last executing test programs: 4m56.164269393s ago: executing program 32 (id=36): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x4) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) shutdown(r1, 0x0) recvfrom$unix(r1, 0x0, 0x0, 0x10120, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 4m53.465244703s ago: executing program 4 (id=69): pipe(&(0x7f0000000dc0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000e00)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000e40)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdir(&(0x7f0000000e80)='./file0\x00', 0x0) rmdir(0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) stat(&(0x7f0000000f80)='./file0/file0\x00', 0x0) 4m52.569247705s ago: executing program 4 (id=82): openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/binder-control\x00', 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x22020600) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, 0x0, 0x0) gettid() signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) poll(0x0, 0x0, 0x90) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000014c0)='/sys/kernel/profiling', 0x1, 0x1cc) writev(r0, &(0x7f0000001500)=[{&(0x7f0000001540)="392c00b5", 0x4}, {0x0}], 0x2) 4m52.408786415s ago: executing program 4 (id=85): syz_io_uring_setup(0xc, &(0x7f0000000000)={0x0, 0xa827, 0x10000, 0xfffffffc, 0x177}, 0x0, 0x0, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000200)={0x0, 0x1000, 0x80, 0x2}, 0x0, 0x0, 0x0) r0 = openat$kvm(0x0, &(0x7f0000001040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f0000001080)={0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000011c0), 0x100}, 0x0) syz_emit_vhci(&(0x7f0000001200)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 4m51.676779425s ago: executing program 4 (id=100): mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x21c0, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000580)='.\x00', &(0x7f00000005c0)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000000600)='./bus\x00', &(0x7f0000000640), 0x40, &(0x7f0000000680)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000006c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000140)='7', 0x1) mknodat$loop(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x6004, 0x1) 4m51.584577228s ago: executing program 4 (id=104): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./pipefs\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./pipefs/gssd/clntXX/gssd\x00', 0x80202, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000000480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@any_dev={0x2, 0xc25, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0x4}}}, &(0x7f0000000540)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x100, 0x2, 0x339, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x80000, 0x0, 0x341}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0xffffffff, 0x100135}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x1, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 4m49.699891482s ago: executing program 4 (id=113): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x8000060000000000}) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4m49.648780178s ago: executing program 33 (id=113): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x8000060000000000}) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4m43.087220187s ago: executing program 3 (id=163): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xc0, &(0x7f00000002c0)=[@in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e20, @remote}, @in6={0xa, 0x4e24, 0x7, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x4000100}, @in6={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x6}, @in6={0xa, 0x4e21, 0x7, @mcast1, 0xffffffff}, @in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e22, 0x80000001, @local, 0x1}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="7b87f20f"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa05, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m42.71545824s ago: executing program 3 (id=164): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "750600", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "ffffffffffffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) 4m42.647058437s ago: executing program 3 (id=165): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x34, r1, 0x1, 0x0, 0x0, {0xb}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f00000000c0)={r3, r3, 0x3b00, 0xd, &(0x7f0000000180)='\x00', 0xb, 0x1, 0x4c4a, 0x2, 0x9, 0x1, 0x2001, 'syz0\x00'}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000240)=""/78, 0x4e}], 0x1}, 0x1}], 0x1, 0x0, 0x0) 4m42.529821587s ago: executing program 3 (id=166): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b92a, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {}, {0xc, 0xb}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x64}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000640)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000680)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000006c0)={'syzkaller0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000700)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000740)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 4m42.346309514s ago: executing program 3 (id=167): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc_mnt/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xfa) mount(0x0, &(0x7f00000007c0)='./mydev\x00', 0x0, 0x0, 0x0) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) write$sysctl(r0, &(0x7f0000000240)='0', 0x1) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x8922, &(0x7f0000000280)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}}) syz_emit_ethernet(0x3a, &(0x7f00000002c0)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x2, 0x23, 0x2c, 0x68, 