last executing test programs: 6.600361404s ago: executing program 2 (id=113): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000200)={0x30, 0x0, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xf26a}]}, 0x30}, 0x1, 0x0, 0x0, 0x24004010}, 0x40000) 6.55034774s ago: executing program 2 (id=115): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x28001, @empty, 0xffffff5d}, 0x1c) listen(r1, 0x50) r2 = socket$inet6(0xa, 0x6, 0x1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000680)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000006c0)={@remote, 0x4c, r3}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000080)=0x3fa, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x4001}) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000003c0)={'syzkaller0\x00', 0x1}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xfffffffe, 0xd782, 0x6, 0x704, 0x4}, 0x9}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r4, &(0x7f0000000640)=ANY=[], 0x4a) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0x5, @empty, 0x4}, 0x1c) listen(r2, 0x50) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r9, 0xffffffffffffffff, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x101e01, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f00000001c0)=0x15) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000200)=0x7e) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000240)=0x9) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000700)=0xd) ioctl$TIOCSTI(r10, 0x5412, &(0x7f00000002c0)=0x40) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000002980)={0x4, 0x0, 0x0, 0x1b0, 0x138, 0x1, 0x0, 0x84800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@snapshot={0x0, 0x3090, 0x0, 0x78, 'snapshot-merge\x00', {@rnull={'/dev/syzrnull', 0x0}, 0x20, @rnull={'/dev/syzrnull', 0x0}, 0x20, 'n', 0x20, '32', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) 6.410410614s ago: executing program 2 (id=118): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d74b5e7abb86130ae1e9e7d83e6423d6ecc70d6f82ce67dafa805316628b165a503d60bb8536", @ANYRES16=r1, @ANYBLOB="050427bd7000ffdbdf732501000000080001", @ANYRES32=r2, @ANYBLOB="4400028040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400040000000800070000000000"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) 6.409711877s ago: executing program 2 (id=121): r0 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000040)={0x9, 0x6, 0x1, 0xfffffffc, 0x2}, 0x10) r1 = io_uring_setup(0x1, &(0x7f0000000240)={0x0, 0xfffffff8, 0x3800, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r1, 0x20, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000340)={&(0x7f0000000380), 0x1000}, &(0x7f00000003c0)={&(0x7f0000000400), 0x1000, 0x1}}, 0x1) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r1, 0x24, &(0x7f0000000440)={0x0, 0x2}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TARGET={0x8, 0x1, 0x8}]}}]}, 0x38}}, 0x4c840) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0xe0002, 0x0) close(r4) syz_usb_connect$lan78xx(0x2, 0xfffffffffffffe0e, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x5b05b05b05b05b5, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$KVM_CREATE_VM(r4, 0x40045506, 0x2b) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000180), 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'bind', '=static', @val={0x3a, [0x33, 0x1]}}}}]}) 5.390396942s ago: executing program 2 (id=138): bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000840)=0xffffffffffffffff, 0x4) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB="9b5900"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="030000000000000000eb0eff000000000000000000000000000000001bd02f380feecb9c3120f91a48faaac63b8bef84bbadd3db2ec94df81e3067fd388a66945d0ae01c46bee6dbb57b87cc2e97057aec320959c193f27dab50898380f787"], 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x8d80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000400)={0x1, 0x0, [{0x400000b5, 0x0, 0x6}]}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./proc/sys/kernel/watchdog_thresh\x00', 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000940)='2', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x1, 0x40002) ioctl$FE_SET_FRONTEND(r5, 0x40246f4c, &(0x7f0000000800)={0x30a32c0, 0x2, @qam={0x2, 0xb, 0x11}}) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x147bc3, 0x1ef) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r6) ptrace$cont(0x20, r6, 0x200, 0x7) ptrace$getregs(0xc, r6, 0x4, &(0x7f0000000ac0)=""/202) lsetxattr$security_capability(&(0x7f0000000480)='./file1\x00', &(0x7f00000004c0), &(0x7f0000000500)=@v3={0x3000000, [{0x7, 0x2}, {0x8, 0x3}], 0xee00}, 0x18, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./file2\x00', 0x387) mount$overlay(0x0, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x0, &(0x7f0000000640)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) truncate(&(0x7f0000000680)='./file0/file1\x00', 0xe2) getsockopt$inet6_buf(r4, 0x29, 0x2f, &(0x7f0000000340)=""/67, &(0x7f00000003c0)=0x43) socket$nl_route(0x10, 0x3, 0x0) 4.520186072s ago: executing program 2 (id=148): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000480)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) bind$inet(r1, &(0x7f0000000580)={0x2, 0x4e20, @empty}, 0x10) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000005c0)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000640)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x2, 0x0, 0x2b}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x31, 0x66, 0x0, 0x3, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e20, 0x4e20, 0x1d, 0x0, @gue={{0x2, 0x0, 0x0, 0xff, 0x100, @val=0x80}, "5eade82003000000000000004c"}}}}, 0x3f) 859.83708ms ago: executing program 1 (id=194): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$CDROMPLAYMSF(r0, 0x2284, &(0x7f0000000400)={0xf, 0x7, 0x6, 0xb0, 0xfa}) 859.575336ms ago: executing program 1 (id=195): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$CDROMPLAYMSF(r0, 0x5303, &(0x7f0000000400)={0xf, 0x7, 0x6, 0xb0, 0xfa}) (fail_nth: 4) 740.491816ms ago: executing program 1 (id=197): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000040)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x5) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f00000001c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='fdinfo/3\x00') read$FUSE(r3, &(0x7f0000000280)={0x2020}, 0x2020) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000180), 0x54943, 0x0) ioctl$CDROMPLAYMSF(r4, 0x5303, &(0x7f0000000000)={0x10, 0x7, 0x7, 0xc, 0xfa}) 740.441467ms ago: executing program 1 (id=198): mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040)='cifs\x00', 0x0, &(0x7f0000000000)='acl') r0 = open(&(0x7f0000000080)='./mnt\x00', 0x8000, 0x129) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) read$FUSE(r0, &(0x7f0000000140)={0x2020}, 0x2020) 680.15524ms ago: executing program 0 (id=199): syz_emit_ethernet(0x86, &(0x7f0000000040)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x300, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0xe0, {0x17, 0x4, 0x0, 0x3, 0x0, 0x70, 0x0, 0x0, 0x89, 0x3, @private, @local, {[@lsrr={0x83, 0x3}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x5, "df6116"}, {0x0, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x0, 0x8, "02a20948fd74"}, {0x7, 0xd, "ccf0294e2a3bdb4aa40b24"}, {0x2, 0x10, "d770917848a392b49307ed10a69a"}]}]}}}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000300)={0x30, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x249}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}]}, 0x30}}, 0x20000000) 679.578885ms ago: executing program 1 (id=200): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1_to_team\x00', 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) bind$packet(r2, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x3, 0x6, @remote}, 0x14) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r3, 0x1, 0x3b, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x0) write(r2, &(0x7f0000000000)="010000000000000020", 0x9) 620.45495ms ago: executing program 0 (id=201): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) 620.120696ms ago: executing program 1 (id=202): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3c}}, 0x200088c4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0x3, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0x2, 0x1}]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000480)={@multicast1, @local}, 0xc) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r5, 0xae9a) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000500)={[0x3, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000005c0)={[{0x2d, 'freezer'}]}, 0x9) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdc01}, 0x14}, 0x1, 0x0, 0x0, 0x24000000}, 0x20008004) syz_create_resource$kvm_nested_state(&(0x7f0000000600)=@vmx={0xc, 0x0, 0x2080, {0x54000, 0xffffffff, {0x1}, 0x1, 0x9}, {"4f6f315a083ccdfc085acde819c43cf101bc8559d1c80efa2180db8308ea8ca9901f128433f0f6f712ba2602fd59613a6d433e2f1263ff9c21219fa3ccb0d1967ff6d090648917b41b72e941ab9632a2c0bc86932bc82f30fdfb6e8e5439bae36e2d73dd3314594c65e0a08a3d5efa07aa5bcef68957862cf402d6f7558997ae6073f8f5376edfeee906f678d0ca5412f44d945c894eb6583fbc1a285c17ece68a26b2a8256fcc4cd66b382614378c2283cf1469d5b0a9a7b33009d4cf73169d482c9022c40decfd30891cd464a0374e9f145f1cc9ce0f20d6f8f529dd720b4340b203df2d182f452bbdd5e6acdaf1240929950d9d99eaeb5d83012956b2c07d14ffe329c4d451555dea79108f86d0445297b8d6d1545fe289bf4e12559f4ba4c5fbf26b37803f5e8df9eb285b1427261a8882fe7aee482f450c0be89dc0f85869afb5f761282fd59037b928801cda9da20b517672d1989878c8d50599b8491f7e5321e3e373abba711f9b6626f26f2d8a360b3a33330af49425ed4342693ac016749320fd2fa6f960eac7033d2a4ebacc2af741afe9d899f737e971f1e8cf98877129bce89c86cc25ca644d06e3a22d06c55ed0cb67ff49526e4a8388da939d6e70f11e61850b2f54f15140b95221653dd14f5a17ccbb28bd534686bd395370214d32e4c9cb7d0fde057fd5e1b4134e0c66db05252d06a49334351dc4fef10de6ff5ddd97b022b1893d43dfeb0ac4289ac2820bf89bd60b7f9dd66ed671f1c241728c73363096b0de9122b3541da25038e69003544fdc33cd5e36fff0f19b6f73d5b02c87088b1a0c88914e96894eea914fb44ceb8a0fe61326fe5e451222290cd4655ab23fcea1f345b0efcad5aa4bdb04adf2acf16ecd3b4da3a350b39bff4d9cba3f2a2a2b1dafbb27ea9ca3a4a80455a3a684fcccc71aff8d93b40fc0ceb19cba5bcbc79ef40ce0789508238a8f550e05548517cd84c79359b886c1c6105a7aa391e524b36429f2f887e283e23df83d667a75e7b100322be8a6c9500181d835c787c9f6baa42fb3cb1650124b48beb5a9bc328023bdccf82ddcecce9b9e74bf0e0175f179dc0fcc5b4a55502075dcfb68338d4158d6e19311125202a80c552ae44618e49906959c723a0f0dc090d7a08f564145506ca8d4baff256060e3033bc6bd1c839407f0a345e3d9e115a59908e24ec572f4e89e0eb1e701570763e9757979203cdf6dd08c378ee4165774c1c5aa37af122258604258058e157a7046ce6fe472eb50fbc62775feb878d9b588cf9b352d725a7029baa3c4aa95fc0d57b94d05ceb3d25cffd3280eb08eac63d903132d2d645f16bce1e6114e514309e277f1e8c831d23fa362f97faaf6ee504765b5d7c4ef18488917363af01d44f8b18c5d64aa1be012eaf92f26d0180bcdabcf777670a190b2db1924bdfe20abd3b9e7729259b94c4888304633bf8efba164d290da68743acc4b594fe424e8ed8fe5cd19c9b99971adc732d3cb647367e5dea485fb13d30d565adb223073637de1de09855922bf552f7228a99cb339ae6d49df40ebeb2227273c26c00ae1cbeffca5f6e57affe7237e26e1ed9cf2c57fa2256c807115f7485e0ba6fb0d00d5d898e74d38e06845c201e983f5ad233166b257d7d2c3334e1e1d5afd2766ef54e74d8a38fb233eb98d66f8ba083a4ef97f8e5d0c06388fde99e583fe316d21d2b8b9373f5dc66dfb06535c6cd0b0e7f89c1f0d8f699dda37fe0e8d46064a3246f63bed02a4e001ef0cc804b102d2de95c5484e5532e26176e3fa12788de43591e7bc6a662a433e0e969c9254ae2ce089af01e1be3cf8a9263d13dce1e9ccf4869e551b076475ff1cd864be43e132680626e6cc4c488fb16a9aa3d9b0d89d1c65f53f1ba62b4ff1ce773d0925f27342bfab3b9687c6b7d9457c2127a004966b4ed8222d58e0b6dd65ff37f49770165a0240cbf70e2973bc57be041138f33f9f9ad2d5cd0ab39956aefeddfb7de10a1ac066b03976a47a26b9b26ad5a4821b0d831469ee1d95ee47c8560fc09fe0014805fa80556d87c19533a22b75aaa20a9255819203d68627756f4b6a72ba8d15837847797ee1770dd98f536695b4725fc66169e3ee7d74dc892a32c4360345bec20cfc7e0a8837d2535c603582a776ac67daa31c029b5b009533d3e2ce3a873d73e2f4c1c07e9358a79e25527e7966fd7e24929278d2a604297c66e176d66193c2e2d7e5bbd1de28641865627cf47dd14facfed8732ab1f3aa917d859d08d6a9b62833a00e921c9cf1828053562ee2f193ee92642309191f71258e05526dd3c42466f03cf5bd32492a18314a91447c94fe4891269911d8e20c2d058537e40358b30680b1795205c66d640558b91dad556e98a144b9becfc6397ce825937f403654bbf15d482f0980106ff0923581a9c2cc37019f773be886a9b9b1c80d624794d012f782d583489b1ebdcd56116dc78deb5b112ec7b6c2df529b903dea8a6195912c13c0bac041a82ba8488dc25d693413aa5987b706ac768ce0c358f08be1