 10 e8 1b 34 ef fc 4d 85 e4 74 57 e8 71 39 ef fc <4c> 8b 6d 08 e8 68 39 ef fc 4c 8b 7d 00 e8 5f 39 ef fc 31 ff 4c 89 [ 88.389877][ T6818] RSP: 0018:ffffc90004287a88 EFLAGS: 00050293 [ 88.389892][ T6818] RAX: 0000000000000000 RBX: ffff888032505800 RCX: ffffffff851b2afb [ 88.389905][ T6818] RDX: ffff88802b7ea540 RSI: ffffffff851b2b6f RDI: ffff88802b7ea540 [ 88.389916][ T6818] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000 [ 88.389926][ T6818] R10: 0000000000000230 R11: 0000000000000000 R12: 0000000000000023 [ 88.389937][ T6818] R13: 0000000000000230 R14: dffffc0000000000 R15: 0000000000000000 [ 88.389956][ T6818] ? copy_iovec_from_user+0x5b/0x140 [ 88.389980][ T6818] ? copy_iovec_from_user+0xcf/0x140 [ 88.390009][ T6818] ? copy_iovec_from_user+0xcf/0x140 [ 88.390035][ T6818] iovec_from_user+0xc1/0x140 [ 88.390065][ T6818] __import_iovec+0x81/0x640 [ 88.390090][ T6818] ? __might_fault+0x40/0x140 [ 88.390107][ T6818] ? __might_fault+0xc5/0x140 [ 88.390135][ T6818] import_iovec+0x101/0x130 [ 88.390165][ T6818] copy_msghdr_from_user+0x2c6/0x4c0 [ 88.390188][ T6818] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 88.390205][ T6818] ? find_held_lock+0x2b/0x80 [ 88.390227][ T6818] ? __lock_acquire+0x49f/0x1a40 [ 88.390247][ T6818] ? get_pid_task+0x106/0x250 [ 88.390267][ T6818] ___sys_recvmsg+0xdd/0x1a0 [ 88.390286][ T6818] ? __pfx____sys_recvmsg+0x10/0x10 [ 88.390307][ T6818] ? find_held_lock+0x2b/0x80 [ 88.390339][ T6818] __x64_sys_recvmsg+0x19a/0x260 [ 88.390364][ T6818] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 88.390402][ T6818] do_syscall_64+0x115/0x870 [ 88.390424][ T6818] ? clear_bhb_loop+0x40/0x90 [ 88.390446][ T6818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.390464][ T6818] RIP: 0033:0x7f255c79e0d9 [ 88.390479][ T6818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.390495][ T6818] RSP: 002b:00007f255d606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 88.390510][ T6818] RAX: ffffffffffffffda RBX: 00007f255ca25fa0 RCX: 00007f255c79e0d9 [ 88.390520][ T6818] RDX: 0000000040002020 RSI: 0000200000001600 RDI: 0000000000000003 [ 88.390530][ T6818] RBP: 00007f255d606090 R08: 0000000000000000 R09: 0000000000000000 [ 88.390540][ T6818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.390550][ T6818] R13: 00007f255ca26038 R14: 00007f255ca25fa0 R15: 00007ffed58282b8 [ 88.390574][ T6818] [ 88.617926][ T5493] usb 5-1: USB disconnect, device number 11 [ 88.699489][ T6829] team0: entered promiscuous mode [ 88.701179][ T6829] team_slave_0: entered promiscuous mode [ 88.703078][ T6829] team_slave_1: entered promiscuous mode [ 88.703798][ T6831] jffs2: notice: (6831) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 88.719805][ T42] audit: type=1400 audit(1786548718.083:598): avc: denied { read write } for pid=6830 comm="syz.2.358" name="mouse0" dev="devtmpfs" ino=947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 88.845165][ T6837] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 88.848856][ T6837] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 88.864577][ T6837] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 88.875945][ T6837] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 88.878971][ T6837] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 88.885000][ T6837] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 88.892148][ T6837] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 88.894770][ T6837] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 88.900876][ T6837] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 88.996862][ T6856] jffs2: notice: (6856) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 89.003516][ T6856] FAULT_INJECTION: forcing a failure. [ 89.003516][ T6856] name failslab, interval 1, probability 0, space 0, times 0 [ 89.007830][ T6856] CPU: 3 UID: 0 PID: 6856 Comm: syz.1.365 Tainted: G L syzkaller #0 PREEMPT(full) [ 89.007848][ T6856] Tainted: [L]=SOFTLOCKUP [ 89.007852][ T6856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.007859][ T6856] Call Trace: [ 89.007863][ T6856] [ 89.007868][ T6856] dump_stack_lvl+0x100/0x190 [ 89.007885][ T6856] should_fail_ex.cold+0x5/0xa [ 89.007899][ T6856] should_failslab+0xc2/0x120 [ 89.007914][ T6856] kmem_cache_alloc_noprof+0x91/0x6a0 [ 89.007926][ T6856] ? stack_trace_save+0x8e/0xc0 [ 89.007939][ T6856] ? alloc_empty_file+0x5b/0x1c0 [ 89.007956][ T6856] alloc_empty_file+0x5b/0x1c0 [ 89.007970][ T6856] path_openat+0xe7/0x4280 [ 89.007980][ T6856] ? __kasan_slab_alloc+0x89/0x90 [ 89.007993][ T6856] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 89.008005][ T6856] ? do_getname+0x35/0x390 [ 89.008018][ T6856] ? do_sys_openat2+0xc7/0x1e0 [ 89.008030][ T6856] ? __x64_sys_creat+0xcc/0x120 [ 89.008043][ T6856] ? do_syscall_64+0x115/0x870 [ 89.008057][ T6856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.008072][ T6856] ? __pfx_path_openat+0x10/0x10 [ 89.008086][ T6856] do_file_open+0x20e/0x430 [ 89.008098][ T6856] ? __pfx_do_file_open+0x10/0x10 [ 89.008119][ T6856] ? alloc_fd+0x471/0x7a0 [ 89.008131][ T6856] ? do_getname+0x191/0x390 [ 89.008146][ T6856] do_sys_openat2+0x10f/0x1e0 [ 89.008160][ T6856] ? __pfx_do_sys_openat2+0x10/0x10 [ 89.008172][ T6856] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 89.008187][ T6856] ? __fget_files+0x21f/0x3d0 [ 89.008201][ T6856] __x64_sys_creat+0xcc/0x120 [ 89.008214][ T6856] ? __pfx___x64_sys_creat+0x10/0x10 [ 89.008228][ T6856] ? __pfx_ksys_write+0x10/0x10 [ 89.008240][ T6856] ? do_syscall_64+0x90/0x870 [ 89.008257][ T6856] do_syscall_64+0x115/0x870 [ 89.008270][ T6856] ? clear_bhb_loop+0x40/0x90 [ 89.008282][ T6856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.008293][ T6856] RIP: 0033:0x7f255c79e0d9 [ 89.008303][ T6856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.008314][ T6856] RSP: 002b:00007f255d606028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 89.008326][ T6856] RAX: ffffffffffffffda RBX: 00007f255ca25fa0 RCX: 00007f255c79e0d9 [ 89.008333][ T6856] RDX: 0000000000000000 RSI: 0000000000000108 RDI: 0000200000000040 [ 89.008339][ T6856] RBP: 00007f255d606090 R08: 0000000000000000 R09: 0000000000000000 [ 89.008345][ T6856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 89.008351][ T6856] R13: 00007f255ca26038 R14: 00007f255ca25fa0 R15: 00007ffed58282b8 [ 89.008363][ T6856] [ 89.155133][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 89.272680][ T6865] sctp: [Deprecated]: syz.1.368 (pid 6865) Use of struct sctp_assoc_value in delayed_ack socket option. [ 89.272680][ T6865] Use struct sctp_sack_info instead [ 89.308609][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 89.312082][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 89.315465][ T9] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 89.316142][ T6867] FAULT_INJECTION: forcing a failure. [ 89.316142][ T6867] name failslab, interval 1, probability 0, space 0, times 0 [ 89.318699][ T9] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 89.323746][ T6867] CPU: 2 UID: 0 PID: 6867 Comm: syz.1.369 Tainted: G L syzkaller #0 PREEMPT(full) [ 89.323771][ T6867] Tainted: [L]=SOFTLOCKUP [ 89.323777][ T6867] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.323787][ T6867] Call Trace: [ 89.323794][ T6867] [ 89.323801][ T6867] dump_stack_lvl+0x100/0x190 [ 89.323826][ T6867] should_fail_ex.cold+0x5/0xa [ 89.323847][ T6867] should_failslab+0xc2/0x120 [ 89.323868][ T6867] __kmalloc_noprof+0xfc/0x820 [ 89.323885][ T6867] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 89.323906][ T6867] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 89.323933][ T6867] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 89.323960][ T6867] genl_family_rcv_msg_doit+0xc7/0x300 [ 89.323981][ T6867] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 89.324008][ T6867] ? bpf_lsm_capable+0x9/0x10 [ 89.324024][ T6867] ? security_capable+0x80/0x260 [ 89.324049][ T6867] genl_rcv_msg+0x560/0x800 [ 89.324071][ T6867] ? __pfx_genl_rcv_msg+0x10/0x10 [ 89.324091][ T6867] ? __pfx_nfc_genl_start_poll+0x10/0x10 [ 89.324137][ T6867] ? __lock_acquire+0x49f/0x1a40 [ 89.324160][ T6867] netlink_rcv_skb+0x159/0x420 [ 89.324178][ T6867] ? __pfx_genl_rcv_msg+0x10/0x10 [ 89.324198][ T6867] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 89.324224][ T6867] ? netlink_deliver_tap+0x1ae/0xcc0 [ 89.324244][ T6867] genl_rcv+0x28/0x40 [ 89.324262][ T6867] netlink_unicast+0x585/0x850 [ 89.324282][ T6867] ? __pfx_netlink_unicast+0x10/0x10 [ 89.324299][ T6867] ? __pfx_sock_has_perm+0x10/0x10 [ 89.324324][ T6867] netlink_sendmsg+0x8b0/0xda0 [ 89.324346][ T6867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.324365][ T6867] ? selinux_socket_sendmsg+0x198/0x2f0 [ 89.324391][ T6867] ____sys_sendmsg+0xa4d/0xbe0 [ 89.324416][ T6867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.324435][ T6867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 89.324470][ T6867] ___sys_sendmsg+0x190/0x1e0 [ 89.324489][ T6867] ? __pfx____sys_sendmsg+0x10/0x10 [ 89.324502][ T6867] ? __lock_acquire+0x49f/0x1a40 [ 89.324522][ T6867] ? get_pid_task+0x106/0x250 [ 89.324562][ T6867] __sys_sendmsg+0x160/0x210 [ 89.324584][ T6867] ? __pfx___sys_sendmsg+0x10/0x10 [ 89.324617][ T6867] do_syscall_64+0x115/0x870 [ 89.324637][ T6867] ? clear_bhb_loop+0x40/0x90 [ 89.324658][ T6867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.324674][ T6867] RIP: 0033:0x7f255c79e0d9 [ 89.324689][ T6867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.324710][ T6867] RSP: 002b:00007f255d606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 89.324727][ T6867] RAX: ffffffffffffffda RBX: 00007f255ca25fa0 RCX: 00007f255c79e0d9 [ 89.324738][ T6867] RDX: 0000000000000000 RSI: 0000200000000a00 RDI: 0000000000000004 [ 89.324748][ T6867] RBP: 00007f255d606090 R08: 0000000000000000 R09: 0000000000000000 [ 89.324757][ T6867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 89.324767][ T6867] R13: 00007f255ca26038 R14: 00007f255ca25fa0 R15: 00007ffed58282b8 [ 89.324789][ T6867] [ 89.438051][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.442787][ T9] usb 5-1: config 0 descriptor?? [ 89.656632][ T6875] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 89.659498][ T6875] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 89.661965][ T6875] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 89.676340][ T6880] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6880 comm=syz.2.373 [ 90.042312][ T9] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 90.044911][ T6900] evm: overlay not supported [ 90.205305][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 90.209315][ T9] usb 8-1: config index 0 descriptor too short (expected 74, got 45) [ 90.212828][ T9] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 90.217506][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 90.221589][ T9] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 90.226372][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 90.230500][ T9] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 90.235737][ T9] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 90.239679][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.454279][ T9] usb 8-1: usb_control_msg returned -32 [ 90.456719][ T9] usbtmc 8-1:16.0: can't read capabilities [ 90.466197][ T9] usb 8-1: USB disconnect, device number 8 [ 91.036776][ T6907] block device autoloading is deprecated and will be removed. [ 91.042387][ T6907] FAULT_INJECTION: forcing a failure. [ 91.042387][ T6907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 91.048936][ T6907] CPU: 0 UID: 0 PID: 6907 Comm: syz.3.382 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.048964][ T6907] Tainted: [L]=SOFTLOCKUP [ 91.048969][ T6907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.048980][ T6907] Call Trace: [ 91.048987][ T6907] [ 91.048994][ T6907] dump_stack_lvl+0x100/0x190 [ 91.049019][ T6907] should_fail_ex.cold+0x5/0xa [ 91.049038][ T6907] _copy_from_iter+0x1f4/0x1690 [ 91.049067][ T6907] ? __lock_acquire+0x49f/0x1a40 [ 91.049090][ T6907] ? __pfx__copy_from_iter+0x10/0x10 [ 91.049127][ T6907] configfs_write_iter+0xb3/0x4e0 [ 91.049154][ T6907] vfs_write+0x6ac/0x1050 [ 91.049182][ T6907] ? __pfx_configfs_write_iter+0x10/0x10 [ 91.049207][ T6907] ? __pfx_vfs_write+0x10/0x10 [ 91.049253][ T6907] ksys_write+0x12a/0x250 [ 91.049270][ T6907] ? __pfx_ksys_write+0x10/0x10 [ 91.049293][ T6907] do_syscall_64+0x115/0x870 [ 91.049316][ T6907] ? clear_bhb_loop+0x40/0x90 [ 91.049341][ T6907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.049382][ T6907] RIP: 0033:0x7f586679e0d9 [ 91.049400][ T6907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.049416][ T6907] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 91.049435][ T6907] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 91.049448][ T6907] RDX: 0000000000000001 RSI: 00002000000005c0 RDI: 0000000000000004 [ 91.049458][ T6907] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 91.049469][ T6907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 91.049479][ T6907] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 91.049504][ T6907] [ 91.752909][ T5748] Bluetooth: hci3: command 0x0c1a tx timeout [ 91.752991][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 91.758080][ T5743] Bluetooth: hci2: command 0x0c1a tx timeout [ 91.833975][ T9] usb 5-1: USB disconnect, device number 12 [ 91.864666][ T41] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 91.865753][ T42] kauditd_printk_skb: 26 callbacks suppressed [ 91.865769][ T42] audit: type=1400 audit(1786548721.185:625): avc: denied { bind } for pid=6930 comm="syz.0.392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 91.878265][ T42] audit: type=1400 audit(1786548721.185:626): avc: denied { append } for pid=6930 comm="syz.0.392" name="comedi3" dev="devtmpfs" ino=1304 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 92.007190][ T5493] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 92.037506][ T41] usb 7-1: Using ep0 maxpacket: 8 [ 92.041311][ T41] usb 7-1: config index 0 descriptor too short (expected 74, got 45) [ 92.044192][ T41] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 92.048420][ T41] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 92.052330][ T41] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 92.056059][ T41] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 92.059648][ T41] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.064101][ T41] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 92.067315][ T41] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.169929][ T5493] usb 6-1: Using ep0 maxpacket: 16 [ 92.176711][ T5493] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 92.179665][ T6935] FAULT_INJECTION: forcing a failure. [ 92.179665][ T6935] name failslab, interval 1, probability 0, space 0, times 0 [ 92.186008][ T6935] CPU: 0 UID: 0 PID: 6935 Comm: syz.3.393 Tainted: G L syzkaller #0 PREEMPT(full) [ 92.186026][ T6935] Tainted: [L]=SOFTLOCKUP [ 92.186030][ T6935] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.186037][ T6935] Call Trace: [ 92.186042][ T6935] [ 92.186047][ T6935] dump_stack_lvl+0x100/0x190 [ 92.186064][ T6935] should_fail_ex.cold+0x5/0xa [ 92.186078][ T6935] should_failslab+0xc2/0x120 [ 92.186093][ T6935] __kmalloc_noprof+0xfc/0x820 [ 92.186105][ T6935] ? rcu_is_watching+0x12/0xc0 [ 92.186122][ T6935] ? tomoyo_encode2+0xfb/0x3c0 [ 92.186136][ T6935] tomoyo_encode2+0xfb/0x3c0 [ 92.186148][ T6935] tomoyo_encode+0x29/0x50 [ 92.186158][ T6935] tomoyo_realpath_from_path+0x18c/0x690 [ 92.186172][ T6935] tomoyo_path_perm+0x276/0x460 [ 92.186186][ T6935] ? tomoyo_path_perm+0x262/0x460 [ 92.186202][ T6935] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 92.186217][ T6935] ? do_raw_spin_lock+0x128/0x260 [ 92.186233][ T6935] ? d_splice_alias_ops+0x626/0x15c0 [ 92.186255][ T6935] ? d_splice_alias_ops+0x62b/0x15c0 [ 92.186280][ T6935] ? configfs_lookup+0x6e/0x7d0 [ 92.186296][ T6935] ? lookup_one_qstr_excl+0xaf/0x250 [ 92.186312][ T6935] tomoyo_path_symlink+0x97/0xe0 [ 92.186325][ T6935] ? __pfx_tomoyo_path_symlink+0x10/0x10 [ 92.186340][ T6935] security_path_symlink+0x152/0x2d0 [ 92.186357][ T6935] filename_symlinkat+0x122/0x560 [ 92.186373][ T6935] ? __pfx_filename_symlinkat+0x10/0x10 [ 92.186385][ T6935] ? strncpy_from_user+0x19d/0x2d0 [ 92.186402][ T6935] ? do_getname+0x191/0x390 [ 92.186416][ T6935] __x64_sys_symlinkat+0x9c/0xe0 [ 92.186430][ T6935] do_syscall_64+0x115/0x870 [ 92.186444][ T6935] ? clear_bhb_loop+0x40/0x90 [ 92.186457][ T6935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.186468][ T6935] RIP: 0033:0x7f586679e0d9 [ 92.186478][ T6935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.186489][ T6935] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 92.186500][ T6935] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 92.186506][ T6935] RDX: 00002000000002c0 RSI: ffffffffffffff9c RDI: 0000200000000280 [ 92.186513][ T6935] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 92.186519][ T6935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.186525][ T6935] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 92.186538][ T6935] [ 92.186551][ T6935] ERROR: Out of memory at tomoyo_realpath_from_path. [ 92.187977][ T5493] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 92.191971][ T42] audit: type=1400 audit(1786548721.499:627): avc: denied { write } for pid=6934 comm="syz.3.393" name="c.1" dev="configfs" ino=10908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 92.196241][ T5493] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.230734][ T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 92.231374][ T5493] usb 6-1: Product: syz [ 92.304256][ T41] usb 7-1: GET_CAPABILITIES returned 0 [ 92.306451][ T41] usbtmc 7-1:16.0: can't read capabilities [ 92.311859][ T5493] usb 6-1: Manufacturer: syz [ 92.315397][ T5493] usb 6-1: SerialNumber: syz [ 92.320678][ T5493] usb 6-1: config 0 descriptor?? [ 92.332982][ T5493] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 92.336457][ T5493] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 92.363267][ T9] usb 5-1: device descriptor read/64, error -71 [ 92.392776][ T6941] loop0: detected capacity change from 0 to 32768 [ 92.399969][ T6941] FAULT_INJECTION: forcing a failure. [ 92.399969][ T6941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 92.407990][ T6941] CPU: 1 UID: 0 PID: 6941 Comm: syz.3.396 Tainted: G L syzkaller #0 PREEMPT(full) [ 92.408008][ T6941] Tainted: [L]=SOFTLOCKUP [ 92.408012][ T6941] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.408020][ T6941] Call Trace: [ 92.408024][ T6941] [ 92.408028][ T6941] dump_stack_lvl+0x100/0x190 [ 92.408045][ T6941] should_fail_ex.cold+0x5/0xa [ 92.408059][ T6941] _copy_from_user+0x2e/0xd0 [ 92.408075][ T6941] ctl_ioctl+0x89f/0xcd0 [ 92.408091][ T6941] ? __pfx_table_load+0x10/0x10 [ 92.408107][ T6941] ? __pfx_ctl_ioctl+0x10/0x10 [ 92.408134][ T6941] ? selinux_file_ioctl+0x13b/0x290 [ 92.408151][ T6941] ? selinux_file_ioctl+0xb6/0x290 [ 92.408169][ T6941] dm_ctl_ioctl+0x22/0x30 [ 92.408182][ T6941] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 92.408196][ T6941] __x64_sys_ioctl+0x18e/0x210 [ 92.408214][ T6941] do_syscall_64+0x115/0x870 [ 92.408228][ T6941] ? clear_bhb_loop+0x40/0x90 [ 92.408241][ T6941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.408253][ T6941] RIP: 0033:0x7f586679e0d9 [ 92.408268][ T6941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.408279][ T6941] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 92.408290][ T6941] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 92.408297][ T6941] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 92.408303][ T6941] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 92.408310][ T6941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.408316][ T6941] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 92.408329][ T6941] [ 92.475934][ C1] hpet: Lost 3 RTC interrupts [ 92.490328][ T847] usb 7-1: USB disconnect, device number 8 [ 92.538483][ T6946] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(655364.0.0), cmd(9) [ 92.591530][ T42] audit: type=1400 audit(1786548721.893:628): avc: denied { connect } for pid=6948 comm="syz.3.399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 92.599779][ T42] audit: type=1400 audit(1786548721.893:629): avc: denied { name_connect } for pid=6948 comm="syz.3.399" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 92.606893][ T9] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 92.739012][ T9] usb 5-1: device descriptor read/64, error -71 [ 92.851060][ T9] usb usb5-port1: attempt power cycle [ 92.941011][ T5493] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 93.106892][ T42] audit: type=1400 audit(1786548722.405:630): avc: denied { append } for pid=6951 comm="syz.2.400" name="loop5" dev="devtmpfs" ino=663 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 93.108389][ T6952] loop5: detected capacity change from 0 to 7 [ 93.124493][ T6952] Dev loop5: unable to read RDB block 7 [ 93.127443][ T6952] loop5: AHDI p2 [ 93.128875][ T6952] loop5: partition table partially beyond EOD, truncated [ 93.139002][ T6952] netlink: 4 bytes leftover after parsing attributes in process `syz.2.400'. [ 93.185177][ T6956] netlink: 8 bytes leftover after parsing attributes in process `syz.2.401'. [ 93.206219][ T9] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 93.227168][ T9] usb 5-1: device descriptor read/8, error -71 [ 93.358605][ T5493] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 93.361950][ T5493] em28xx 6-1:0.0: board has no eeprom [ 93.362228][ T6958] SELinux: context truncated [ 93.365705][ T6958] SELinux: invalid ocon [ 93.419409][ T5493] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 93.421760][ T5493] em28xx 6-1:0.0: dvb set to bulk mode. [ 93.423457][ T41] em28xx 6-1:0.0: Binding DVB extension [ 93.431851][ T5493] usb 6-1: USB disconnect, device number 8 [ 93.440193][ T5493] em28xx 6-1:0.0: Disconnecting em28xx [ 93.448881][ T41] em28xx 6-1:0.0: Registering input extension [ 93.452182][ T5493] em28xx 6-1:0.0: Closing input extension [ 93.461927][ T5493] em28xx 6-1:0.0: Freeing device [ 93.480358][ T9] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 93.498661][ T42] audit: type=1400 audit(1786548722.779:631): avc: denied { connect } for pid=6964 comm="syz.3.403" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 93.499549][ T6958] SELinux: failed to load policy [ 93.506113][ T9] usb 5-1: device descriptor read/8, error -71 [ 93.606751][ T42] audit: type=1400 audit(1786548722.897:632): avc: denied { mount } for pid=6971 comm="syz.2.405" name="/" dev="9p" ino=87294069 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 93.622036][ T42] audit: type=1400 audit(1786548722.907:633): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 93.624387][ T9] usb usb5-port1: unable to enumerate USB device [ 93.832883][ T6976] FAULT_INJECTION: forcing a failure. [ 93.832883][ T6976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 93.838564][ T6976] CPU: 2 UID: 0 PID: 6976 Comm: syz.2.406 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.838591][ T6976] Tainted: [L]=SOFTLOCKUP [ 93.838597][ T6976] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.838608][ T6976] Call Trace: [ 93.838615][ T6976] [ 93.838622][ T6976] dump_stack_lvl+0x100/0x190 [ 93.838649][ T6976] should_fail_ex.cold+0x5/0xa [ 93.838672][ T6976] _copy_from_user+0x2e/0xd0 [ 93.838699][ T6976] kstrtouint_from_user+0xd6/0x1d0 [ 93.838718][ T6976] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 93.838735][ T6976] ? __lock_acquire+0x49f/0x1a40 [ 93.838766][ T6976] proc_fail_nth_write+0x83/0x220 [ 93.838795][ T6976] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 93.838829][ T6976] vfs_write+0x2aa/0x1050 [ 93.838857][ T6976] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 93.838887][ T6976] ? __pfx_vfs_write+0x10/0x10 [ 93.838913][ T6976] ? __fget_files+0x215/0x3d0 [ 93.838937][ T6976] ? __fget_files+0x21f/0x3d0 [ 93.838962][ T6976] ksys_write+0x12a/0x250 [ 93.838977][ T6976] ? __pfx_ksys_write+0x10/0x10 [ 93.839000][ T6976] do_syscall_64+0x115/0x870 [ 93.839023][ T6976] ? clear_bhb_loop+0x40/0x90 [ 93.839045][ T6976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.839063][ T6976] RIP: 0033:0x7f9f9355e90e [ 93.839077][ T6976] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 93.839094][ T6976] RSP: 002b:00007f9f943ebfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.839127][ T6976] RAX: ffffffffffffffda RBX: 00007f9f943ec6c0 RCX: 00007f9f9355e90e [ 93.839140][ T6976] RDX: 0000000000000001 RSI: 00007f9f943ec0a0 RDI: 0000000000000003 [ 93.839150][ T6976] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 93.839161][ T6976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.839171][ T6976] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 93.839196][ T6976] [ 93.925463][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 93.928509][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 93.929891][ T5743] Bluetooth: hci2: command 0x0c1a tx timeout [ 94.111913][ T6992] ptrace attach of "/syz-executor exec"[5741] was attempted by "/syz-executor exec"[6992] [ 94.637233][ T60] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 94.645516][ T7011] FAULT_INJECTION: forcing a failure. [ 94.645516][ T7011] name failslab, interval 1, probability 0, space 0, times 0 [ 94.650615][ T7011] CPU: 3 UID: 0 PID: 7011 Comm: syz.1.420 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.650633][ T7011] Tainted: [L]=SOFTLOCKUP [ 94.650637][ T7011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.650652][ T7011] Call Trace: [ 94.650671][ T7011] [ 94.650677][ T7011] dump_stack_lvl+0x100/0x190 [ 94.650727][ T7011] should_fail_ex.cold+0x5/0xa [ 94.650764][ T7011] should_failslab+0xc2/0x120 [ 94.650786][ T7011] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 94.650808][ T7011] ? __alloc_skb+0x140/0x710 [ 94.650872][ T7011] __alloc_skb+0x140/0x710 [ 94.650891][ T7011] ? __alloc_skb+0x5b7/0x710 [ 94.650910][ T7011] ? __pfx___alloc_skb+0x10/0x10 [ 94.650928][ T7011] ? genl_rcv_msg+0x4be/0x800 [ 94.650960][ T7011] netlink_ack+0x117/0xb80 [ 94.650977][ T7011] netlink_rcv_skb+0x333/0x420 [ 94.650994][ T7011] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.651014][ T7011] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.651065][ T7011] ? netlink_deliver_tap+0x1ae/0xcc0 [ 94.651086][ T7011] genl_rcv+0x28/0x40 [ 94.651104][ T7011] netlink_unicast+0x585/0x850 [ 94.651125][ T7011] ? __pfx_netlink_unicast+0x10/0x10 [ 94.651149][ T7011] netlink_sendmsg+0x8b0/0xda0 [ 94.651170][ T7011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.651185][ T7011] ? selinux_socket_sendmsg+0x198/0x2f0 [ 94.651219][ T7011] ____sys_sendmsg+0xa4d/0xbe0 [ 94.651243][ T7011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.651263][ T7011] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.651294][ T7011] ___sys_sendmsg+0x190/0x1e0 [ 94.651313][ T7011] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.651328][ T7011] ? __lock_acquire+0x49f/0x1a40 [ 94.651349][ T7011] ? get_pid_task+0x106/0x250 [ 94.651381][ T7011] __sys_sendmsg+0x160/0x210 [ 94.651403][ T7011] ? __pfx___sys_sendmsg+0x10/0x10 [ 94.651438][ T7011] do_syscall_64+0x115/0x870 [ 94.651495][ T7011] ? clear_bhb_loop+0x40/0x90 [ 94.651516][ T7011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.651533][ T7011] RIP: 0033:0x7f255c79e0d9 [ 94.651548][ T7011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.651574][ T7011] RSP: 002b:00007f255d5e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.651592][ T7011] RAX: ffffffffffffffda RBX: 00007f255ca26090 RCX: 00007f255c79e0d9 [ 94.651599][ T7011] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000005 [ 94.651607][ T7011] RBP: 00007f255d5e5090 R08: 0000000000000000 R09: 0000000000000000 [ 94.651617][ T7011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.651626][ T7011] R13: 00007f255ca26128 R14: 00007f255ca26090 R15: 00007ffed58282b8 [ 94.651649][ T7011] [ 94.784102][ T7013] FAULT_INJECTION: forcing a failure. [ 94.784102][ T7013] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 94.789717][ T7013] CPU: 2 UID: 0 PID: 7013 Comm: syz.2.421 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.789745][ T7013] Tainted: [L]=SOFTLOCKUP [ 94.789751][ T7013] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.789762][ T7013] Call Trace: [ 94.789769][ T7013] [ 94.789777][ T7013] dump_stack_lvl+0x100/0x190 [ 94.789805][ T7013] should_fail_ex.cold+0x5/0xa [ 94.789824][ T7013] ? prepare_alloc_pages+0x16d/0x5f0 [ 94.789852][ T7013] should_fail_alloc_page+0xeb/0x140 [ 94.789877][ T7013] prepare_alloc_pages+0x1f0/0x5f0 [ 94.789906][ T7013] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 94.789931][ T7013] ? rcu_is_watching+0x12/0xc0 [ 94.789958][ T7013] ? trace_mm_page_alloc+0x164/0x1c0 [ 94.789984][ T7013] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 94.790007][ T7013] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 94.790029][ T7013] ? is_bpf_text_address+0x8a/0x1a0 [ 94.790053][ T7013] ? bpf_ksym_find+0x128/0x1c0 [ 94.790078][ T7013] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 94.790099][ T7013] ? is_bpf_text_address+0x94/0x1a0 [ 94.790122][ T7013] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 94.790141][ T7013] ? __kernel_text_address+0xd/0x30 [ 94.790179][ T7013] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 94.790203][ T7013] ? __lock_acquire+0x49f/0x1a40 [ 94.790229][ T7013] ? policy_nodemask+0xed/0x4f0 [ 94.790256][ T7013] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 94.790290][ T7013] __kasan_populate_vmalloc+0xf0/0x210 [ 94.790315][ T7013] alloc_vmap_area+0x95d/0x2bb0 [ 94.790346][ T7013] ? kasan_save_track+0x14/0x30 [ 94.790367][ T7013] ? __kasan_kmalloc+0xaa/0xb0 [ 94.790386][ T7013] ? __pfx_alloc_vmap_area+0x10/0x10 [ 94.790410][ T7013] ? __get_vm_area_node+0x101/0x330 [ 94.790437][ T7013] __get_vm_area_node+0x1ca/0x330 [ 94.790465][ T7013] __vmalloc_node_range_noprof+0x228/0x1630 [ 94.790491][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.790510][ T7013] ? rcu_is_watching+0x12/0xc0 [ 94.790544][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.790569][ T7013] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 94.790596][ T7013] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 94.790628][ T7013] ? trace_kmem_cache_alloc+0xdd/0x100 [ 94.790655][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.790674][ T7013] __vmalloc_node_noprof+0xad/0xf0 [ 94.790699][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.790721][ T7013] copy_process+0x7fb/0x8030 [ 94.790760][ T7013] ? __pfx_copy_process+0x10/0x10 [ 94.790785][ T7013] ? __kasan_kmalloc+0xaa/0xb0 [ 94.790806][ T7013] ? lockdep_init_map_type+0x5c/0x250 [ 94.790830][ T7013] ? lockdep_init_map_type+0x5c/0x250 [ 94.790853][ T7013] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 94.790876][ T7013] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 94.790906][ T7013] vhost_task_create+0x1db/0x370 [ 94.790927][ T7013] ? __pfx_vhost_task_create+0x10/0x10 [ 94.790954][ T7013] ? __pfx_vhost_task_fn+0x10/0x10 [ 94.790976][ T7013] ? __pfx___mutex_lock+0x10/0x10 [ 94.790999][ T7013] ? kasan_quarantine_put+0x104/0x240 [ 94.791025][ T7013] kvm_mmu_post_init_vm+0x1b3/0x360 [ 94.791052][ T7013] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 94.791079][ T7013] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 94.791104][ T7013] kvm_vcpu_ioctl+0x730/0x1700 [ 94.791126][ T7013] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.791147][ T7013] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.791169][ T7013] ? do_vfs_ioctl+0x226/0x13e0 [ 94.791196][ T7013] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.791226][ T7013] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 94.791263][ T7013] ? __fget_files+0x215/0x3d0 [ 94.791280][ T7013] ? hook_file_ioctl_common+0x140/0x440 [ 94.791307][ T7013] ? selinux_file_ioctl+0x13b/0x290 [ 94.791334][ T7013] ? selinux_file_ioctl+0xb6/0x290 [ 94.791362][ T7013] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.791382][ T7013] __x64_sys_ioctl+0x18e/0x210 [ 94.791409][ T7013] do_syscall_64+0x115/0x870 [ 94.791431][ T7013] ? clear_bhb_loop+0x40/0x90 [ 94.791453][ T7013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.791471][ T7013] RIP: 0033:0x7f9f9359e0d9 [ 94.791487][ T7013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.791504][ T7013] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.791522][ T7013] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 94.791533][ T7013] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 94.791543][ T7013] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 94.791553][ T7013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.791563][ T7013] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 94.791588][ T7013] [ 94.791665][ T7013] syz.2.421: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 94.840011][ T60] usb 8-1: Using ep0 maxpacket: 8 [ 94.841093][ T7013] ,cpuset= [ 94.844217][ T60] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 94.844811][ T7013] / [ 94.846642][ T60] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 94.848686][ T7013] ,mems_allowed=0-1 [ 94.848717][ T7013] CPU: 2 UID: 0 PID: 7013 Comm: syz.2.421 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.848742][ T7013] Tainted: [L]=SOFTLOCKUP [ 94.848748][ T7013] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.848759][ T7013] Call Trace: [ 94.848767][ T7013] [ 94.848774][ T7013] dump_stack_lvl+0x100/0x190 [ 94.848802][ T7013] warn_alloc.cold+0x94/0xa8 [ 94.848821][ T7013] ? __pfx_warn_alloc+0x10/0x10 [ 94.848839][ T7013] ? lockdep_hardirqs_on+0x78/0x100 [ 94.848864][ T7013] ? __get_vm_area_node+0x2cd/0x330 [ 94.848892][ T7013] ? __get_vm_area_node+0x208/0x330 [ 94.848921][ T7013] __vmalloc_node_range_noprof+0xccd/0x1630 [ 94.848946][ T7013] ? rcu_is_watching+0x12/0xc0 [ 94.848981][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.849008][ T7013] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 94.849035][ T7013] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 94.849067][ T7013] ? trace_kmem_cache_alloc+0xdd/0x100 [ 94.849095][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.849114][ T7013] __vmalloc_node_noprof+0xad/0xf0 [ 94.849139][ T7013] ? vhost_task_create+0x1db/0x370 [ 94.849162][ T7013] copy_process+0x7fb/0x8030 [ 94.849206][ T7013] ? __pfx_copy_process+0x10/0x10 [ 94.849230][ T7013] ? __kasan_kmalloc+0xaa/0xb0 [ 94.849252][ T7013] ? lockdep_init_map_type+0x5c/0x250 [ 94.849276][ T7013] ? lockdep_init_map_type+0x5c/0x250 [ 94.849299][ T7013] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 94.849323][ T7013] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 94.849375][ T7013] vhost_task_create+0x1db/0x370 [ 94.849397][ T7013] ? __pfx_vhost_task_create+0x10/0x10 [ 94.849424][ T7013] ? __pfx_vhost_task_fn+0x10/0x10 [ 94.849447][ T7013] ? __pfx___mutex_lock+0x10/0x10 [ 94.849469][ T7013] ? kasan_quarantine_put+0x104/0x240 [ 94.849495][ T7013] kvm_mmu_post_init_vm+0x1b3/0x360 [ 94.849522][ T7013] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 94.849549][ T7013] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 94.849574][ T7013] kvm_vcpu_ioctl+0x730/0x1700 [ 94.849597][ T7013] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.849617][ T7013] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.849639][ T7013] ? do_vfs_ioctl+0x226/0x13e0 [ 94.849666][ T7013] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.849692][ T7013] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 94.849727][ T7013] ? __fget_files+0x215/0x3d0 [ 94.849743][ T7013] ? hook_file_ioctl_common+0x140/0x440 [ 94.849771][ T7013] ? selinux_file_ioctl+0x13b/0x290 [ 94.849797][ T7013] ? selinux_file_ioctl+0xb6/0x290 [ 94.849826][ T7013] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.849847][ T7013] __x64_sys_ioctl+0x18e/0x210 [ 94.849875][ T7013] do_syscall_64+0x115/0x870 [ 94.849896][ T7013] ? clear_bhb_loop+0x40/0x90 [ 94.849918][ T7013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.849936][ T7013] RIP: 0033:0x7f9f9359e0d9 [ 94.849952][ T7013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.849969][ T7013] RSP: 002b:00007f9f943ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.849986][ T7013] RAX: ffffffffffffffda RBX: 00007f9f93825fa0 RCX: 00007f9f9359e0d9 [ 94.849998][ T7013] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 94.850008][ T7013] RBP: 00007f9f943ec090 R08: 0000000000000000 R09: 0000000000000000 [ 94.850018][ T7013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.850028][ T7013] R13: 00007f9f93826038 R14: 00007f9f93825fa0 R15: 00007ffe3ff4a958 [ 94.850053][ T7013] [ 94.850752][ T7013] Mem-Info: [ 94.851088][ T60] usb 8-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 94.853336][ T7013] active_anon:9038 inactive_anon:0 isolated_anon:0 [ 94.853336][ T7013] active_file:0 inactive_file:65323 isolated_file:0 [ 94.853336][ T7013] unevictable:1768 dirty:147 writeback:0 [ 94.853336][ T7013] slab_reclaimable:11445 slab_unreclaimable:68240 [ 94.853336][ T7013] mapped:25135 shmem:2345 pagetables:1174 [ 94.853336][ T7013] sec_pagetables:294 bounce:0 [ 94.853336][ T7013] kernel_misc_reclaimable:0 [ 94.853336][ T7013] free:443903 free_pcp:17362 free_cma:0 [ 94.855186][ T60] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 94.857029][ T7013] Node 0 active_anon:36152kB inactive_anon:0kB active_file:0kB inactive_file:261092kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:100540kB dirty:584kB writeback:0kB shmem:5844kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13248kB pagetables:4452kB sec_pagetables:1176kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 94.858845][ T60] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 94.861306][ T7013] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 94.862958][ T60] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 94.865138][ T7013] Node 0 [ 94.867433][ T60] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 94.869400][ T7013] DMA free:15360kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 94.871338][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.046533][ T7019] netlink: 8 bytes leftover after parsing attributes in process `syz.0.424'. [ 95.048525][ T7013] lowmem_reserve[]: 0 1225 1225 [ 95.085222][ T60] usb 8-1: GET_CAPABILITIES returned 0 [ 95.088859][ T7013] 1225 [ 95.106397][ T60] usbtmc 8-1:16.0: can't read capabilities [ 95.106675][ T7013] 1225 [ 95.201528][ T7013] Node 0 DMA32 free:124748kB boost:0kB min:27396kB low:34244kB high:41092kB reserved_highatomic:0KB free_highatomic:0KB active_anon:36028kB inactive_anon:0kB active_file:0kB inactive_file:261092kB unevictable:3536kB writepending:584kB zspages:0kB present:2080628kB managed:1255220kB mlocked:0kB bounce:0kB free_pcp:59612kB local_pcp:15280kB free_cma:0kB [ 95.213051][ T7013] lowmem_reserve[]: 0 0 0 0 0 [ 95.214779][ T7013] Node 1 Normal free:1635504kB boost:0kB min:39840kB low:49800kB high:59760kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:3536kB writepending:4kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:10128kB local_pcp:1756kB free_cma:0kB [ 95.226265][ T7013] lowmem_reserve[]: 0 0 0 0 0 [ 95.228042][ T7013] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 95.232498][ T7013] Node 0 DMA32: 299*4kB (UME) 211*8kB (UME) 400*16kB (UME) 347*32kB (UME) 146*64kB (UME) 46*128kB (UME) 14*256kB (UME) 17*512kB (UME) 11*1024kB (UME) 12*2048kB (UME) 10*4096kB (UM) = 124708kB [ 95.239261][ T7013] Node 1 Normal: 4*4kB (UM) 0*8kB 2*16kB (UM) 4*32kB (UM) 2*64kB (M) 3*128kB (M) 0*256kB 3*512kB (M) 1*1024kB (U) 1*2048kB (M) 398*4096kB (M) = 1635504kB [ 95.244891][ T7013] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 95.248769][ T7013] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 95.252163][ T7013] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 95.255688][ T7013] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 95.259392][ T7013] 67663 total pagecache pages [ 95.261137][ T7013] 0 pages in swap cache [ 95.262656][ T7013] Free swap = 124996kB [ 95.264151][ T7013] Total swap = 124996kB [ 95.265665][ T7013] 1048443 pages RAM [ 95.267004][ T7013] 0 pages HighMem/MovableOnly [ 95.268755][ T7013] 285327 pages reserved [ 95.270305][ T7013] 0 pages cma reserved [ 95.288339][ T6999] FAULT_INJECTION: forcing a failure. [ 95.288339][ T6999] name failslab, interval 1, probability 0, space 0, times 0 [ 95.292860][ T6999] CPU: 0 UID: 0 PID: 6999 Comm: syz.3.416 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.292878][ T6999] Tainted: [L]=SOFTLOCKUP [ 95.292881][ T6999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.292889][ T6999] Call Trace: [ 95.292893][ T6999] [ 95.292898][ T6999] dump_stack_lvl+0x100/0x190 [ 95.292916][ T6999] should_fail_ex.cold+0x5/0xa [ 95.292931][ T6999] should_failslab+0xc2/0x120 [ 95.292945][ T6999] __kmalloc_noprof+0xfc/0x820 [ 95.292958][ T6999] ? tomoyo_encode2+0xfb/0x3c0 [ 95.292972][ T6999] tomoyo_encode2+0xfb/0x3c0 [ 95.292984][ T6999] tomoyo_encode+0x29/0x50 [ 95.292994][ T6999] tomoyo_realpath_from_path+0x18c/0x690 [ 95.293008][ T6999] tomoyo_path_number_perm+0x23c/0x580 [ 95.293026][ T6999] ? tomoyo_path_number_perm+0x22e/0x580 [ 95.293042][ T6999] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 95.293070][ T6999] ? find_held_lock+0x2b/0x80 [ 95.293080][ T6999] ? __fget_files+0x215/0x3d0 [ 95.293091][ T6999] ? hook_file_ioctl_common+0x140/0x440 [ 95.293103][ T6999] ? __fget_files+0x215/0x3d0 [ 95.293116][ T6999] ? __fget_files+0x21f/0x3d0 [ 95.293129][ T6999] security_file_ioctl+0xd3/0x230 [ 95.293151][ T6999] __x64_sys_ioctl+0xb7/0x210 [ 95.293175][ T6999] do_syscall_64+0x115/0x870 [ 95.293196][ T6999] ? clear_bhb_loop+0x40/0x90 [ 95.293217][ T6999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.293233][ T6999] RIP: 0033:0x7f586679e0d9 [ 95.293243][ T6999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.293258][ T6999] RSP: 002b:00007f5867733028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.293275][ T6999] RAX: ffffffffffffffda RBX: 00007f5866a25fa0 RCX: 00007f586679e0d9 [ 95.293285][ T6999] RDX: 0000200000002000 RSI: 00000000c0145b0e RDI: 0000000000000004 [ 95.293296][ T6999] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 95.293305][ T6999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 95.293314][ T6999] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 95.293332][ T6999] [ 95.293370][ T6999] ERROR: Out of memory at tomoyo_realpath_from_path. [ 95.374085][ T60] usb 8-1: USB disconnect, device number 9 [ 95.567123][ T7034] netlink: 'syz.2.431': attribute type 12 has an invalid length. [ 95.570611][ T7034] netlink: 132 bytes leftover after parsing attributes in process `syz.2.431'. [ 95.628193][ T7038] FAULT_INJECTION: forcing a failure. [ 95.628193][ T7038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 95.634502][ T7038] CPU: 2 UID: 0 PID: 7038 Comm: syz.1.433 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.634529][ T7038] Tainted: [L]=SOFTLOCKUP [ 95.634536][ T7038] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.634545][ T7038] Call Trace: [ 95.634551][ T7038] [ 95.634557][ T7038] dump_stack_lvl+0x100/0x190 [ 95.634585][ T7038] should_fail_ex.cold+0x5/0xa [ 95.634606][ T7038] _copy_from_user+0x2e/0xd0 [ 95.634629][ T7038] memdup_user+0x6b/0xe0 [ 95.634650][ T7038] strndup_user+0x78/0xe0 [ 95.634670][ T7038] keyctl_pkey_params_get+0xd5/0x4b0 [ 95.634695][ T7038] ? __pfx_keyctl_pkey_params_get+0x10/0x10 [ 95.634717][ T7038] ? find_held_lock+0x2b/0x80 [ 95.634729][ T7038] ? __might_fault+0xc5/0x140 [ 95.634744][ T7038] ? __might_fault+0xc5/0x140 [ 95.634770][ T7038] keyctl_pkey_params_get_2+0x12f/0x3f0 [ 95.634789][ T7038] ? __pfx_keyctl_pkey_params_get_2+0x10/0x10 [ 95.634804][ T7038] ? ksys_write+0x190/0x250 [ 95.634827][ T7038] ? __mutex_unlock_slowpath+0x35d/0x930 [ 95.634854][ T7038] keyctl_pkey_verify+0xac/0x2c0 [ 95.634872][ T7038] ? __pfx_keyctl_pkey_verify+0x10/0x10 [ 95.634896][ T7038] ? ksys_write+0x1ac/0x250 [ 95.634911][ T7038] ? __pfx_ksys_write+0x10/0x10 [ 95.634926][ T7038] __do_sys_keyctl+0x40f/0x5a0 [ 95.634953][ T7038] do_syscall_64+0x115/0x870 [ 95.634974][ T7038] ? clear_bhb_loop+0x40/0x90 [ 95.634995][ T7038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.635014][ T7038] RIP: 0033:0x7f255c79e0d9 [ 95.635030][ T7038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.635054][ T7038] RSP: 002b:00007f255d606028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 95.635071][ T7038] RAX: ffffffffffffffda RBX: 00007f255ca25fa0 RCX: 00007f255c79e0d9 [ 95.635080][ T7038] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 000000000000001c [ 95.635088][ T7038] RBP: 00007f255d606090 R08: 0000000000000000 R09: 0000000000000000 [ 95.635098][ T7038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 95.635110][ T7038] R13: 00007f255ca26038 R14: 00007f255ca25fa0 R15: 00007ffed58282b8 [ 95.635133][ T7038] [ 95.681724][ T847] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 95.808704][ T55] IPVS: starting estimator thread 0... [ 95.810900][ T7046] IPVS: set_ctl: invalid protocol: 41197 200.178.249.164:40278 [ 95.814501][ T7046] IPVS: set_ctl: invalid protocol: 44 36.0.131.197:11453 [ 95.894427][ T847] usb 5-1: Using ep0 maxpacket: 8 [ 95.900108][ T847] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 95.904006][ T847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 95.907703][ T847] usb 5-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 95.912616][ T847] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 95.915161][ T7047] IPVS: using max 45 ests per chain, 108000 per kthread [ 95.916834][ T847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 95.922342][ T847] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 95.929033][ T847] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 95.933100][ T847] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.955871][ T5493] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 95.975309][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 95.975353][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 95.977967][ T5748] Bluetooth: hci2: command 0x0c1a tx timeout [ 96.127359][ T5493] usb 6-1: Using ep0 maxpacket: 32 [ 96.132752][ T5493] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 96.137066][ T5493] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 96.140928][ T5493] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 96.144616][ T5493] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.146063][ T847] usb 5-1: GET_CAPABILITIES returned 0 [ 96.150486][ T847] usbtmc 5-1:16.0: can't read capabilities [ 96.155079][ T5493] usb 6-1: config 0 descriptor?? [ 96.157570][ T5888] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 96.309451][ T5888] usb 8-1: Using ep0 maxpacket: 8 [ 96.312363][ T5888] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.315636][ T5888] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 96.319019][ T5888] usb 8-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 96.322989][ T5888] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 96.326669][ T5888] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 96.329985][ T5888] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.334254][ T5888] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 96.337638][ T5888] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.353264][ T60] usb 5-1: USB disconnect, device number 17 [ 96.552347][ T5888] usb 8-1: GET_CAPABILITIES returned 0 [ 96.555963][ T5888] usbtmc 8-1:16.0: can't read capabilities [ 96.761564][ T5888] usb 8-1: USB disconnect, device number 10 [ 96.765442][ T34] usb 7-1: new low-speed USB device number 9 using dummy_hcd [ 96.945531][ T34] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 96.948478][ T34] usb 7-1: config 0 has no interface number 0 [ 96.951111][ T34] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 96.955595][ T34] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 96.959955][ T34] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 96.964731][ T34] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 96.969460][ T34] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 96.974016][ T34] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 96.979658][ T34] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 96.983321][ T34] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.989549][ T34] usb 7-1: config 0 descriptor?? [ 96.992625][ T7058] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.996342][ T7058] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 97.005588][ T34] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 97.011120][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 97.011133][ T42] audit: type=1400 audit(1786548726.251:641): avc: denied { name_bind } for pid=7067 comm="syz.0.444" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 97.098535][ T7071] netlink: 45 bytes leftover after parsing attributes in process `syz.0.445'. [ 97.206044][ T42] audit: type=1400 audit(1786548726.439:642): avc: denied { write } for pid=7057 comm="syz.2.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 97.220143][ T42] audit: type=1400 audit(1786548726.449:643): avc: denied { read } for pid=7057 comm="syz.2.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 97.221115][ T7058] loop5: detected capacity change from 0 to 7 [ 97.236315][ T7058] loop5: [ 97.237600][ T7058] loop5: partition table partially beyond EOD, truncated [ 97.244736][ T7058] ldusb 7-1:0.55: Write buffer overflow, 2 bytes dropped [ 97.248878][ T5493] usb 7-1: USB disconnect, device number 9 [ 97.258881][ T5493] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 97.341841][ T42] audit: type=1326 audit(1786548726.577:644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7081 comm="syz.3.450" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f586679e0d9 code=0x0 [ 97.434960][ T7092] FAULT_INJECTION: forcing a failure. [ 97.434960][ T7092] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.441167][ T7092] CPU: 1 UID: 0 PID: 7092 Comm: syz.3.451 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.441195][ T7092] Tainted: [L]=SOFTLOCKUP [ 97.441202][ T7092] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.441212][ T7092] Call Trace: [ 97.441219][ T7092] [ 97.441227][ T7092] dump_stack_lvl+0x100/0x190 [ 97.441255][ T7092] should_fail_ex.cold+0x5/0xa [ 97.441275][ T7092] _copy_from_user+0x2e/0xd0 [ 97.441300][ T7092] kstrtouint_from_user+0xd6/0x1d0 [ 97.441321][ T7092] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 97.441365][ T7092] ? __lock_acquire+0x49f/0x1a40 [ 97.441398][ T7092] proc_fail_nth_write+0x83/0x220 [ 97.441422][ T7092] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 97.441455][ T7092] vfs_write+0x2aa/0x1050 [ 97.441482][ T7092] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 97.441509][ T7092] ? __pfx_vfs_write+0x10/0x10 [ 97.441532][ T7092] ? __fget_files+0x215/0x3d0 [ 97.441554][ T7092] ? __fget_files+0x21f/0x3d0 [ 97.441579][ T7092] ksys_write+0x12a/0x250 [ 97.441594][ T7092] ? __pfx_ksys_write+0x10/0x10 [ 97.441617][ T7092] do_syscall_64+0x115/0x870 [ 97.441639][ T7092] ? clear_bhb_loop+0x40/0x90 [ 97.441657][ T7092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.441675][ T7092] RIP: 0033:0x7f586675e90e [ 97.441696][ T7092] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 97.441712][ T7092] RSP: 002b:00007f5867711fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.441730][ T7092] RAX: ffffffffffffffda RBX: 00007f58677126c0 RCX: 00007f586675e90e [ 97.441741][ T7092] RDX: 0000000000000001 RSI: 00007f58677120a0 RDI: 0000000000000007 [ 97.441751][ T7092] RBP: 00007f5867712090 R08: 0000000000000000 R09: 0000000000000000 [ 97.441761][ T7092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.441771][ T7092] R13: 00007f5866a26128 R14: 00007f5866a26090 R15: 00007ffd89ad58e8 [ 97.441792][ T7092] [ 97.520385][ C1] hpet: Lost 4 RTC interrupts [ 97.542383][ T42] audit: type=1400 audit(1786548726.775:645): avc: denied { cmd } for pid=7093 comm="syz.0.453" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 98.005743][ T7120] FAULT_INJECTION: forcing a failure. [ 98.005743][ T7120] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.011053][ T7120] CPU: 3 UID: 0 PID: 7120 Comm: syz.3.460 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.011080][ T7120] Tainted: [L]=SOFTLOCKUP [ 98.011086][ T7120] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.011097][ T7120] Call Trace: [ 98.011107][ T7120] [ 98.011115][ T7120] dump_stack_lvl+0x100/0x190 [ 98.011141][ T7120] should_fail_ex.cold+0x5/0xa [ 98.011163][ T7120] _copy_to_user+0x32/0xd0 [ 98.011190][ T7120] simple_read_from_buffer+0xcb/0x170 [ 98.011210][ T7120] proc_fail_nth_read+0x1af/0x230 [ 98.011237][ T7120] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 98.011264][ T7120] ? rw_verify_area+0xce/0x6d0 [ 98.011288][ T7120] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 98.011314][ T7120] vfs_read+0x1e4/0xb40 [ 98.011342][ T7120] ? __pfx_vfs_read+0x10/0x10 [ 98.011367][ T7120] ? __fget_files+0x215/0x3d0 [ 98.011389][ T7120] ? __fget_files+0x21f/0x3d0 [ 98.011413][ T7120] ksys_read+0x12a/0x250 [ 98.011438][ T7120] ? __pfx_ksys_read+0x10/0x10 [ 98.011470][ T7120] do_syscall_64+0x115/0x870 [ 98.011491][ T7120] ? clear_bhb_loop+0x40/0x90 [ 98.011512][ T7120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.011530][ T7120] RIP: 0033:0x7f586675e90e [ 98.011543][ T7120] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 98.011560][ T7120] RSP: 002b:00007f5867732fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 98.011576][ T7120] RAX: ffffffffffffffda RBX: 00007f58677336c0 RCX: 00007f586675e90e [ 98.011587][ T7120] RDX: 000000000000000f RSI: 00007f58677330a0 RDI: 0000000000000004 [ 98.011597][ T7120] RBP: 00007f5867733090 R08: 0000000000000000 R09: 0000000000000000 [ 98.011606][ T7120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 98.011616][ T7120] R13: 00007f5866a26038 R14: 00007f5866a25fa0 R15: 00007ffd89ad58e8 [ 98.011639][ T7120] [ 98.143257][ T7124] geneve2: entered promiscuous mode [ 98.145542][ T7124] geneve2: entered allmulticast mode [ 98.168632][ T7126] netlink: 20 bytes leftover after parsing attributes in process `syz.2.464'. [ 98.175054][ T12] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 98.175095][ T12] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 98.175117][ T12] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 98.175135][ T12] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 98.190848][ T42] audit: type=1400 audit(1786548727.417:646): avc: denied { write } for pid=7125 comm="syz.2.464" name="/" dev="configfs" ino=3095 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.377473][ T7140] i2c i2c-1: Failed to register i2c client isp1301 at 0x02 (-16) [ 98.425071][ T42] audit: type=1400 audit(1786548727.645:647): avc: denied { write } for pid=7145 comm="syz.0.470" name="functions" dev="configfs" ino=10903 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.429822][ T7146] [ 98.435030][ T7146] ====================================================== [ 98.435485][ T42] audit: type=1400 audit(1786548727.655:648): avc: denied { write } for pid=7145 comm="syz.0.470" name="extensions" dev="configfs" ino=16161 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.437487][ T7146] WARNING: possible circular locking dependency detected [ 98.437500][ T7146] syzkaller #0 Tainted: G L [ 98.451588][ T7146] ------------------------------------------------------ [ 98.454115][ T7146] syz.0.470/7146 is trying to acquire lock: [ 98.456267][ T7146] ffffffff901d0fe8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.460546][ T7146] [ 98.460546][ T7146] but task is already holding lock: [ 98.463232][ T7146] ffff88805a80dd70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 98.466692][ T7146] [ 98.466692][ T7146] which lock already depends on the new lock. [ 98.466692][ T7146] [ 98.470549][ T7146] [ 98.470549][ T7146] the existing dependency chain (in reverse order) is: [ 98.473870][ T7146] [ 98.473870][ T7146] -> #3 (&p->frag_sem){++++}-{4:4}: [ 98.476557][ T7146] lock_acquire+0x1b9/0x370 [ 98.478418][ T7146] down_write_killable+0x93/0x250 [ 98.480459][ T7146] configfs_rmdir+0x3fa/0x950 [ 98.482382][ T7146] vfs_rmdir+0x328/0x8a0 [ 98.484146][ T7146] filename_rmdir+0x31a/0x5c0 [ 98.486070][ T7146] __x64_sys_rmdir+0x46/0x70 [ 98.487950][ T7146] do_syscall_64+0x115/0x870 [ 98.489916][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.492258][ T7146] [ 98.492258][ T7146] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 98.495449][ T7146] lock_acquire+0x1b9/0x370 [ 98.497106][ T7146] down_write+0x8b/0x1f0 [ 98.498848][ T7146] configfs_depend_item_unlocked+0xf3/0x6a0 [ 98.501162][ T7146] usbg_make_tpg+0x261/0x620 [ 98.503022][ T7146] target_fabric_make_tpg+0xab/0x8c0 [ 98.505189][ T7146] configfs_mkdir+0x51e/0xb70 [ 98.507087][ T7146] vfs_mkdir+0x361/0x850 [ 98.508865][ T7146] filename_mkdirat+0x48b/0x5e0 [ 98.510847][ T7146] __x64_sys_mkdirat+0x89/0xc0 [ 98.512759][ T7146] do_syscall_64+0x115/0x870 [ 98.514636][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.516972][ T7146] [ 98.516972][ T7146] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 98.519757][ T7146] lock_acquire+0x1b9/0x370 [ 98.521702][ T7146] __mutex_lock+0x1a4/0x1bd0 [ 98.523584][ T7146] tcm_set_name+0x29/0xb0 [ 98.525384][ T7146] function_make+0x21c/0x3f0 [ 98.527283][ T7146] configfs_mkdir+0x51e/0xb70 [ 98.529245][ T7146] vfs_mkdir+0x361/0x850 [ 98.531048][ T7146] filename_mkdirat+0x48b/0x5e0 [ 98.533002][ T7146] __x64_sys_mkdirat+0x89/0xc0 [ 98.534932][ T7146] do_syscall_64+0x115/0x870 [ 98.536809][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.539157][ T7146] [ 98.539157][ T7146] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 98.542123][ T7146] check_prev_add+0xeb/0xe60 [ 98.543989][ T7146] __lock_acquire+0x136c/0x1a40 [ 98.545953][ T7146] lock_acquire+0x1b9/0x370 [ 98.547781][ T7146] __mutex_lock+0x1a4/0x1bd0 [ 98.549655][ T7146] uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.552265][ T7146] configfs_write_iter+0x302/0x4e0 [ 98.554293][ T7146] vfs_write+0x6ac/0x1050 [ 98.556061][ T7146] ksys_write+0x12a/0x250 [ 98.557851][ T7146] do_syscall_64+0x115/0x870 [ 98.559737][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.562052][ T7146] [ 98.562052][ T7146] other info that might help us debug this: [ 98.562052][ T7146] [ 98.565710][ T7146] Chain exists of: [ 98.565710][ T7146] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#24 --> &p->frag_sem [ 98.565710][ T7146] [ 98.570915][ T7146] Possible unsafe locking scenario: [ 98.570915][ T7146] [ 98.573613][ T7146] CPU0 CPU1 [ 98.575537][ T7146] ---- ---- [ 98.577490][ T7146] rlock(&p->frag_sem); [ 98.579061][ T7146] lock(&sb->s_type->i_mutex_key#24); [ 98.581969][ T7146] lock(&p->frag_sem); [ 98.584404][ T7146] lock(gadget_subsys.su_mutex); [ 98.586252][ T7146] [ 98.586252][ T7146] *** DEADLOCK *** [ 98.586252][ T7146] [ 98.589180][ T7146] 4 locks held by syz.0.470/7146: [ 98.591021][ T7146] #0: ffff88802c3c9270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 98.594282][ T7146] #1: ffff8880237ce450 (sb_writers#13){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 98.597545][ T7146] #2: ffff888048879080 (&buffer->mutex#2){+.+.}-{4:4}, at: configfs_write_iter+0x76/0x4e0 [ 98.601200][ T7146] #3: ffff88805a80dd70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 98.604727][ T7146] [ 98.604727][ T7146] stack backtrace: [ 98.606874][ T7146] CPU: 0 UID: 0 PID: 7146 Comm: syz.0.470 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.606895][ T7146] Tainted: [L]=SOFTLOCKUP [ 98.606899][ T7146] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.606908][ T7146] Call Trace: [ 98.606917][ T7146] [ 98.606923][ T7146] dump_stack_lvl+0x100/0x190 [ 98.606941][ T7146] print_circular_bug.cold+0x178/0x1c7 [ 98.606965][ T7146] check_noncircular+0x146/0x160 [ 98.606982][ T7146] ? do_raw_spin_lock+0x128/0x260 [ 98.607002][ T7146] check_prev_add+0xeb/0xe60 [ 98.607019][ T7146] __lock_acquire+0x136c/0x1a40 [ 98.607038][ T7146] lock_acquire+0x1b9/0x370 [ 98.607054][ T7146] ? uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.607077][ T7146] ? __pfx___might_resched+0x10/0x10 [ 98.607095][ T7146] __mutex_lock+0x1a4/0x1bd0 [ 98.607114][ T7146] ? uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.607133][ T7146] ? uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.607153][ T7146] ? _kstrtoull+0x13c/0x1f0 [ 98.607167][ T7146] ? __pfx___mutex_lock+0x10/0x10 [ 98.607191][ T7146] ? __pfx_kstrtou8+0x10/0x10 [ 98.607207][ T7146] ? uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.607225][ T7146] uvcg_extension_b_num_controls_store+0x12b/0x230 [ 98.607253][ T7146] ? __pfx_uvcg_extension_b_num_controls_store+0x10/0x10 [ 98.607274][ T7146] ? configfs_write_iter+0x388/0x4e0 [ 98.607291][ T7146] configfs_write_iter+0x302/0x4e0 [ 98.607307][ T7146] vfs_write+0x6ac/0x1050 [ 98.607328][ T7146] ? __pfx_configfs_write_iter+0x10/0x10 [ 98.607344][ T7146] ? __pfx_vfs_write+0x10/0x10 [ 98.607369][ T7146] ksys_write+0x12a/0x250 [ 98.607381][ T7146] ? __pfx_ksys_write+0x10/0x10 [ 98.607395][ T7146] do_syscall_64+0x115/0x870 [ 98.607412][ T7146] ? clear_bhb_loop+0x40/0x90 [ 98.607427][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.607442][ T7146] RIP: 0033:0x7fab6139e0d9 [ 98.607454][ T7146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.607468][ T7146] RSP: 002b:00007fab621bd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.607483][ T7146] RAX: ffffffffffffffda RBX: 00007fab61625fa0 RCX: 00007fab6139e0d9 [ 98.607492][ T7146] RDX: 0000000000000002 RSI: 0000200000000280 RDI: 0000000000000005 [ 98.607501][ T7146] RBP: 00007fab61435024 R08: 0000000000000000 R09: 0000000000000000 [ 98.607509][ T7146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.607518][ T7146] R13: 00007fab61626038 R14: 00007fab61625fa0 R15: 00007fff23ac2e08 [ 98.607531][ T7146] [ 98.701301][ T7149] netlink: 64 bytes leftover after parsing attributes in process `syz.0.470'. [ 98.754792][ T34] usb 6-1: USB disconnect, device number 9