0x0, 0x7, 0x6, 0x0, @remote, @remote, {[@timestamp_prespec={0x44, 0x4, 0x37}]}}, {{0x4e22, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x2, 0x0, 0xe7}}}}}}, 0x0) 4m42.222092762s ago: executing program 3 (id=168): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000940)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x7, 0x1c, &(0x7f0000000a80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x2, 0x300}, {0x6e, 0x0, 0xd}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x20000f19}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0xf1}}}, &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m27.042525215s ago: executing program 34 (id=168): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000940)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x7, 0x1c, &(0x7f0000000a80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x2, 0x300}, {0x6e, 0x0, 0xd}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x20000f19}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0xf1}}}, &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m24.676638811s ago: executing program 5 (id=308): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x101040, 0x0) openat$procfs(0xffffff9c, &(0x7f0000000000)='/proc/zoneinfo\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$kcm(0x10, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='\n', 0x1) 4m24.485399564s ago: executing program 5 (id=310): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000280), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000008050000010b007e0b0a43b820a8e8c9881db642", @ANYRES8=r0, @ANYRES64=r1], 0x97) open(&(0x7f0000000140)='.\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f00000004c0)='./bus\x00', 0x0, 0x40, 0x0) chdir(&(0x7f0000000640)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x200) 4m24.213503845s ago: executing program 5 (id=311): rt_sigprocmask(0x0, &(0x7f0000000140)={[0xfffffffffffe]}, 0x0, 0x8) gettid() mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x9, 0x0, 0x0) timer_settime(0x0, 0xffffffffffffffff, &(0x7f00000001c0)={{0x77359400}, {0x0, 0x9}}, 0x0) timer_gettime(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x80, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000004c0)={0x2020, 0x0, 0x0}, 0xb190) write$FUSE_INIT(r0, &(0x7f0000002500)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000002580)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000004580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004640)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000004680)='./file0\x00', 0x20100, 0x44) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, 0x0) 4m24.102618672s ago: executing program 5 (id=312): pipe(&(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0xfff, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 4m23.833806558s ago: executing program 5 (id=314): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80102, 0x0) r0 = socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0) r2 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) syz_open_procfs$namespace(r2, 0x0) ioctl$COMEDI_SETRSUBD(0xffffffffffffffff, 0x6410) write(r1, &(0x7f0000000380)='+192.168.1.1', 0xc) 4m23.759949955s ago: executing program 5 (id=316): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) mount(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) write(r2, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) close(r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000700)=0x2005, 0x4) sendmsg$inet6(r4, &(0x7f0000000740)={&(0x7f0000000780)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1b, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000290000003700000016000000000000008810"], 0x10a0}, 0x34004054) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x5e25, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20008001, &(0x7f0000000080)={0xa, 0x4e22, 0x78a2, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000006780)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000}, 0xb00}], 0x1, 0x0) 4m13.641299172s ago: executing program 1 (id=400): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4a, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x6, 0x200008, 0x7, 0x20001}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r1], 0x4c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fstat(r3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) 4m3.086256881s ago: executing program 1 (id=403): syz_open_dev$dvb_demux(&(0x7f0000000900), 0x0, 0x2000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = gettid() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0xffffffffffffffff) readv(r2, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/255, 0xff}], 0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setsig(r1, 0xa, 0x12) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) r3 = gettid() tkill(r3, 0x13) 4m3.030994657s ago: executing program 35 (id=316): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) mount(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) write(r2, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) close(r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000700)=0x2005, 0x4) sendmsg$inet6(r4, &(0x7f0000000740)={&(0x7f0000000780)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1b, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000290000003700000016000000000000008810"], 0x10a0}, 0x34004054) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x5e25, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20008001, &(0x7f0000000080)={0xa, 0x4e22, 0x78a2, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000006780)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000}, 0xb00}], 0x1, 0x0) 4m3.030680896s ago: executing program 1 (id=410): syz_open_dev$vim2m(0x0, 0x800, 0x2) mmap$binder(&(0x7f00000c0000)=nil, 