c4a6e768002908d3eade2f1956e000a7a8102b9b2c011d450154adf181bf4f294df61b43a022e270813c288af3287c2093dab81dc4e760b1e01871e069137ec75c6714f44d2da50c126a8d8c90fd2aec0c3a9ee49e0739d55aab871e13a7055bc37a43ef73235f01c346af396be63b3ac84ac3bc0c4459333165027cf08d7276e49b252f5e72e2a0894da7d1de350f8220bda8459b57a5a1f794e5a10e7eab91f01419d438cc8076a90cb69d0fc59715ab852dde1eb529e5e6e60fa6e42aa69704c40c03f9ada1aea4dd67bec20000a2e62fa2e7c48c881d9e4a1c9ac8d4f278e24d510b4aa56c30e998050666e16da56e19a59601de50ae887082b7082da25eb13a0d2baff53ec741aa2e0c38029295731903506bd6af2f495a2a998b116e162a2158a5190e782b1e90a714863631aeefaf5ffe311e96befaab6fedc0f66d3be3a0d636284d1f33043c78a76211892b2f360a31f6e888a6a2463d705acb85685fef2f5fa51d9b917df9d0d99c8c0d02d9e80dd56746ca642b40ac90af4147cffdab22a978dd22829849cb65f8e50b44c5909afda28923d64b1acb2c6ee70cb83848f149542d744192791538f73c609c25dfa77ef741e59fe7cf9bbbf07d985b3a127669d3dbe8720ffe185a3828a63b964c56329d0b8584bbd2e3ecf5a7045855ecaf546017924f8a034f7553e68147e67aee95c50975326a65802a99e622a3fa2a0a03df30e7d1bff76015ed8ad6642ae93baca3eadec470fb5bf6199a49276685118626ef1f4a4e062780abf8d8fb018632876cd0d1577eb921e5ff1098c73f1cc220b9f25f3eeaa2f3fcaf1e5fa24e8efa5dee2ff996bfe400d197edf24ed1169f0a5afebc7385d15f94515b722e798b8a5b61c2629ce52bea5298ecb65bf9f42caef849b74ba053ca9fb92c62dba9b5c9e791d88e029b0929357977ad67abda85e72a48963640d9a75c2a99d419f3d62d90518d03cfec199828dffd98241768ce1aa25643a9e5970806a22bb761a6fecf82ad2c0f19d8127b09e7ab9e8bd6bc7cb5a580ac0fd262a3c122052a2416fe324aab05b989e36fa45ef3ff78725c004e2761457f1f3e210390ef31fcce29280829b90816c6b7cf9e453f9422db2937ed355a449882a2d7b91ef61a3c3056096cd613af0cbe956ba0f0549d71ba4852927c2dd901baef83c088c66cb606e1e5b2c4fe09a0e8af6c5afc29517c11dc5bb9a9532cf63b40edf138d42a836668d5670be1092e05cdaf6beaa5bf719d4fd230a46ad9ee812d8d407088ca9aa50a58f35ecc8e08b2f70f408b952767457b7fecf134b10b923f14b08c4603a2dc9eb50b7bd0b3ee397c7d490127af0234082236d2adec1f80c8bdf335b4ed00710c243e36616cba6ee99127b847eafab40cc8a84760d0afa763a37774eef3ef641c71b91e3fc956f72a9e8e11a82fbe626c0847867820474b03f8a79c9b549b9d51037e466947e567eed9dcf30d888c37e09f92db05a17b25cccf29d76de6cfb9277f6a8a40e0c9535585c4afc6fb73921c055dcdeda5fe96c1e5e0f4d7d6e5573537e85886a20b6c206fae596ee910b131ebe892f5e5da5fe01081488600b6a6fa18075d9331f067379ce30bd31e51eaeb795b8efa00547d0bf53016e37eba732481599d753b316c3a4f733f812091dac2cc78ad502ccdf355ea0cf0a9f5c9b5d375ddda212e48cb773fe5487a385173f33dc0667a8c27740bdb119b5d99dd7bbf937e97950f8905acb20f8b216a48f96638d3368019b85bc1b430e1e4a9c5a36ad5af3a1feed34ab08dd9f1eb9c5a9b3ea158e466d5ff96d0d1fab8ab7c48b239999898147bef34659b21879a3378b306201e219cacf1cafef6e07f1fc5e93335af223f0814bb543748d910820c71a675a4340f0aecef9cb5f846e6b5f01f89904e5009d2a62fe1066643d3f34f494258845e499e06c14a8d24009e8a6ab739d93915a19b0bb3922e7f55c1dca9dbdfdee74d62a22cb4923ff1bbda250f4ea8f3584f6e3d07beeae8ace685b4543803c5b6fe867677f620f0fbd73aab372772bf749177b7f0157d5fafe735422506a6108d1f3006176989b86978ba73fd9fb9485b48a16fa992f52476c6b75bce372c4ef038e8718390b693ec229855bc1052525a969fc588cbaf6a023fc6084bef412357c7e4ec2b81125e61191ff48d78f9514a1d2897550e7b141ad32167adb051d5706b458534fcb7f159d1d5749aa585d845567f8d571ada5c26ae2769197af6fcdef68210b7bb1ef8aebcc70472708d172ec273d861e4193a440aef1673538c92d7d5c8291af233daad03de278fed9b45d7cac890836eb0246a180d2617a198d96b151a42163080625756c3a7ac62035e48728e426b7f091703a081d598a16aad50253d143b9e7fcfc8a1be5c9aac6e3bad0f842982e316909e554623bbe9595ea806875c9250f68de1f86e35f8cc01be18eab361f77fa1269c7c4bd8c5e88b33a4e943a2c4269eea558daa3515425bada78dad24a2efcb06062ba3b9e796d21fca08e6cc937c209a76f3e9bbd201c3b70132e81234f7f95244aa935845016c3612b098b5bfca1a5726b630bb452970e4530701550f39a86901e4f240bd930bbeab7cd69946b2db8e8d0893d12fbde5ccac191671e3026cacd19fa7635f0eaf2f70122949d8f7b4ea34fcb56c5e258c252a70e944184e58cefb359d11a043f4bb63f86774814e6da604e937d3104bd747fbab1e2efd6a67c83b68d8cf1952d7a793587d7b310735025eea5671f52232b9fe59f8e4441da4e6129b950ea5dc05f29af7ad8aebcc703b903cdfb0dbf5c3927449a29210257e75e3a2d51711d7aae90c7a8cdf1589be92e176995a266ddbe38313264a60ae0e4bd1da42ff6e190812ab2e04241ac2dfc7dd40d7dbe05a5647b042bfd7e110dcd081ac350fc2781150d73139007cbeaf62cafe1d91f7ff4ac77fb4204147b4ee911edd11fff27177601c3c7884e6c6cc948c993aae510fe566554a415f64f51ddece5310dec171e03c93900542f3f660cec5f09435dc585ff94c98aa7f58540ccfbd5664631db0fafc916ff61d41cf40b1a0d1aa37b6251b3911e385be8e5caa93552c53504e0647b63e7ebcd6ea1c631684036c4b3fa76a06690731de5f4b427a0c4e00cac481b4098ec78313d677f752e9f0c324fb4022dcbc628831f89bf0db539e63f75273cf2fa88e8cb8c39087d6cca64a81791436f35b9abdf8", "c233624c32fc911b2b09c12862e9e07dd7ec8f36ddacdc54b5213058860830537e1c236493c539b9fe4e379e5127d79dbdc8efe22ddcc4362a3b8a93307f1ee44bd615d6e3798233eeb1c256e468e59f431ec81327414e1f1eeeca601a73b2ccd3c030522245232eb06e3c17d4db859093d1b80fe2df8429e16f7ca33a39ec49a5785948da36498e72aae54d6a4972ac3285ee11aa8c8d944e0492c50557e9394195921167cbc2e3c6b5e77ccc716aeb389ce9fd830d33d3f3cf55f09fd856c834b62c67cc59efd7da18935009d614367677c2bb5fef51a7df7a780b9b612e46f38787026368f0fc85d423d60a806542f4c48b7273422abbcbdbc7bd8a232b58c33fa57564d451bbc94cd915ee00942100ac89d442552e4b198502a56c7f8dc69073819ddcb9b1ceefadcfbb4353796ce4bafcd43f8988cc2d48f0caaf76a64d80609d07f30586ad42a5c769a9ba3eb0c6c27070fd505565b702d70db6937730701e61c881404960cb4df3ee7add5379a914970b337c9c6adff22e13f8e4b755124007c7d15af1d40013a87c20f9e94e13a396eb3fd981100d26ca26941e3803ca1096ed041c03eeb18b7d17accb237ec6dbd0416276b0293911f747e1c28e48ba8bacc7bef4ee706684d598e39639258e254a614324b9e82473c312a95ee2e3f4ccdb25d80fea4e394f70954c6ba2dfe6c431bfb98983290d695ae264672bf9982018dcc07a8ae1f949979da7a68642ddc6acf0b50b3e5725d17db7753a420f2e4fad5398c40a38dae008157be377e0b08136a6991ddb8d8b513501b3df4354bf821df327b258b875bbd4a98d3ffe7c1926ab1f80073b7a09dc62c0c8c85c00e3280fa36d8f6b806f782a39f697114e1c00553e745d95ff82fca57af7ab31d195cd782ad16d359ab917917f3bd082751e022234a396911b0f8aa7d8fc3edd3525297a7965c10d6fc1d07caf8f7abe7b229323bd2e523b22dd7beb978b5e97f73ff62ef28786a561977528cb226652221a729b8fa7421dd0dfe2270fd2cfdfde9de86d24988cb22b9209c02d5b1b0a1568e2de85b266a43952cc1475ed36a5e37578d6988a7b6c49dff5e62653ce526395811e9beaf34d7db04f393776fe6fbbf80a2d7849a4e21970b822878e8970b886f00a0c43ea6ce9b252eca477aa296a6737839a0e89196161af274081192138184af49136526d23933c795eccb898c1bbbe9c0ff3d2c305c6e2f251c05de95cac6cfc52f89cdb8506711d97b8845da1c19e9d32f8252c84ac51b7e9cd7017158c92a1b7b3593962e3a9e140f6e11d03d6bc09153a2a43d3c1d7f350933aeea3f8959a78caba27c47299dd334206aa2f9a835ba4fe77b3076fd06a6675ded8400bd602616f23f18554c58820b0dabc6462213a6dea99171ee3885f4808bb1ef38234d3adfe199dc0515d30554c931fd525ffcfe3a2b55555c4cfe3c04010b56bbe46ba390f3ba4a55bd63cc7e8e2170cef4249dd90d864b40285e71dcdaf23fee0436b719c038c068c34cacbe5706c64856116e21c2e39a63823e8391019890f2f99f63c2392b327cabc918ca7ad13b9583126b40cc033676d2ad9200553fa758768ae511b3229e8d7449a678b026c18ac59bf951603d4b5650f87987a2f640e23f845374fd3b3b8d5e2526bc810c4d798aa85c8690c12ae1eb7526f7ff55e362981db8a1d76a54db02398bb19ef3ad2cc07380707353b973c9dd3d3ca5454c72fefc2d00294763503154a6112a7b06e0d8301d3cea4beaa9ce545c3f1324fdb668556de037bb527a88b615b86e6f1431dfcae386f0c895f90ce0cbfcf0a0f426848bdfe35ded732d1b0676e1fd708f461ec3842c0b59c3c1b83a25f2e3b04317f8ad1f020aea844962995baecac8ec1e64e6804fd4f2e1f104d6126e7ef86d54764e7c849c0678b724d98d570b5fdff88053281b890db931cb1e2e45af910a93b77cd11a8593ee3b6a7614f1f740ff380b5e0f8f5fe4b9aa1f9cb28f1fcbbf209b666038082ec870852b4ff43a49acc46a69254c069351567fd22d485ea49dd228c3bbc1ad730a5eb97161f2818b61af4c591cf5ce07c6c30a3745819034ce73ec95a31a3e3ba41095a348c5728f61666cd21baf52e182386bbfe18d229bc3c00af3bb52d0807a1537e253ca50e352597709a9009464f76ff9bdbf495758ae9d9b77578f397d0fcf86d014fc57a39a9c6c4edbb75e8e547033b17dd4df81813cb634ea765b13af002a3a45239eba06752baf7bc8a37cc8cccf5729d750ba011f6bafb671e9b0f807c40a2aeba06c4abd41647897e9e152c5b560ed9e62521bc45433f42bc5c36376a5979cbc7710600eb84545de90d0d40699ec52fff4372ef37eb267cfb8105d8ce6cc4b1995d6140541f988231b92925abf18cc418ccb4c9653ce3b5e6749000d1f889ca8198a4a20e4941477d4e3e9ed0c4b81b72238e3e82a317ac0286c953b0ca0b005a851bf840fe5f70347898205191f3aebcbb36190eab04718ea9e6ee06d926c628960054e78678a5c13fb62559a5eda53103445fa673fab706ae9400999757f4e4cf4756f112be7dad2e2e0d99cc41cba31a4169998895ef4fec1ee95c4d9d2984fe662697cc371c4c245bd6d64767958588c607eca899fa373f5f74172d51f884664ebd0ea4f36a73a8faa04e88ff72b9c9492df491157d6856d0e7dcc3c52db1ef1a83a97e85fff7599951ba0cb9a806cba3868abd75750b9251a46afe58b1dc8e05593da0f024cb29a115253093aca11f33a8a53ce8e14298459b7243c7fc7a16cc3dcf98be9b46c207acb1b3dde4c49242df19db5aeaa1bb31f5453214d79081160ef3629b0cab4e206b4c7cf3fcfc157824aea701dff321ffa1720590365356877dc0a100c5dac3be4eec29adabb1727322e12242937cf2e5a2bd6fc415bee81d392538425698831bc4a30ef071f730b785204b43626068703867cd5899f49a30a836ba438b1e6810a4a45b656f53413b66d6d282642454c6af54fb840ca3bbae5d778739a24187b55f10f321e66d0e502874831de60244a4f30d4fd8c5ecf3730ff2e14d8a654d9dd322f4a11325c902e5e7f726ebb1314a9bf55e5ff293a633f5418279ffadd71e1d9adc9ccebd7ca0fb1338070fbfdba91d56c8de4db366ca07bfecc6677f58c5a1f2801dad219bd211800fda7af87cf971062a7fa456cb922d636e3943f7affc9b940a61141b02714efa1adf968eb026eed7112e8c595d56cd44472932981c46aa92fecaa9030720edb9a357e6396ac38f4675f32f435514826b236abfe1bb90b566758a37384c279fdc3ce545dc61d6cb8eaf0e4af61329f7847fbb78daf988c1c95a7c14542ab43f543a2cd1340556167eca228e06539522ed4e7744a3db791f5542a1b610e81a55d1713f4051d5874ff668e806b6b465413a3300cb1430513dbf4f1b7bdf2e5c0c9787d19c778337fa21c01d25118cf099b21e14720f0d0720e35cf4e47b59ad1f9eda7cb13e0c4c364aebd520350b39aea006a37bb7b97bf8a6563a9817fc93bf99d4692ebd503fa264b7aece9c3c1e7b8f060fd1d491cdb37ebfd28670f9511cebd8e344d548546799edbc3da3205baeeeeb3eaac02fc64c1e6bbdcfab8d06fb092c296ccbdeb8b8ee59fb44bfcf44ef85783f9da8411774432459b7c185342e5ec50d0b7b13b0d6e87b4d1ab94f5a1b0178499093fdcc224881ab0b606f37d89f865eaf99da9afbc75991cf6bdca774e154000695f25342402b76d3007a7676452fe2f336887d368e1a585f9f2d21408d14c8d7c36c992b5ee7d9e0376d3a858c7e9560338468b90b18e80f1610d792c7da12f0058828dc55872f70664cf3c66b348239c6d5bc5c1c6869979f2ab725a7d77cbe38f46b5c296cd2422e8534ad32bdeca5bf5bad89477e1b278b8a0b86a1e65fcf7c5a24629605cbd4979f210573b5f2c0021e2dc212ddb2662ca3ef939e65d7901cf466ee4435bc79ba431c6ee7f6fafd866a4d1c14fdb870357694c5e8cf94a9c4907faa390b071ddf91e0c5ff60f23719a2b21d9fc2c8b08253b3989c970905ba78ae45e14a8f681d2a9e5535e00fd741baeba434760e0569b73c7b20c8b8f7ccdf852cfa910294d78bca6117383a397058829ab8335aba2815fce299afefc4aec63ee4ac195191abc6cdfe7c7259a539993828da6d32d0f36065be0448f66f59bc463214872c3d3aca502bcdf3ac46f65b9fa6a7771536c4fc6fe015e379251540f5119fbd1e7a7fba7f8997e617cd94bf4462c5117288f793c66ee1328800d611996dd862fafb56e896a20d7383d753b3554522b42bdc608839d423882801cd0a3e111f06c22dbfdac38d6d1b16169d692ab1da1a56f185f3f1bd748a71b1b70162f3724e95cf6cc9362e9a52fe51f90432e462e8daa459fe0d70cc0e31c6c9e75630dd714839a9d46f9f707fdcdf4e0ee048329d88328979d98c40738bcf0607060a10f146ba926fb345a8493484d584987486f5d5c1631c7b50d957d5e37a87cdc5be12eb1b405d435ba8a7bb6ad75f9c2760f9340be106e2cf76c502eda205bc80aa8578923f2a39044463f88f4af4b80d8ba557971ae13e317fcdf94139499edfd21d4b16b03b73b40ff7d7afae9377842bf71dbda7a1fa0c9d60bdda392deaa2499ef2aaf6311853ec7693bc853fcba485c071100c2d7b5d7d2063885f7c8faacc52249229544ea409a5c1efd789665b79899e615877006b64eada4f0a08c6541dac5c8477baa1237a6130310c648aaa718e76215a774fd715f9217aac1d66c9e92ebd72437a038126bece33e5f7aa680e8fd775dc98670e044810f8d3b4fd247eee174276a6e8c0823a71123a53241a07c8617b3027359b153cf2f915552fd2808d13b55344e17ab0cc8eef862da56c8787c26e6ff3f5dff2b2ac76e386a47d71f06252357f5b17b0859d43a78eaaf0f7b88ae24a7ca659cdfd5ac46fcf21b39e8d3a2e23e443566aba076a9abbe457122dd7742cac1e0c63febb8675ed77249e7d89c884759f777ff605f6747156c50f7b6fe50a5bf01d9be3e6ed79cc71df2bb1feabda5d59495129665ae4fe223722e288e98e9834638882cbd630cd9b061897031e1cd70097517cb76e0e4f6b8b66903554173d28825603620742a6d2630d6b8acc09f01a5d4a99d1752e0163897d150a1efa7c4e27094fc09b3e2408c96fd0bd9750a026d52a1b5ead62fe65d83fd4e09d3567635d4bf3eb28139d4797699d98ce446755d0ed148decfd483992ba5a316cb361b5ae88e19358d6dc5e82ded0c06c43de93655fcf91fa84c3cfd71bf923ebcb0e0b9c8b3b55a44bad98bae23d731d52fdc24ea3018230490843a7a9744f9e4a9e351dad409e82f26780a269fd4917d16f07c7b41e6993e51214d81dd2896acf6644153d81e3a8fc31f2004a880eaf10445f3480937330e131d9fd858349188d198ed8174b6ba0a483ddf5546df93825014c435a5f317a6aa851c7fd3555abc017e49df70f57f19cf9f1b52a583a2b86309115f8eac0e7470e4a57247f7c96fa854e977dae2130f1beab30dca2a73472482157ccca3f9825a57f81530e32150f500b8abf046a69b6285383859b595757d68bddbe7c25f88d9e47b826dfbef245943e6bca0f8e390a641123c178cc75e7b6e3dc6d5715784f80446d12b6469d04abed97ae70c865af82e84dc6333b9992b4cf8ed6fc4d8ff770c89f8344b8a3448899d78a95fb978679dac334bc29a3e22c19e5ea3c2f24b097d408292c6cb80bc64ffa"}}) sendmmsg(r1, &(0x7f0000000200), 