0x0, 0x1, 0x11, 0xffffffffffffffff, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./proc\x00', &(0x7f0000000840)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000008c0)='270', 0x3) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r2, 0x5, 0x2, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000340)='./mnt\x00', &(0x7f0000000380)='xfs\x00', 0x0, 0x0) 4m2.906028937s ago: executing program 1 (id=413): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000640)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0x1, 0x1, 0x5}}]}}]}, 0x44}}, 0x4084) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000d80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000e40)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0xd, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r8, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xda, 0x6, @multicast}, 0x14) 4m2.699169474s ago: executing program 1 (id=418): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x72, 0x2}, 0x20) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x28, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @remote, @mcast2={0xe}}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc_mnt\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xfa) mount(0x0, &(0x7f0000000180)='./mydev\x00', 0x0, 0x0, 0x0) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) write$sysctl(r1, &(0x7f00000001c0)='5', 0x1) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x8922, &(0x7f0000000200)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}}) syz_emit_ethernet(0x3a, &(0x7f00000002c0)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x2, 0x23, 0x2c, 0x68, 0x0, 0x7, 0x6, 0x0, @remote, @remote, {[@timestamp_prespec={0x44, 0x4, 0x37}]}}, {{0x4e22, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x2, 0x0, 0xe7}}}}}}, 0x0) 4m2.583170416s ago: executing program 1 (id=421): r0 = socket(0x1e, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs_dir\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300001400000011"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001700)=ANY=[@ANYBLOB="140400001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d10300000800034000000001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000001780)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000001800)=ANY=[@ANYBLOB="140000001000000000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) mount(0x0, &(0x7f0000000040)='./tracefs_dir\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000700)=""/4096, 0x1000}], 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r5, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x28, r1, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040}, 0x4040000) 3m47.31252006s ago: executing program 36 (id=421): r0 = socket(0x1e, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs_dir\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300001400000011"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001700)=ANY=[@ANYBLOB="140400001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d10300000800034000000001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000001780)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000001800)=ANY=[@ANYBLOB="140000001000000000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) mount(0x0, &(0x7f0000000040)='./tracefs_dir\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000700)=""/4096, 0x1000}], 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r5, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x28, r1, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040}, 0x4040000) 45.365498011s ago: executing program 0 (id=5274): ioctl$XFS_IOC_FSBULKSTAT(0xffffffffffffffff, 0xc0205865, &(0x7f0000000bc0)={&(0x7f0000000200)=0x81, 0x4, 0x0, 0x0}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f000000040000000800000004"], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r0, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)=r1}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r2, &(0x7f0000000200), 0x0}, 0x20) 45.321952144s ago: executing program 0 (id=5276): ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)={0x5c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7500}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xde}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0xb}}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast=0xffff0011}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 45.291065594s ago: executing program 0 (id=5278): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)="0f", 0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x5, 0x12, r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="85000000ae00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x14, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=[0x0], 0x0, 0x0, 0x200000000000017b}}, 0x40) 45.164582454s ago: executing program 0 (id=5282): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000200)='./file0\x00') mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f00000002c0)='./file0/../file0/../file0\x00', &(0x7f0000000300)='./file0\x00') 45.090747638s ago: executing program 0 (id=5283): syz_open_procfs(0x0, &(0x7f0000000900)='projid_map\x00') r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000640), &(0x7f0000000880)}, 0x20) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000008c0)={r1, &(0x7f0000000900), 0x0, 0x4}, 0x20) 44.990067881s ago: executing program 0 (id=5284): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000400)={0x2, 0x2}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000300), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000340)={0x2, 0xfe}, 0x2) 44.912595572s ago: executing program 37 (id=5284): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000400)={0x2, 