0x4000000000000d2, 0x8048848) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) syz_emit_ethernet(0x52, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x1c, 0x6, 0xff, @local, @local, {[], {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x6, "03240800"}]}}}}}}}}, 0x0) 530.414332ms ago: executing program 0 (id=203): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000200)={0x30, r1, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xf26a}]}, 0x30}, 0x1, 0x0, 0x0, 0x24004010}, 0x40000) 529.882635ms ago: executing program 0 (id=204): getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000000c0)={0x1, 0x83, "cb7b9542ef99a1351f01a5913b416c74a6de4d30adc45971e3c3a6d96addf8d0bde3884147f368eeea9504c33c5f2f22bbd53f6d9d7df246cb910b706da4186b393fbc02c1e18cccb1e0afe3679918666be0b31a58055c337cc78cdfed2e804f0c4616e19540804797f14c875c7aa423fbdc3b6b84adb3e5d747b5e1a6f2a70d9d87bd"}, &(0x7f0000000180)=0x8b) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x10) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000240)={0x0, 0x4, 0xfff, 0xa2fc}) getsockopt$inet_sctp6_SCTP_EXPOSE_POTENTIALLY_FAILED_STATE(0xffffffffffffffff, 0x84, 0x83, &(0x7f00000001c0)={r0, 0x2}, &(0x7f0000000200)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x24}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xe}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0xf, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 468.610809ms ago: executing program 0 (id=205): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000001020103000000000000000000000008f088a585ec13944dff2e0a8430bffef5e5be7e517b56af21ccfb1a9dcd56284cef4a511162a8cdcd3f0bb3474ceac84d38672059277a29428477b6d281280f58b8c7ef9be522814465ed18ba3a3357b42f0ac22d74497f2b4e6fc011a6c29810709f120bf1fea00ddddfdbcd8df01466304ce5aff028c80e3363"], 0x14}, 0x1, 0x0, 0x0, 0x20004090}, 0x90) 468.050375ms ago: executing program 0 (id=207): r0 = memfd_create(&(0x7f0000000800)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x06t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\x04n0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81\xbd\xd5\x00\x00C6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x1c\xd11\xfc\xa7\x93E\xff\xff\xd0\xac\b\x01\x10\xcc\xcd\x9a0\xd83\xb6\r\xbb\xe1u_KUd3l\x862\xa8I\xa7\x8f\xfb\xed\xdbn\xbd\xbe\xf0+a\xc8JC\x03:&9\xae\xb8\xd8TdMf[\x1c\n#\x87\xfc\x81O`\x19P\x142~|\xdf\xbc\xaf\xe4^\xac\xa5\xfbyy\xcb\f\x14}g\xa7\xc2\xe1\xa9\xdf\xbf\xdbV\x94:\xa6I\xa9\x15\x0f', 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000440)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000500)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="7db49fdb07ac1af786f979a7c4c98f4a30507687a32c16c61e034cb67357e38da3fbe77aa31c827b802222469f1809decbb3a12e1757d1ac4ca0cfbbc289bc69b43b1b7d2e896183837a7224005c40412d2937969050f4a048a1af3723b7dc", 0x5f}, {&(0x7f0000000600)="a55b2c8f73dfa037f58774af75d97ac0c02173e2c7efc30f342a5e29dfdc47280776b0deecfb7e4911e4dd33096e8823fb8ba706e431aa", 0x37}], 0x2, &(0x7f0000000640)=[@assoc={0x18, 0x117, 0x4, 0x86}], 0x18, 0xc840}], 0x1, 0x84) recvmsg$can_raw(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)=""/35, 0x23}, {&(0x7f0000000740)=""/172, 0xac}], 0x2}, 0x62) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x7, 0x1, &(0x7f00000001c0)=ANY=[@ANYBLOB="8520ec"], &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="180200000020000000000000800000008500000000000000329c69a4ddd2bb12"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r3, 0x0, 0xe, 0x44, &(0x7f0000000400)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0xda, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000da547ae41320008004b1900cc006800000204907800000000ac1e0101443ce4d1e000000283d84a74ac1414aa4d848000ac1414aa00000c85ffffffff0000000100000000000001000000000000008f8bac14141500000005890439489404010aa045b25f40977def940400009404daef860244c2db2eb984189345879f301a9141d60cd5cecbd947c0cffb51ae09a70ff25539fc0600569c4540f34df250aa977b53e2867d97aea0bb2f3e836081287c4864b3cc8181baea17d1b4a1ad74753851c4bca7e59a5eb3a8cb3ad1e3bd6eb667b00000"], 0x0) 363.693507ms ago: executing program 3 (id=210): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) read$dsp(0xffffffffffffffff, &(0x7f0000000280)=""/50, 0x32) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r1) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r2, 0x1, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x48800}, 0x80) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000140)=0x4) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000000)='hfsplus\x00', 0x4418, &(0x7f0000000100)='barrier') 260.501607ms ago: executing program 3 (id=211): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) 160.716561ms ago: executing program 3 (id=212): r0 = socket(0x10, 0x803, 0x0) recvmsg$unix(r0, &(0x7f00000016c0)={&(0x7f0000000100), 0x6e, &(0x7f0000001640)=[{&(0x7f0000000180)=""/253, 0xfd}, {&(0x7f0000000280)=""/219, 0xdb}, {&(0x7f00000003c0)=""/179, 0xb3}, {&(0x7f0000000480)=""/186, 0xba}, {&(0x7f0000000540)=""/188, 0xbc}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/8, 0x8}], 0x7}, 0x2) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x437, 0x70bd29, 0x25dfdbdc, {0x0, 0x0, 0x0, 0x0, 0x418, 0x1400}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}, @IFLA_GENEVE_DF={0x5, 0xd, 0x2}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40c1}, 0x20000000) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000001700)='pim6reg\x00') ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000002980)={0x4, 0x0, 0x0, 0x1b0, 0x138, 0x1, 0x0, 0x84800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@snapshot={0x0, 0x3090, 0x0, 0x78, 'snapshot-merge\x00', {@rnull={'/dev/syzrnull', 0x0}, 0x20, @rnull={'/dev/syzrnull', 0x0}, 0x20, 'n', 0x20, '32', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) 98.521135ms ago: executing program 3 (id=213): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000200)={0x30, r1, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xf26a}]}, 0x30}, 0x1, 0x0, 0x0, 0x24004010}, 0x40000) 98.048149ms ago: executing program 3 (id=214): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = socket(0x2, 0x2, 0x1) bind$unix(r2, &(0x7f0000000200)=@abs, 0x6e) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/acpi/devices/LNXCPU:01/eject\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='1', 0x1) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x8, &(0x7f0000000140)={[{@metacopy_on}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@uuid_auto}, {@verity_on}]}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x404000, 0xa, 0x11}, 0x18) renameat(r5, &(0x7f0000000480)='./file1\x00', r1, &(0x7f00000004c0)='./bus\x00') ioctl$sock_SIOCETHTOOL(r4, 0x89f0, &(0x7f0000000180)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_ringparam={0xd, 0x0, 0x1c004, 0x20000000, 0x80000001, 0x80090, 0x4, 0x2, 0x80}}) read$FUSE(r1, &(0x7f0000000600)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./proc\x00', &(0x7f0000000580)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000002640)='./proc/fs/cifs/Stats\x00', 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000002680)='fd/3\x00') read$FUSE(r6, &(0x7f00000026c0)={0x2020}, 0x2020) ioctl(r0, 0x890c, &(0x7f00000005c0)="000000000000000000000000000000000f0000006c61706230") ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) 0s ago: executing program 3 (id=215): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904800003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000001b00)=ANY=[@ANYBLOB="03ccac9f226f6ca4e278b0ccb2447c40cf11694d4dc73b7d81df26cab9841c20db9948f18587a1df7f0aeeec94e04807fa8b177821097b1360d2bd9d04c30c4bf54e9f687e5fc42c03149efa4f1f972097a5beb27a296b5811a3177db7bef46661100122e695f43261b251d56a7e6b9b3587a3d86f9850a76e9ff0c5719820b98210fe5c19f6acdc996aa5f28b83add5ed6c788b9e0db143b1b565a3884fe732754fd347ee4fd4fccbd3e9fe3e0b000000de744ef238d2635eabc3495db08cf47a60e0108769768b6cc1e3608e6fd2de5009e1f890375dd4fcff20e1c1403362e3276e251d577557c5eabf5bb6d8cbaa8aa0dfd81301e33b45b5d9dedcb1a8427c4a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100e0ff5070000028000000770000000000000095000200000000007ae9413df8ff0af5aa35339f4b382c4cad9db6fa7a9b857b72abaca100af1ba23d699b89e890c10500000000000000000000000000ac0e064c27bdfbd301150500000000000000bfdc995279d64072aacbb0595b95060000009ad3bf16a461e48e955a772d4062093f4cb1c3d9532abad2085401f098eb039ae4f4103699b9e079227e98cc07c09c1a72cb6d47cef1595e84d21951010f0274b1445a2ad6a7ad73827cccc21842599e0ae7b91f0b878b9267aa0b28d69a74ffdea613e892f0f9ff94e690b6ad68e4cb6dd65fd7bf3124702c6b1c2aea53ee0cb83ff1807459c7cba77cedca0bff6d8370c33e2bd9cebd29c152ff9dc8c2772fe552fecfcd1778b0838100000031d521207e5223d86508416780983c2f380bc01cefe9773a9a5cd5b24aa24a561e72393c0ce2bf44825b05c138779fe74f884c2472ab45c2af60289cb199963312dd1929096c6f49d116f1612a7b97f77169fa5e8a66a372ef8e3ee7167f7d2a26fc6c3cfa4dc5860277223d6eb3460e3b10a0dc9495635a9fca19d7beb5e700498b43bdadc916c01264d22d7969530633f94b257fbc5da7a96820e31444c0b0f62619c9e351996185e4015510875b774666ba5c0ba9845ad25b578d"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000500), 0x0, 0x10, &(0x7f0000000540), 0x15}, 0x48) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0) socket(0x2, 0x805, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$HIDIOCGUSAGE(r1, 0xc0145b0d, &(0x7f0000000180)={0x0, 0xffffffff, 0x5, 0x1, 0x9}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:48796' (ED25519) to the list of known hosts. [ 39.768972][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 39.768993][ T42] audit: type=1400 audit(1793292482.109:138): avc: denied { name_bind } for pid=5768 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 39.799454][ T42] audit: type=1400 audit(1793292482.139:139): avc: denied { execute } for pid=5769 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 39.800062][ T42] audit: type=1400 audit(1793292482.139:140): avc: denied { execute_no_trans } for pid=5769 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 42.133429][ T42] audit: type=1400 audit(1793292484.469:141): avc: denied { mounton } for pid=5769 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 42.143822][ T42] audit: type=1400 audit(1793292484.479:142): avc: denied { mount } for pid=5769 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 42.147239][ T5769] cgroup: Unknown subsys name 'net' [ 42.148466][ T42] audit: type=1400 audit(1793292484.489:143): avc: denied { unmount } for pid=5769 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 42.316681][ T5769] cgroup: Unknown subsys name 'cpuset' [ 42.320518][ T5769] cgroup: Unknown subsys name 'rlimit' [ 42.457579][ T42] audit: type=1400 audit(1793292484.799:144): avc: denied { setattr } for pid=5769 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 42.457940][ T42] audit: type=1400 audit(1793292484.799:145): avc: denied { create } for pid=5769 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.458170][ T42] audit: type=1400 audit(1793292484.799:146): avc: denied { write } for pid=5769 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.458411][ T42] audit: type=1400 audit(1793292484.799:147): avc: denied { read } for pid=5769 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.531259][ T5774] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 43.308257][ T5769] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.610619][ T42] kauditd_printk_skb: 6 callbacks suppressed [ 46.610636][ T42] audit: type=1400 audit(1793292488.949:154): avc: denied { execmem } for pid=5776 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 46.791659][ T42] audit: type=1400 audit(1793292489.139:155): avc: denied { create } for pid=5780 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.793320][ T42] audit: type=1400 audit(1793292489.139:156): avc: denied { read write } for pid=5780 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.794322][ T42] audit: type=1400 audit(1793292489.139:157): avc: denied { open } for pid=5780 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.811427][ T42] audit: type=1400 audit(1793292489.159:158): avc: denied { ioctl } for pid=5780 comm="syz-executor" path="socket:[6128]" dev="sockfs" ino=6128 ioctlcmd=0x400448c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.835872][ T5784] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 46.839804][ T5144] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 46.840394][ T5787] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 46.844076][ T5787] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 46.844635][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 46.845243][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 46.845848][ T5787] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 46.846799][ T5787] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 46.847057][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 46.848688][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 46.849223][ T5789] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 46.850630][ T5789] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 46.851043][ T5789] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 46.864703][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 46.865338][ T42] audit: type=1400 audit(1793292489.209:159): avc: denied { read } for pid=5781 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 46.865861][ T42] audit: type=1400 audit(1793292489.209:160): avc: denied { open } for pid=5781 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 46.867262][ T42] audit: type=1400 audit(1793292489.209:161): avc: denied { mounton } for pid=5781 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 46.870897][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 46.872969][ T42] audit: type=1400 audit(1793292489.209:162): avc: denied { module_request } for pid=5781 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 46.895832][ T42] audit: type=1400 audit(1793292489.239:163): avc: denied { sys_module } for pid=5781 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 46.901011][ T5787] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 46.902411][ T5787] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 46.903206][ T5787] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 46.904420][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 46.905055][ T5787] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.079199][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.079735][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.080392][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.082185][ T5780] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 47.094759][ T5786] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 47.142070][ T5793] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 47.193512][ T5781] infiniband rxe0: set active [ 47.194663][ T5781] infiniband rxe0: added rxe_eth0 [ 47.207104][ T5781] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 47.207137][ T5781] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 47.207176][ T5781] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 47.214261][ T1355] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.233413][ T5781] RDS/IB: rxe0: added [ 47.233628][ T5781] smc: adding ib device rxe0 with port count 1 [ 47.233688][ T5781] smc: ib device rxe0 port 1 has no pnetid [ 47.235715][ T57] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.265034][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.429876][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.482127][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.482413][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.482517][ T5780] bridge_slave_0: entered allmulticast mode [ 47.483919][ T5780] bridge_slave_0: entered promiscuous mode [ 47.503628][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.503791][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.504132][ T5780] bridge_slave_1: entered allmulticast mode [ 47.505550][ T5780] bridge_slave_1: entered promiscuous mode [ 47.543346][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.543418][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.543689][ T5786] bridge_slave_0: entered allmulticast mode [ 47.545228][ T5786] bridge_slave_0: entered promiscuous mode [ 47.564559][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.564632][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.564730][ T5786] bridge_slave_1: entered allmulticast mode [ 47.566034][ T5786] bridge_slave_1: entered promiscuous mode [ 47.577098][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.588113][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.608048][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.618143][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.618298][ T5793] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.618342][ T5793] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.618402][ T5793] bridge_slave_0: entered allmulticast mode [ 47.619537][ T5793] bridge_slave_0: entered promiscuous mode [ 47.639681][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.641474][ T5780] team0: Port device team_slave_0 added [ 47.641613][ T5793] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.641688][ T5793] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.641965][ T5793] bridge_slave_1: entered allmulticast mode [ 47.643265][ T5793] bridge_slave_1: entered promiscuous mode [ 47.655869][ T5780] team0: Port device team_slave_1 added [ 47.690482][ T5786] team0: Port device team_slave_0 added [ 47.708838][ T5786] team0: Port device team_slave_1 added [ 47.719275][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.719290][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.719312][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.726657][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.726667][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.726680][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.729212][ T5793] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.730657][ T5793] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.737382][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.737395][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.737417][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.743583][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.743592][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.743606][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.753207][ T5793] team0: Port device team_slave_0 added [ 47.758506][ T5781] rxe_eth0 speed is unknown, defaulting to 1000 [ 47.761151][ T5793] team0: Port device team_slave_1 added [ 47.804367][ T5793] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.804383][ T5793] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.804403][ T5793] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.807703][ T5786] hsr_slave_0: entered promiscuous mode [ 47.808291][ T5786] hsr_slave_1: entered promiscuous mode [ 47.814518][ T5780] hsr_slave_0: entered promiscuous mode [ 47.815314][ T5780] hsr_slave_1: entered promiscuous mode [ 47.815920][ T5780] debugfs: 'hsr0' already exists in 'hsr' [ 47.815990][ T5780] Cannot create hsr debugfs directory [ 47.823007][ T5793] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.823020][ T5793] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.823043][ T5793] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.943947][ T5793] hsr_slave_0: entered promiscuous mode [ 47.944723][ T5793] hsr_slave_1: entered promiscuous mode [ 47.945241][ T5793] debugfs: 'hsr0' already exists in 'hsr' [ 47.945259][ T5793] Cannot create hsr debugfs directory [ 48.174424][ T5786] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.177782][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.178456][ T5786] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.181799][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.196435][ T5786] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.198764][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.208999][ T5786] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.211004][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.242293][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.242364][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.242449][ T5781] bridge_slave_0: entered allmulticast mode [ 48.243147][ T5781] bridge_slave_0: entered promiscuous mode [ 48.252941][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.253058][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.253143][ T5781] bridge_slave_1: entered allmulticast mode [ 48.254417][ T5781] bridge_slave_1: entered promiscuous mode [ 48.255463][ T5780] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.259913][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.260363][ T5780] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.263502][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.272414][ T5780] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.275467][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.276052][ T5780] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.279879][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.294966][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.304873][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.307583][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.307682][ T5786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.308496][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.308584][ T5786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.349422][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.350114][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.361576][ T5781] team0: Port device team_slave_0 added [ 48.364226][ T5781] team0: Port device team_slave_1 added [ 48.379685][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.379696][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.379710][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.380527][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.380535][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.380549][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.431901][ T5781] hsr_slave_0: entered promiscuous mode [ 48.432356][ T5781] hsr_slave_1: entered promiscuous mode [ 48.432687][ T5781] debugfs: 'hsr0' already exists in 'hsr' [ 48.432699][ T5781] Cannot create hsr debugfs directory [ 48.451110][ T5793] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.453593][ T5793] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.460957][ T5793] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.462709][ T5793] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.475355][ T5793] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.477387][ T5793] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.477816][ T5793] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.479590][ T5793] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.556834][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.569392][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.605102][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.605187][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.615835][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.615889][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.630722][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.631857][ T5781] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.634853][ T5781] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.635228][ T5781] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.638352][ T5781] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.642725][ T5781] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.646360][ T5781] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.647969][ T5781] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.652979][ T5781] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.674855][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.688531][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.688578][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.701541][ T5793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.710912][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.711001][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.736367][ T5793] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.759005][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.759096][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.772356][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.772469][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.823683][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.842824][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.848710][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.848760][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.852379][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.852423][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.885172][ T67] Bluetooth: hci1: command tx timeout [ 48.964201][ T5787] Bluetooth: hci0: command tx timeout [ 48.964386][ T5144] Bluetooth: hci2: command tx timeout [ 48.964520][ T67] Bluetooth: hci3: command tx timeout [ 48.998201][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.032119][ T5786] veth0_vlan: entered promiscuous mode [ 49.038069][ T5786] veth1_vlan: entered promiscuous mode [ 49.040253][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.071679][ T5786] veth0_macvtap: entered promiscuous mode [ 49.081379][ T5786] veth1_macvtap: entered promiscuous mode [ 49.083219][ T5780] veth0_vlan: entered promiscuous mode [ 49.088504][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.094080][ T5780] veth1_vlan: entered promiscuous mode [ 49.106747][ T5793] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.112008][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.124596][ T5781] veth0_vlan: entered promiscuous mode [ 49.132536][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.133308][ T5781] veth1_vlan: entered promiscuous mode [ 49.164051][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.164218][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.164282][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.164991][ T5780] veth0_macvtap: entered promiscuous mode [ 49.178654][ T5780] veth1_macvtap: entered promiscuous mode [ 49.185173][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.212344][ T5781] veth0_macvtap: entered promiscuous mode [ 49.215744][ T5793] veth0_vlan: entered promiscuous mode [ 49.221508][ T5781] veth1_macvtap: entered promiscuous mode [ 49.235015][ T77] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.235029][ T77] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.240153][ T5793] veth1_vlan: entered promiscuous mode [ 49.241574][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.244404][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.257292][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.273573][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.276334][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.276345][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.317212][ T5793] veth0_macvtap: entered promiscuous mode [ 49.329742][ T5793] veth1_macvtap: entered promiscuous mode [ 49.334882][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.334894][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.355529][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.355541][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.362688][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.364785][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.376479][ T5786] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.387061][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.387073][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.397392][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.397405][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.434198][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.434213][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.458839][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.458853][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.474866][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475027][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475180][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475200][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475217][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475236][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475253][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475271][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475289][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475306][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475324][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.475342][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.630762][ T5955] cgroup: none used incorrectly [ 49.632496][ T5955] FAULT_INJECTION: forcing a failure. [ 49.632496][ T5955] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 49.632515][ T5955] CPU: 2 UID: 0 PID: 5955 Comm: syz.0.6 Tainted: G L syzkaller #0 PREEMPT(full) [ 49.632530][ T5955] Tainted: [L]=SOFTLOCKUP [ 49.632535][ T5955] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 49.632541][ T5955] Call Trace: [ 49.632545][ T5955] [ 49.632550][ T5955] dump_stack_lvl+0x100/0x190 [ 49.632575][ T5955] should_fail_ex.cold+0x5/0xa [ 49.632593][ T5955] _copy_to_user+0x32/0xd0 [ 49.632607][ T5955] bpf_verifier_vlog+0x333/0x6d0 [ 49.632624][ T5955] __btf_verifier_log+0xc3/0x100 [ 49.632640][ T5955] ? __pfx___btf_verifier_log+0x10/0x10 [ 49.632659][ T5955] ? __lock_acquire+0x5c0/0x1f40 [ 49.632690][ T5955] btf_parse_hdr+0x4f1/0xec0 [ 49.632716][ T5955] ? lock_acquire+0x1d1/0x380 [ 49.632739][ T5955] ? __might_fault+0xc5/0x140 [ 49.632752][ T5955] ? find_held_lock+0x2b/0x80 [ 49.632764][ T5955] ? __might_fault+0xc5/0x140 [ 49.632791][ T5955] ? __pfx_btf_parse_hdr+0x10/0x10 [ 49.632811][ T5955] btf_new_fd+0x60d/0x39d0 [ 49.632829][ T5955] ? cred_has_capability.isra.0+0x2bd/0x300 [ 49.632844][ T5955] ? cred_has_capability.isra.0+0x186/0x300 [ 49.632858][ T5955] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 49.632876][ T5955] ? __pfx_btf_new_fd+0x10/0x10 [ 49.632892][ T5955] ? rcu_is_watching+0x13/0xc0 [ 49.632905][ T5955] ? cap_capable+0x107/0x430 [ 49.632920][ T5955] ? bpf_lsm_capable+0x9/0x10 [ 49.632931][ T5955] ? security_capable+0x80/0x260 [ 49.632946][ T5955] ? ns_capable+0xcd/0xf0 [ 49.632960][ T5955] __sys_bpf+0x2400/0x4b60 [ 49.632985][ T5955] ? __pfx___sys_bpf+0x10/0x10 [ 49.633002][ T5955] ? find_held_lock+0x2b/0x80 [ 49.633014][ T5955] ? futex_wake+0x4ea/0x5e0 [ 49.633039][ T5955] ? rcu_read_lock_any_held+0x6a/0x90 [ 49.633053][ T5955] ? find_held_lock+0x2b/0x80 [ 49.633064][ T5955] ? ksys_write+0x190/0x250 [ 49.633075][ T5955] ? ksys_write+0x190/0x250 [ 49.633093][ T5955] ? __x64_sys_futex+0x34f/0x4d0 [ 49.633105][ T5955] ? __x64_sys_futex+0x358/0x4d0 [ 49.633119][ T5955] ? fput+0x7c/0x100 [ 49.633132][ T5955] ? __pfx___x64_sys_futex+0x10/0x10 [ 49.633144][ T5955] ? ksys_write+0x1ac/0x250 [ 49.633156][ T5955] ? __x64_sys_bpf+0xce/0x140 [ 49.633166][ T5955] __x64_sys_bpf+0xce/0x140 [ 49.633176][ T5955] ? do_syscall_64+0xae/0x790 [ 49.633189][ T5955] do_syscall_64+0x123/0x790 [ 49.633200][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 49.633212][ T5955] RIP: 0033:0x7fa0fbb9f559 [ 49.633222][ T5955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.633233][ T5955] RSP: 002b:00007fa0fcb03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 49.633245][ T5955] RAX: ffffffffffffffda RBX: 00007fa0fbe25fa0 RCX: 00007fa0fbb9f559 [ 49.633252][ T5955] RDX: 0000000000000028 RSI: 0000200000000500 RDI: 0000000000000012 [ 49.633259][ T5955] RBP: 00007fa0fbc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 49.633265][ T5955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.633272][ T5955] R13: 00007fa0fbe26038 R14: 00007fa0fbe25fa0 R15: 00007ffe99d8b298 [ 49.633286][ T5955] [ 49.637602][ T5960] cgroup: none used incorrectly [ 49.700302][ T5967] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 49.704270][ T5968] syzkaller1: entered promiscuous mode [ 49.704283][ T5968] syzkaller1: entered allmulticast mode [ 49.708394][ T5950] tipc: Started in network mode [ 49.708409][ T5950] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 49.709192][ T5950] tipc: Enabled bearer , priority 0 [ 49.815233][ T5967] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'. [ 49.815255][ T5967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8'. [ 49.815312][ T5967] netlink: 'syz.0.8': attribute type 11 has an invalid length. [ 49.815326][ T5967] netlink: 'syz.0.8': attribute type 7 has an invalid length. [ 49.822251][ T5967] Zero length message leads to an empty skb [ 50.077510][ T5997] netlink: 'syz.0.15': attribute type 1 has an invalid length. [ 50.077827][ T5997] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=52496 sclass=netlink_route_socket pid=5997 comm=syz.0.15 [ 50.334196][ T57] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 50.499121][ T57] usb 5-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 50.500772][ T57] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 50.500794][ T57] usb 5-1: config 0 has no interface number 0 [ 50.500823][ T57] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 50.500841][ T57] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 50.500862][ T57] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 50.500882][ T57] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 50.500903][ T57] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 50.500924][ T57] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 50.500957][ T57] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.505898][ T57] usb 5-1: config 0 descriptor?? [ 50.508836][ T5998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 50.508920][ T5998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 50.521701][ T57] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 50.787341][ T29] usb 5-1: USB disconnect, device number 2 [ 50.799824][ T29] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 50.832223][ T1488] tipc: Node number set to 11578026 [ 50.886493][ T6025] netlink: 16 bytes leftover after parsing attributes in process `syz.2.22'. [ 50.947248][ T6031] syz.2.22 uses obsolete (PF_INET,SOCK_PACKET) [ 50.947672][ T67] Bluetooth: hci0: Unknown advertising packet type: 0x74 [ 50.948030][ T6031] syzkaller1: entered promiscuous mode [ 50.948042][ T6031] syzkaller1: entered allmulticast mode [ 50.964162][ T67] Bluetooth: hci1: command tx timeout [ 51.044504][ T67] Bluetooth: hci2: command tx timeout [ 51.054309][ T5144] Bluetooth: hci0: command tx timeout [ 51.054874][ T67] Bluetooth: hci3: command tx timeout [ 51.133908][ T63] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 51.293859][ T63] usb 6-1: Using ep0 maxpacket: 8 [ 51.294791][ T63] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 51.296089][ T63] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 51.296107][ T63] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 51.296125][ T63] usb 6-1: config 16 has no interface number 0 [ 51.296154][ T63] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 51.296172][ T63] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 51.296193][ T63] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 51.296213][ T63] usb 6-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 51.296245][ T63] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.505504][ T63] usb 6-1: GET_CAPABILITIES returned 0 [ 51.505535][ T63] usbtmc 6-1:16.128: can't read capabilities [ 51.614795][ T42] kauditd_printk_skb: 97 callbacks suppressed [ 51.614807][ T42] audit: type=1400 audit(1793292493.959:261): avc: denied { write } for pid=6044 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 51.689242][ T42] audit: type=1400 audit(1793292494.029:262): avc: denied { setopt } for pid=6048 comm="syz.0.29" lport=17 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 51.689863][ T42] audit: type=1400 audit(1793292494.029:263): avc: denied { write } for pid=6048 comm="syz.0.29" lport=17 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 51.692160][ T42] audit: type=1400 audit(1793292494.029:264): avc: denied { create } for pid=6048 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 51.696300][ T42] audit: type=1400 audit(1793292494.039:265): avc: denied { cmd } for pid=6048 comm="syz.0.29" path="/dev/ublk-control" dev="devtmpfs" ino=706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 51.703422][ T42] audit: type=1400 audit(1793292494.039:266): avc: denied { create } for pid=6048 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 51.705172][ T42] audit: type=1400 audit(1793292494.049:267): avc: denied { listen } for pid=6048 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 51.707224][ T42] audit: type=1400 audit(1793292494.049:268): avc: denied { map } for pid=6048 comm="syz.0.29" path="/dev/ublkc0" dev="devtmpfs" ino=2871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 51.710356][ T42] audit: type=1400 audit(1793292494.049:269): avc: denied { write } for pid=6034 comm="syz.1.24" name="usbtmc0" dev="devtmpfs" ino=2869 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 51.723345][ T6036] syz_tun: entered allmulticast mode [ 51.732150][ T6034] syz_tun: left allmulticast mode [ 51.741817][ T63] usb 6-1: USB disconnect, device number 2 [ 51.772013][ T6060] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 51.774718][ T42] audit: type=1400 audit(1793292494.119:270): avc: denied { sys_module } for pid=6048 comm="syz.0.29" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 51.803499][ T6063] syzkaller1: entered promiscuous mode [ 51.803513][ T6063] syzkaller1: entered allmulticast mode [ 51.951376][ T6067] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 51.953645][ T6067] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 52.022076][ T6071] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 52.379687][ T6088] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 52.379705][ T6088] CIFS mount error: No usable UNC path provided in device string! [ 52.379705][ T6088] [ 52.379802][ T6088] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 52.494959][ T6098] cifs: Unknown parameter 'acx' [ 52.510558][ T6096] ip_tables: iptables: counters copy to user failed while replacing table [ 52.855012][ T5883] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 52.946701][ T1355] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 52.992564][ T1355] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 53.004789][ T5883] usb 6-1: Using ep0 maxpacket: 8 [ 53.007297][ T5883] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 53.008196][ T5883] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 53.008210][ T5883] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 53.008222][ T5883] usb 6-1: config 16 has no interface number 0 [ 53.008241][ T5883] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 53.008254][ T5883] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 53.008267][ T5883] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 53.008280][ T5883] usb 6-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 53.008301][ T5883] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.044110][ T67] Bluetooth: hci1: command tx timeout [ 53.124528][ T67] Bluetooth: hci3: command tx timeout [ 53.124561][ T67] Bluetooth: hci0: command tx timeout [ 53.124583][ T67] Bluetooth: hci2: command tx timeout [ 53.207107][ T34] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 53.215702][ T5883] usb 6-1: GET_CAPABILITIES returned 0 [ 53.215725][ T5883] usbtmc 6-1:16.128: can't read capabilities [ 53.245245][ T1355] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 53.283608][ T6139] syzkaller1: entered promiscuous mode [ 53.283630][ T6139] syzkaller1: entered allmulticast mode [ 53.420740][ T6105] syz_tun: entered allmulticast mode [ 53.423527][ T6104] syz_tun: left allmulticast mode [ 53.431837][ T41] usb 6-1: USB disconnect, device number 3 [ 53.468325][ T6151] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 53.600534][ T6160] syzkaller1: entered promiscuous mode [ 53.600556][ T6160] syzkaller1: entered allmulticast mode [ 53.654813][ T6162] netlink: 4 bytes leftover after parsing attributes in process `syz.0.68'. [ 53.654831][ T6162] openvswitch: netlink: Flow actions attr not present in new flow. [ 53.717188][ T63] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 53.741549][ T6168] tc_dump_action: action bad kind [ 53.756127][ T63] libceph: mon0 (1)127.0.0.1:1 socket error on write [ 53.971087][ T6173] ieee802154 phy0 wpan0: encryption failed: -22 [ 54.015728][ T6125] ceph: No mds server is up or the cluster is laggy [ 54.015782][ T6115] ceph: No mds server is up or the cluster is laggy [ 54.151971][ T6187] syzkaller1: entered promiscuous mode [ 54.151986][ T6187] syzkaller1: entered allmulticast mode [ 54.495005][ T5883] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 54.578105][ T6220] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 54.620294][ T6223] overlayfs: conflicting options: nfs_export=on,index=off [ 54.631296][ T6225] netlink: 28 bytes leftover after parsing attributes in process `syz.1.89'. [ 54.664501][ T5883] usb 5-1: Using ep0 maxpacket: 8 [ 54.664989][ T5883] usb 5-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 54.665845][ T5883] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 54.665858][ T5883] usb 5-1: config 16 has an invalid interface number: 128 but max is 0 [ 54.665869][ T5883] usb 5-1: config 16 has no interface number 0 [ 54.665887][ T5883] usb 5-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 54.665899][ T5883] usb 5-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 54.665912][ T5883] usb 5-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 54.665924][ T5883] usb 5-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 54.665944][ T5883] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.692108][ T6227] syzkaller1: entered promiscuous mode [ 54.692127][ T6227] syzkaller1: entered allmulticast mode [ 54.867584][ T6236] FAULT_INJECTION: forcing a failure. [ 54.867584][ T6236] name failslab, interval 1, probability 0, space 0, times 1 [ 54.867611][ T6236] CPU: 3 UID: 0 PID: 6236 Comm: syz.1.96 Tainted: G L syzkaller #0 PREEMPT(full) [ 54.867636][ T6236] Tainted: [L]=SOFTLOCKUP [ 54.867644][ T6236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.867654][ T6236] Call Trace: [ 54.867661][ T6236] [ 54.867669][ T6236] dump_stack_lvl+0x100/0x190 [ 54.867715][ T6236] should_fail_ex.cold+0x5/0xa [ 54.867746][ T6236] should_failslab+0xc2/0x120 [ 54.867774][ T6236] __kmalloc_noprof+0xfc/0x840 [ 54.867801][ T6236] ? rcu_is_watching+0x13/0xc0 [ 54.867824][ T6236] ? tomoyo_realpath_from_path+0xb6/0x690 [ 54.867850][ T6236] tomoyo_realpath_from_path+0xb6/0x690 [ 54.867878][ T6236] tomoyo_path_number_perm+0x23c/0x580 [ 54.867902][ T6236] ? tomoyo_path_number_perm+0x22e/0x580 [ 54.867927][ T6236] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 54.867961][ T6236] ? __lock_acquire+0x5c0/0x1f40 [ 54.867997][ T6236] ? __fget_files+0x34/0x3d0 [ 54.868021][ T6236] ? find_held_lock+0x2b/0x80 [ 54.868042][ T6236] ? hook_file_ioctl_common+0x140/0x440 [ 54.868071][ T6236] ? __fget_files+0x21f/0x3d0 [ 54.868094][ T6236] security_file_ioctl+0xd3/0x230 [ 54.868121][ T6236] __x64_sys_ioctl+0xb7/0x210 [ 54.868166][ T6236] do_syscall_64+0x123/0x790 [ 54.868196][ T6236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.868216][ T6236] RIP: 0033:0x7f54ea59f559 [ 54.868234][ T6236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.868250][ T6236] RSP: 002b:00007f54eb44d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 54.868267][ T6236] RAX: ffffffffffffffda RBX: 00007f54ea825fa0 RCX: 00007f54ea59f559 [ 54.868278][ T6236] RDX: 0000200000000400 RSI: 0000000000005303 RDI: 0000000000000003 [ 54.868288][ T6236] RBP: 00007f54eb44d090 R08: 0000000000000000 R09: 0000000000000000 [ 54.868298][ T6236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 54.868308][ T6236] R13: 00007f54ea826038 R14: 00007f54ea825fa0 R15: 00007ffd2759f138 [ 54.868333][ T6236] [ 54.868382][ T6236] ERROR: Out of memory at tomoyo_realpath_from_path. [ 54.872890][ T5883] usb 5-1: GET_CAPABILITIES returned 0 [ 54.872927][ T5883] usbtmc 5-1:16.128: can't read capabilities [ 55.043174][ T6246] netlink: 'syz.1.100': attribute type 26 has an invalid length. [ 55.043195][ T6246] netlink: 4 bytes leftover after parsing attributes in process `syz.1.100'. [ 55.078810][ T6198] syz_tun: entered allmulticast mode [ 55.081684][ T6197] syz_tun: left allmulticast mode [ 55.083483][ T34] usb 5-1: USB disconnect, device number 3 [ 55.124577][ T5144] Bluetooth: hci1: command tx timeout [ 55.174593][ T6252] CIFS mount error: No usable UNC path provided in device string! [ 55.174593][ T6252] [ 55.174614][ T6252] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 55.198075][ T6255] syzkaller1: entered promiscuous mode [ 55.198089][ T6255] syzkaller1: entered allmulticast mode [ 55.214218][ T5144] Bluetooth: hci2: command tx timeout [ 55.214240][ T5144] Bluetooth: hci0: command tx timeout [ 55.214253][ T5144] Bluetooth: hci3: command tx timeout [ 55.277933][ T6263] tmpfs: Bad value for 'mpol' [ 55.283076][ T6263] tls_set_device_offload_rx: netdev not found [ 55.307883][ T6266] netlink: 56 bytes leftover after parsing attributes in process `syz.3.105'. [ 55.307909][ T6266] netlink: 56 bytes leftover after parsing attributes in process `syz.3.105'. [ 55.348560][ T6268] geneve2: entered promiscuous mode [ 55.348584][ T6268] geneve2: entered allmulticast mode [ 55.430871][ T6273] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 55.437431][ T6273] iommufd_mock iommufd_mock1: Adding to iommu group 11 [ 55.562361][ T6285] TC_ACT_REPEAT abuse ? [ 55.597851][ T6292] syzkaller1: entered promiscuous mode [ 55.597873][ T6292] syzkaller1: entered allmulticast mode [ 55.710800][ T6307] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 55.739296][ T6311] syzkaller0: entered promiscuous mode [ 55.739318][ T6311] syzkaller0: entered allmulticast mode [ 55.751702][ T6313] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 55.770848][ T6311] block device autoloading is deprecated and will be removed. qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 55.889316][ T6321] FAULT_INJECTION: forcing a failure. [ 55.889316][ T6321] name failslab, interval 1, probability 0, space 0, times 0 [ 55.889336][ T6321] CPU: 2 UID: 0 PID: 6321 Comm: syz.0.128 Tainted: G L syzkaller #0 PREEMPT(full) [ 55.889352][ T6321] Tainted: [L]=SOFTLOCKUP [ 55.889357][ T6321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 55.889364][ T6321] Call Trace: [ 55.889368][ T6321] [ 55.889372][ T6321] dump_stack_lvl+0x100/0x190 [ 55.889396][ T6321] should_fail_ex.cold+0x5/0xa [ 55.889414][ T6321] should_failslab+0xc2/0x120 [ 55.889427][ T6321] __kmalloc_noprof+0xfc/0x840 [ 55.889445][ T6321] ? tomoyo_encode2+0xfb/0x3c0 [ 55.889459][ T6321] tomoyo_encode2+0xfb/0x3c0 [ 55.889472][ T6321] tomoyo_encode+0x29/0x50 [ 55.889483][ T6321] tomoyo_realpath_from_path+0x18c/0x690 [ 55.889498][ T6321] tomoyo_path_number_perm+0x23c/0x580 [ 55.889519][ T6321] ? tomoyo_path_number_perm+0x22e/0x580 [ 55.889544][ T6321] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 55.889587][ T6321] ? __lock_acquire+0x5c0/0x1f40 [ 55.889626][ T6321] ? __fget_files+0x34/0x3d0 [ 55.889650][ T6321] ? find_held_lock+0x2b/0x80 [ 55.889666][ T6321] ? hook_file_ioctl_common+0x140/0x440 [ 55.889683][ T6321] ? __fget_files+0x21f/0x3d0 [ 55.889699][ T6321] security_file_ioctl+0xd3/0x230 [ 55.889718][ T6321] __x64_sys_ioctl+0xb7/0x210 [ 55.889737][ T6321] do_syscall_64+0x123/0x790 [ 55.889750][ T6321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 55.889763][ T6321] RIP: 0033:0x7fa0fbb9f559 [ 55.889773][ T6321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.889784][ T6321] RSP: 002b:00007fa0fcb03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 55.889796][ T6321] RAX: ffffffffffffffda RBX: 00007fa0fbe25fa0 RCX: 00007fa0fbb9f559 [ 55.889803][ T6321] RDX: 0000200000000400 RSI: 0000000000005303 RDI: 0000000000000003 [ 55.889810][ T6321] RBP: 00007fa0fcb03090 R08: 0000000000000000 R09: 0000000000000000 [ 55.889817][ T6321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 55.889823][ T6321] R13: 00007fa0fbe26038 R14: 00007fa0fbe25fa0 R15: 00007ffe99d8b298 [ 55.889838][ T6321] [ 55.889848][ T6321] ERROR: Out of memory at tomoyo_realpath_from_path. [ 55.913301][ T6323] netlink: 'syz.3.129': attribute type 2 has an invalid length. [ 55.934063][ T5883] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 55.969876][ T6325] syzkaller1: entered promiscuous mode [ 55.969890][ T6325] syzkaller1: entered allmulticast mode [ 56.013828][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 56.101141][ T6305] tmpfs: Bad value for 'mpol' [ 56.103548][ T5883] usb 7-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 56.103579][ T5883] usb 7-1: too many configurations: 181, using maximum allowed: 8 [ 56.104396][ T5883] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 56.104432][ T5883] usb 7-1: can't read configurations, error -71 [ 56.184086][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 56.184993][ T10] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 56.188332][ T10] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 56.188354][ T10] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 56.188371][ T10] usb 6-1: config 16 has no interface number 0 [ 56.188424][ T10] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 56.188445][ T10] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 56.188466][ T10] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 56.188486][ T10] usb 6-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 56.188526][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.403168][ T10] usb 6-1: GET_CAPABILITIES returned 0 [ 56.403208][ T10] usbtmc 6-1:16.128: can't read capabilities [ 56.574332][ T6342] raw_sendmsg: syz.0.137 forgot to set AF_INET. Fix it! [ 56.608446][ T6317] syz_tun: entered allmulticast mode [ 56.612105][ T6316] syz_tun: left allmulticast mode [ 56.615023][ T41] usb 6-1: USB disconnect, device number 4 [ 56.652810][ T42] kauditd_printk_skb: 78 callbacks suppressed [ 56.652827][ T42] audit: type=1400 audit(56.581:349): avc: denied { map_create } for pid=6344 comm="syz.2.138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 56.702353][ T42] audit: type=1326 audit(56.631:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6344 comm="syz.2.138" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f398339f559 code=0x0 [ 56.720075][ T6348] syzkaller1: entered promiscuous mode [ 56.720088][ T6348] syzkaller1: entered allmulticast mode [ 56.761164][ T42] audit: type=1400 audit(56.691:351): avc: denied { unlink } for pid=6344 comm="syz.2.138" name="#1" dev="tmpfs" ino=167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 56.768188][ T6349] evm: overlay not supported [ 57.202316][ T42] audit: type=1400 audit(57.131:352): avc: denied { write } for pid=6361 comm="syz.1.145" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.202721][ T42] audit: type=1400 audit(57.131:353): avc: denied { open } for pid=6361 comm="syz.1.145" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.210428][ T42] audit: type=1400 audit(57.141:354): avc: denied { ioctl } for pid=6361 comm="syz.1.145" path="/dev/sg0" dev="devtmpfs" ino=720 ioctlcmd=0x2271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.224463][ T42] audit: type=1400 audit(57.161:355): avc: denied { bind } for pid=6361 comm="syz.1.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.224924][ T42] audit: type=1400 audit(57.161:356): avc: denied { write } for pid=6361 comm="syz.1.145" path="socket:[11682]" dev="sockfs" ino=11682 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.271642][ T6364] Bluetooth: MGMT ver 1.23 [ 57.274560][ T6364] netlink: 40 bytes leftover after parsing attributes in process `syz.1.146'. [ 57.274579][ T6364] openvswitch: netlink: Flow key attr not present in new flow. [ 57.366937][ T5883] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 57.449056][ T6371] netlink: 8 bytes leftover after parsing attributes in process `syz.1.147'. [ 57.524255][ T5883] usb 5-1: Using ep0 maxpacket: 32 [ 57.525599][ T5883] usb 5-1: New USB device found: idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 57.527027][ T5883] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 57.527049][ T5883] usb 5-1: config 0 has no interface number 0 [ 57.527081][ T5883] usb 5-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 57.527102][ T5883] usb 5-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 57.527123][ T5883] usb 5-1: config 0 interface 119 altsetting 0 endpoint 0x83 has an invalid bInterval 255, changing to 11 [ 57.527146][ T5883] usb 5-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 59391, setting to 1024 [ 57.527170][ T5883] usb 5-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 57.530468][ T5883] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.530490][ T5883] usb 5-1: Product: syz [ 57.530504][ T5883] usb 5-1: Manufacturer: syz [ 57.530518][ T5883] usb 5-1: SerialNumber: syz [ 57.532828][ T5883] usb 5-1: config 0 descriptor?? [ 57.534489][ T6357] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 57.539675][ T5883] input: bcm5974 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.119/input/input6 [ 57.738818][ T42] audit: type=1400 audit(57.671:357): avc: denied { read write } for pid=6356 comm="syz.0.143" name="event4" dev="devtmpfs" ino=2893 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 57.739160][ T42] audit: type=1400 audit(57.671:358): avc: denied { open } for pid=6356 comm="syz.0.143" path="/dev/input/event4" dev="devtmpfs" ino=2893 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 57.760148][ T5883] usb 5-1: USB disconnect, device number 4 [ 58.578284][ T6387] syzkaller0: entered promiscuous mode [ 58.578298][ T6387] syzkaller0: entered allmulticast mode [ 58.674273][ T63] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 58.752157][ T1355] rxe_eth0 speed is unknown, defaulting to 1000 [ 58.769350][ T6391] Set syz1 is full, maxelem 2 reached [ 58.823885][ T63] usb 6-1: Using ep0 maxpacket: 8 [ 58.825237][ T63] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 58.826125][ T63] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 58.826139][ T63] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 58.826149][ T63] usb 6-1: config 16 has no interface number 0 [ 58.826167][ T63] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 58.826179][ T63] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 58.826192][ T63] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 58.826204][ T63] usb 6-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 58.826224][ T63] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.923270][ T6398] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 59.037033][ T63] usb 6-1: GET_CAPABILITIES returned 0 [ 59.037057][ T63] usbtmc 6-1:16.128: can't read capabilities [ 59.246215][ T41] usb 6-1: USB disconnect, device number 5 [ 59.361808][ T6412] FAULT_INJECTION: forcing a failure. [ 59.361808][ T6412] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.361834][ T6412] CPU: 0 UID: 0 PID: 6412 Comm: syz.3.163 Tainted: G L syzkaller #0 PREEMPT(full) [ 59.361856][ T6412] Tainted: [L]=SOFTLOCKUP [ 59.361860][ T6412] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.361867][ T6412] Call Trace: [ 59.361872][ T6412] [ 59.361876][ T6412] dump_stack_lvl+0x100/0x190 [ 59.361900][ T6412] should_fail_ex.cold+0x5/0xa [ 59.361918][ T6412] _copy_from_user+0x2e/0xd0 [ 59.361932][ T6412] mmc_ioctl_cdrom_play_msf+0xcc/0x390 [ 59.361960][ T6412] ? __pfx_mmc_ioctl_cdrom_play_msf+0x10/0x10 [ 59.361979][ T6412] ? lock_acquire+0x1d1/0x380 [ 59.361996][ T6412] ? sr_block_ioctl+0x118/0x250 [ 59.362009][ T6412] cdrom_ioctl+0x31d2/0x3880 [ 59.362021][ T6412] ? __pfx_cdrom_ioctl+0x10/0x10 [ 59.362031][ T6412] ? rcu_is_watching+0x13/0xc0 [ 59.362043][ T6412] ? trace_rpm_return_int+0x78/0x220 [ 59.362059][ T6412] ? rpm_resume+0x7eb/0x1320 [ 59.362076][ T6412] ? __pfx_rpm_resume+0x10/0x10 [ 59.362089][ T6412] ? do_raw_spin_lock+0x128/0x260 [ 59.362104][ T6412] ? lockdep_hardirqs_on+0x7d/0x110 [ 59.362128][ T6412] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 59.362145][ T6412] ? __pm_runtime_resume+0xc3/0x170 [ 59.362161][ T6412] sr_block_ioctl+0x1ae/0x250 [ 59.362172][ T6412] ? __pfx_sr_block_ioctl+0x10/0x10 [ 59.362184][ T6412] blkdev_ioctl+0x5ad/0x6f0 [ 59.362197][ T6412] ? __pfx_blkdev_ioctl+0x10/0x10 [ 59.362209][ T6412] ? selinux_file_ioctl+0x1e0/0x290 [ 59.362227][ T6412] ? selinux_file_ioctl+0x1e7/0x290 [ 59.362245][ T6412] ? __pfx_blkdev_ioctl+0x10/0x10 [ 59.362258][ T6412] __x64_sys_ioctl+0x18e/0x210 [ 59.362278][ T6412] do_syscall_64+0x123/0x790 [ 59.362291][ T6412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.362303][ T6412] RIP: 0033:0x7f52bc59f559 [ 59.362312][ T6412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.362323][ T6412] RSP: 002b:00007f52bd3ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 59.362335][ T6412] RAX: ffffffffffffffda RBX: 00007f52bc825fa0 RCX: 00007f52bc59f559 [ 59.362342][ T6412] RDX: 0000200000000400 RSI: 0000000000005303 RDI: 0000000000000003 [ 59.362349][ T6412] RBP: 00007f52bd3ac090 R08: 0000000000000000 R09: 0000000000000000 [ 59.362356][ T6412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 59.362362][ T6412] R13: 00007f52bc826038 R14: 00007f52bc825fa0 R15: 00007ffc350a8778 [ 59.362377][ T6412] [ 59.934180][ T6424] CIFS mount error: No usable UNC path provided in device string! [ 59.934180][ T6424] [ 59.934199][ T6424] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 60.045812][ T6428] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 60.056658][ T6428] bond1 (unregistering): Released all slaves [ 60.089964][ T6431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.171'. [ 60.089979][ T6431] netlink: 24 bytes leftover after parsing attributes in process `syz.0.171'. [ 60.358956][ T6444] hd3ss3220 0-0047: supply vdd5 not found, using dummy regulator [ 60.365293][ T6444] hd3ss3220 0-0047: supply vcc33 not found, using dummy regulator [ 60.377827][ T6444] i2c i2c-0: new_device: Instantiated device hd3ss3220 at 0x47 [ 60.378355][ T6444] i2c i2c-0: delete_device: Can't parse I2C address [ 60.428002][ T6451] netlink: 'syz.0.179': attribute type 4 has an invalid length. [ 60.428023][ T6451] netlink: 152 bytes leftover after parsing attributes in process `syz.0.179'. [ 60.432545][ T6451] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 60.464121][ T63] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 60.547776][ T6456] FAULT_INJECTION: forcing a failure. [ 60.547776][ T6456] name failslab, interval 1, probability 0, space 0, times 0 [ 60.547807][ T6456] CPU: 0 UID: 0 PID: 6456 Comm: syz.0.182 Tainted: G L syzkaller #0 PREEMPT(full) [ 60.547834][ T6456] Tainted: [L]=SOFTLOCKUP [ 60.547839][ T6456] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.547848][ T6456] Call Trace: [ 60.547855][ T6456] [ 60.547863][ T6456] dump_stack_lvl+0x100/0x190 [ 60.547916][ T6456] should_fail_ex.cold+0x5/0xa [ 60.547955][ T6456] should_failslab+0xc2/0x120 [ 60.548000][ T6456] kmem_cache_alloc_noprof+0x92/0x6a0 [ 60.548032][ T6456] ? __send_signal_locked+0x1d1/0x1420 [ 60.548059][ T6456] __send_signal_locked+0x1d1/0x1420 [ 60.548086][ T6456] send_signal_locked+0x15e/0x970 [ 60.548109][ T6456] ? __pfx_send_signal_locked+0x10/0x10 [ 60.548127][ T6456] ? do_raw_spin_lock+0x128/0x260 [ 60.548151][ T6456] ? _raw_spin_lock_irqsave+0x52/0x60 [ 60.548192][ T6456] force_sig_info_to_task+0x450/0x660 [ 60.548221][ T6456] force_sig_fault+0xc3/0x100 [ 60.548245][ T6456] ? __pfx_force_sig_fault+0x10/0x10 [ 60.548272][ T6456] ? __pfx___up_read+0x10/0x10 [ 60.548302][ T6456] ? fixup_vdso_exception+0x2d1/0x370 [ 60.548332][ T6456] __bad_area_nosemaphore+0x31b/0x3f0 [ 60.548360][ T6456] ? lock_mm_and_find_vma+0xaa/0x750 [ 60.548412][ T6456] do_user_addr_fault+0x8ca/0x12f0 [ 60.548454][ T6456] exc_page_fault+0x6f/0xd0 [ 60.548485][ T6456] asm_exc_page_fault+0x26/0x30 [ 60.548504][ T6456] RIP: 0033:0x7fa0fba53c73 [ 60.548520][ T6456] Code: 0f 1f 80 00 00 00 00 48 89 7c 24 f8 48 89 74 24 f0 48 89 54 24 e8 48 89 4c 24 e0 48 8b 4c 24 f8 48 8b 54 24 f0 48 8b 44 24 e8 <44> 8b 41 2c 8b 79 30 48 8b 74 24 e0 49 01 d0 8b 14 3a 41 23 10 f6 [ 60.548536][ T6456] RSP: 002b:00007fa0fcb02fc8 EFLAGS: 00010202 [ 60.548551][ T6456] RAX: 00007fa0fcae1000 RBX: 0000200000000340 RCX: 0000000000000000 [ 60.548563][ T6456] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 60.548573][ T6456] RBP: 0000200000001540 R08: 00002000000014c0 R09: 0000000000000000 [ 60.548586][ T6456] R10: ffffffffffffffff R11: 0000000000000000 R12: 0000000000000000 [ 60.548598][ T6456] R13: 00007fa0fbe26038 R14: 00007fa0fbe25fa0 R15: 00007ffe99d8b298 [ 60.548625][ T6456] [ 60.613826][ T63] usb 8-1: Using ep0 maxpacket: 8 [ 60.614463][ T63] usb 8-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 60.615426][ T63] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 60.615445][ T63] usb 8-1: config 16 has an invalid interface number: 128 but max is 0 [ 60.615462][ T63] usb 8-1: config 16 has no interface number 0 [ 60.615493][ T63] usb 8-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 60.615509][ T63] usb 8-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 60.615526][ T63] usb 8-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 60.615545][ T63] usb 8-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 60.615576][ T63] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.765350][ T67] Bluetooth: hci1: SCO packet for unknown connection handle 1 [ 60.766805][ T6471] overlay: Unknown parameter 'fowner>00000000000000060929' [ 60.832934][ T63] usb 8-1: GET_CAPABILITIES returned 0 [ 60.832974][ T63] usbtmc 8-1:16.128: can't read capabilities [ 61.041472][ T63] usb 8-1: USB disconnect, device number 2 [ 61.285054][ T6495] FAULT_INJECTION: forcing a failure. [ 61.285054][ T6495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.285075][ T6495] CPU: 2 UID: 0 PID: 6495 Comm: syz.1.195 Tainted: G L syzkaller #0 PREEMPT(full) [ 61.285091][ T6495] Tainted: [L]=SOFTLOCKUP [ 61.285096][ T6495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.285103][ T6495] Call Trace: [ 61.285107][ T6495] [ 61.285112][ T6495] dump_stack_lvl+0x100/0x190 [ 61.285135][ T6495] should_fail_ex.cold+0x5/0xa [ 61.285154][ T6495] _copy_to_user+0x32/0xd0 [ 61.285169][ T6495] simple_read_from_buffer+0xcb/0x170 [ 61.285184][ T6495] proc_fail_nth_read+0x1af/0x230 [ 61.285200][ T6495] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 61.285216][ T6495] ? rw_verify_area+0xce/0x6d0 [ 61.285232][ T6495] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 61.285247][ T6495] vfs_read+0x1e4/0xb40 [ 61.285265][ T6495] ? lock_acquire+0x1d1/0x380 [ 61.285280][ T6495] ? __fget_files+0x34/0x3d0 [ 61.285294][ T6495] ? __pfx_vfs_read+0x10/0x10 [ 61.285311][ T6495] ? find_held_lock+0x2b/0x80 [ 61.285323][ T6495] ? __fget_files+0x215/0x3d0 [ 61.285339][ T6495] ? __fget_files+0x21f/0x3d0 [ 61.285356][ T6495] ksys_read+0x12a/0x250 [ 61.285366][ T6495] ? __pfx_ksys_read+0x10/0x10 [ 61.285380][ T6495] do_syscall_64+0x123/0x790 [ 61.285393][ T6495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.285406][ T6495] RIP: 0033:0x7f54ea55fd8e [ 61.285416][ T6495] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 61.285427][ T6495] RSP: 002b:00007f54eb44cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 61.285438][ T6495] RAX: ffffffffffffffda RBX: 00007f54eb44d6c0 RCX: 00007f54ea55fd8e [ 61.285445][ T6495] RDX: 000000000000000f RSI: 00007f54eb44d0a0 RDI: 0000000000000004 [ 61.285452][ T6495] RBP: 00007f54eb44d090 R08: 0000000000000000 R09: 0000000000000000 [ 61.285459][ T6495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 61.285465][ T6495] R13: 00007f54ea826038 R14: 00007f54ea825fa0 R15: 00007ffd2759f138 [ 61.285480][ T6495] [ 61.366616][ T6507] CIFS mount error: No usable UNC path provided in device string! [ 61.366616][ T6507] [ 61.366635][ T6507] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 61.630498][ T6527] Bluetooth: MGMT ver 1.23 [ 61.671676][ T42] kauditd_printk_skb: 55 callbacks suppressed [ 61.671695][ T42] audit: type=1400 audit(61.601:414): avc: denied { create } for pid=6524 comm="syz.0.207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 61.675955][ T42] audit: type=1400 audit(61.611:415): avc: denied { setopt } for pid=6524 comm="syz.0.207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 61.676298][ T42] audit: type=1400 audit(61.611:416): avc: denied { accept } for pid=6524 comm="syz.0.207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 61.741286][ T6532] /dev/sr0: Can't open blockdev [ 61.986753][ T42] audit: type=1400 audit(61.921:417): avc: denied { create } for pid=6539 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 61.990931][ T42] audit: type=1400 audit(61.921:418): avc: denied { bind } for pid=6539 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 61.991520][ T42] audit: type=1400 audit(61.921:419): avc: denied { node_bind } for pid=6539 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 61.998394][ T6540] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 62.009335][ T42] audit: type=1400 audit(61.941:420): avc: denied { ioctl } for pid=6539 comm="syz.3.214" path="socket:[14626]" dev="sockfs" ino=14626 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 62.051486][ T13] smpboot: CPU 1 is now offline [ 62.103652][ T13] [ 62.104721][ T13] ====================================================== [ 62.107395][ T13] WARNING: possible circular locking dependency detected [ 62.110175][ T13] syzkaller #0 Tainted: G L [ 62.112720][ T13] ------------------------------------------------------ [ 62.115484][ T13] kworker/u32:1/13 is trying to acquire lock: [ 62.117919][ T13] ffff88801e3ef5a8 (kn->active#5){++++}-{0:0}, at: __kernfs_remove+0x34c/0xbc0 [ 62.121498][ T13] [ 62.121498][ T13] but task is already holding lock: [ 62.124400][ T13] ffffffff8fe7a6b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 [ 62.128333][ T13] [ 62.128333][ T13] which lock already depends on the new lock. [ 62.128333][ T13] [ 62.132363][ T13] [ 62.132363][ T13] the existing dependency chain (in reverse order) is: [ 62.135832][ T13] [ 62.135832][ T13] -> #3 (cpu_hotplug_lock){++++}-{0:0}: [ 62.138928][ T13] lock_acquire+0x1d1/0x380 [ 62.141022][ T13] percpu_down_write+0x4e/0x3d0 [ 62.143190][ T13] _cpu_up+0x68/0x960 [ 62.145042][ T13] cpu_up+0x1ba/0x230 [ 62.146877][ T13] cpuhp_bringup_mask+0xf8/0x180 [ 62.149079][ T13] bringup_nonboot_cpus+0xd9/0x1b0 [ 62.151276][ T13] smp_init+0x32/0x150 [ 62.153353][ T13] kernel_init_freeable+0x44b/0x7b0 [ 62.155574][ T13] kernel_init+0x21/0x1e0 [ 62.157480][ T13] ret_from_fork+0x730/0xd60 [ 62.159499][ T13] ret_from_fork_asm+0x1a/0x30 [ 62.161557][ T13] [ 62.161557][ T13] -> #2 (cpu_add_remove_lock){+.+.}-{4:4}: [ 62.164597][ T13] lock_acquire+0x1d1/0x380 [ 62.166539][ T13] __mutex_lock+0x19f/0x1c10 [ 62.168552][ T13] cpu_device_down+0x46/0xc0 [ 62.170356][ T13] device_offline+0x2f4/0x400 [ 62.172411][ T13] acpi_bus_offline+0x3c7/0x550 [ 62.174504][ T13] acpi_device_hotplug+0x627/0xbe0 [ 62.176655][ T13] acpi_hotplug_work_fn+0x5e/0x90 [ 62.178755][ T13] process_one_work+0xac7/0x1b10 [ 62.180895][ T13] worker_thread+0x5ef/0xe50 [ 62.182883][ T13] kthread+0x373/0x450 [ 62.184718][ T13] ret_from_fork+0x730/0xd60 [ 62.186718][ T13] ret_from_fork_asm+0x1a/0x30 [ 62.188802][ T13] [ 62.188802][ T13] -> #1 (&device->physical_node_lock){+.+.}-{4:4}: [ 62.192101][ T13] lock_acquire+0x1d1/0x380 [ 62.194053][ T13] __mutex_lock+0x19f/0x1c10 [ 62.196004][ T13] acpi_companion_match+0xc0/0x180 [ 62.198277][ T13] acpi_device_uevent_modalias+0x19/0x30 [ 62.200666][ T13] platform_uevent+0x51/0xc0 [ 62.202628][ T13] dev_uevent+0x1de/0x870 [ 62.204459][ T13] kobject_uevent_env+0x6eb/0x18b0 [ 62.206633][ T13] kobject_synth_uevent+0x679/0x7d0 [ 62.208842][ T13] uevent_store+0x24/0x50 [ 62.210740][ T13] dev_attr_store+0x58/0x80 [ 62.212713][ T13] sysfs_kf_write+0xf2/0x150 [ 62.214702][ T13] kernfs_fop_write_iter+0x3e0/0x5f0 [ 62.216952][ T13] vfs_write+0x6af/0x1050 [ 62.218851][ T13] ksys_write+0x12a/0x250 [ 62.220757][ T13] do_syscall_64+0x123/0x790 [ 62.222748][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.225226][ T13] [ 62.225226][ T13] -> #0 (kn->active#5){++++}-{0:0}: [ 62.228120][ T13] check_prev_add+0xeb/0xe60 [ 62.230156][ T13] __lock_acquire+0x1528/0x1f40 [ 62.232292][ T13] lock_acquire+0x1d1/0x380 [ 62.234316][ T13] kernfs_drain+0x4eb/0x600 [ 62.236322][ T13] __kernfs_remove+0x34c/0xbc0 [ 62.238424][ T13] kernfs_remove_by_name_ns+0x7c/0x120 [ 62.240775][ T13] device_del+0x361/0x9b0 [ 62.242408][ T13] device_unregister+0x1d/0xe0 [ 62.244083][ T13] unregister_cpu+0xa0/0x140 [ 62.245649][ T13] acpi_processor_post_eject+0x16f/0x390 [ 62.247512][ T13] acpi_device_hotplug+0x9df/0xbe0 [ 62.249282][ T13] acpi_hotplug_work_fn+0x5e/0x90 [ 62.250921][ T13] process_one_work+0xac7/0x1b10 [ 62.252557][ T13] worker_thread+0x5ef/0xe50 [ 62.254114][ T13] kthread+0x373/0x450 [ 62.255520][ T13] ret_from_fork+0x730/0xd60 [ 62.257090][ T13] ret_from_fork_asm+0x1a/0x30 [ 62.258702][ T13] [ 62.258702][ T13] other info that might help us debug this: [ 62.258702][ T13] [ 62.262347][ T13] Chain exists of: [ 62.262347][ T13] kn->active#5 --> cpu_add_remove_lock --> cpu_hotplug_lock [ 62.262347][ T13] [ 62.266274][ T13] Possible unsafe locking scenario: [ 62.266274][ T13] [ 62.268435][ T13] CPU0 CPU1 [ 62.270149][ T13] ---- ---- [ 62.271787][ T13] lock(cpu_hotplug_lock); [ 62.273173][ T13] lock(cpu_add_remove_lock); [ 62.275444][ T13] lock(cpu_hotplug_lock); [ 62.277526][ T13] lock(kn->active#5); [ 62.278838][ T13] [ 62.278838][ T13] *** DEADLOCK *** [ 62.278838][ T13] [ 62.282038][ T13] locks held by kworker/u32:1/13: 6, last CPU#0: [ 62.284654][ T13] #0: ffff888023e79948 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 [ 62.289101][ T13] #1: ffffc90000107d08 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 62.293492][ T13] #2: ffffffff91047100 (device_hotplug_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x7e/0xbe0 [ 62.297592][ T13] #3: ffffffff90d15c60 (acpi_scan_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x8c/0xbe0 [ 62.300976][ T13] #4: ffffffff8fe7a760 (cpu_add_remove_lock){+.+.}-{4:4}, at: acpi_processor_post_eject+0x141/0x390 [ 62.303792][ T63] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 62.306724][ T13] #5: ffffffff8fe7a6b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 [ 62.310100][ T13] [ 62.310100][ T13] stack backtrace: [ 62.312254][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u32:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 62.316159][ T13] Tainted: [L]=SOFTLOCKUP [ 62.317791][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.321220][ T13] Workqueue: kacpi_hotplug acpi_hotplug_work_fn [ 62.323204][ T13] Call Trace: [ 62.324222][ T13] [ 62.325146][ T13] dump_stack_lvl+0x100/0x190 [ 62.326544][ T13] print_circular_bug.cold+0x178/0x1be [ 62.328202][ T13] check_noncircular+0x146/0x160 [ 62.329713][ T13] check_prev_add+0xeb/0xe60 [ 62.331094][ T13] __lock_acquire+0x1528/0x1f40 [ 62.332556][ T13] lock_acquire+0x1d1/0x380 [ 62.333960][ T13] ? __kernfs_remove+0x34c/0xbc0 [ 62.335447][ T13] ? kernfs_drain+0x4c2/0x600 [ 62.336881][ T13] kernfs_drain+0x4eb/0x600 [ 62.338274][ T13] ? __kernfs_remove+0x34c/0xbc0 [ 62.339842][ T13] ? __pfx_kernfs_drain+0x10/0x10 [ 62.341369][ T13] ? find_held_lock+0x2b/0x80 [ 62.342827][ T13] ? __kernfs_remove+0x224/0xbc0 [ 62.344364][ T13] ? __kernfs_remove+0x224/0xbc0 [ 62.345901][ T13] ? up_write+0x2dc/0x5b0 [ 62.347227][ T13] __kernfs_remove+0x34c/0xbc0 [ 62.348755][ T13] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 62.350650][ T13] kernfs_remove_by_name_ns+0x7c/0x120 [ 62.352319][ T13] device_del+0x361/0x9b0 [ 62.353671][ T13] ? __pfx_device_del+0x10/0x10 [ 62.355173][ T13] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 62.357063][ T13] ? kernfs_remove_by_name_ns+0xbb/0x120 [ 62.358810][ T13] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 62.360702][ T13] device_unregister+0x1d/0xe0 [ 62.362185][ T13] unregister_cpu+0xa0/0x140 [ 62.363601][ T13] acpi_processor_post_eject+0x16f/0x390 [ 62.365317][ T13] acpi_device_hotplug+0x9df/0xbe0 [ 62.366851][ T13] ? __pfx_acpi_device_hotplug+0x10/0x10 [ 62.368578][ T13] acpi_hotplug_work_fn+0x5e/0x90 [ 62.370218][ T13] process_one_work+0xac7/0x1b10 [ 62.371728][ T13] ? __pfx_process_one_work+0x10/0x10 [ 62.373364][ T13] ? lock_acquire+0x1d1/0x380 [ 62.374821][ T13] ? __pfx_acpi_hotplug_work_fn+0x10/0x10 [ 62.376583][ T13] worker_thread+0x5ef/0xe50 [ 62.378016][ T13] ? kthread+0x13a/0x450 [ 62.379337][ T13] ? __pfx_worker_thread+0x10/0x10 [ 62.380918][ T13] kthread+0x373/0x450 [ 62.382182][ T13] ? __pfx_kthread+0x10/0x10 [ 62.383635][ T13] ret_from_fork+0x730/0xd60 [ 62.385083][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 62.386784][ T13] ? __switch_to+0x800/0x10e0 [ 62.388242][ T13] ? __pfx_kthread+0x10/0x10 [ 62.389717][ T13] ret_from_fork_asm+0x1a/0x30 [ 62.391194][ T13] [ 62.454024][ T63] usb 8-1: Using ep0 maxpacket: 8 [ 62.456679][ T63] usb 8-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 62.457682][ T63] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 62.458480][ T63] usb 8-1: config 16 has an invalid interface number: 128 but max is 0 [ 62.458493][ T63] usb 8-1: config 16 has no interface number 0 [ 62.458509][ T63] usb 8-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 62.458521][ T63] usb 8-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 62.458533][ T63] usb 8-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 62.458545][ T63] usb 8-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 62.458564][ T63] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.471468][ T3313] cfg80211: failed to load regulatory.db [ 62.684678][ T63] usb 8-1: GET_CAPABILITIES returned 0 [ 62.684708][ T63] usbtmc 8-1:16.128: can't read capabilities [ 62.891386][ T1355] usb 8-1: USB disconnect, device number 3 [ 63.693940][ T5787] Bluetooth: hci1: command 0x0c24 tx timeout [ 63.693965][ T67] Bluetooth: hci1: Opcode 0x0c24 failed: -110 [ 71.205059][ T1448] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.205086][ T1448] ieee802154 phy1 wpan1: encryption failed: -22