0x2}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000300), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000340)={0x2, 0xfe}, 0x2) 35.463671729s ago: executing program 9 (id=5454): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='7', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) 35.412557565s ago: executing program 9 (id=5456): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000100)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1, 0x81, 0x800, {0x0, 0xea60}, {}, {}, 0x1, @can={{0x3, 0x1, 0x1, 0x1}, 0x2, 0x2, 0x0, 0x0, "5e3dba8ae862e81c"}}, 0x48}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="02"], 0x48}, 0x1, 0x0, 0x0, 0x4080}, 0xc084) 35.370708048s ago: executing program 9 (id=5458): socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x10, 0x4, 0x4, 0x8}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0}, 0x0, 0x0}, 0x20) 35.293386624s ago: executing program 9 (id=5461): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x40080, 0x149) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000004c0)={0x2020}, 0x2020) 35.222370677s ago: executing program 9 (id=5464): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@wr_crn={0x67, 0x20, {0x8, 0xa618}}], 0x20}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 34.753935878s ago: executing program 9 (id=5474): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000020000850000001b000000b700000000000000180100002120732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 34.60192042s ago: executing program 38 (id=5474): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000020000850000001b000000b700000000000000180100002120732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 3.180014961s ago: executing program 6 (id=5980): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sched_setscheduler(0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000480)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000640)) timer_settime(0x0, 0x0, &(0x7f0000000680)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000380)={&(0x7f00000003c0)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, 0x0, 0x0, &(0x7f00000004c0)=[{0x18, 0x110, 0x1, "01"}], 0x18}, 0x0) 3.039114195s ago: executing program 6 (id=5981): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001440)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001480)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f00000014c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 2.968415202s ago: executing program 6 (id=5982): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) 2.968201839s ago: executing program 6 (id=5983): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}, {0x0, 0x3}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1100, 0x1000}}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtclass={0x24, 0x29, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x0) 2.896867623s ago: executing program 6 (id=5984): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000003c0)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) 2.754242763s ago: executing program 6 (id=5985): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='+p', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/ttyUSB0\x00', 0x2, 0x0) write$vhost_msg_v2(r1, &(0x7f0000000280)={0x2, 0x900, {0x0, 0x0, 0x0, 0x3}}, 0x48) 1.693239979s ago: executing program 8 (id=5999): write$sysctl(0xffffffffffffffff, &(0x7f00000001c0)='1', 0x1) r0 = openat$tun(0xffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000380)={&(0x7f00000003c0), 0xc, &(0x7f0000000400)={&(0x7f0000000440)=@setlink={0x20, 0x13, 0x5, 0x70bc95, 0x0, {0x0, 0x0, 0x0, r2, 0x1, 0x1}}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000580)={&(0x7f00000005c0), 0xc, &(0x7f0000000600)={&(0x7f0000000640)=@setlink={0x20, 0x13, 0x5, 0x70bc97, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}, 0x20}}, 0x0) write$tun(r0, &(0x7f0000000a40)={@void, @void, @ipv4=@udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @rand_addr=0x64010102}, {0x4e20, 0x4e21, 0x8}}}, 0x1c) 1.547715995s ago: executing program 2 (id=6001): close(0x3) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000780)={0x0, 0x10, &(0x7f0000000b00)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000b40)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000b80)={r2, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000c40)=0x84) sendmmsg$inet_sctp(r0, &(0x7f0000000c80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) 1.547483197s ago: executing program 8 (id=6002): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) fcntl$setstatus(r0, 0x4, 0x800) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @remote}, 0x10) getsockopt$inet_mptcp_MPTCP_INFO(r0, 0x11c, 0x1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000340)=0x60) sendto$inet(r0, 0x0, 0x0, 0x40, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), r2) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x40, r3, 0x5, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, r1}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x40}}, 0x0) 1.435164596s ago: executing program 2 (id=6004): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.434952436s ago: executing program 8 (id=6005): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000a9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mount(0x0, 0x0, &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys_dbg/bus/usb/devices/usb5/authorized_default\x00', 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b80, &(0x7f0000000040)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399}) syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2802) io_uring_enter(r0, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x18) 1.156039874s ago: executing program 2 (id=6006): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x40) write(r0, &(0x7f0000000180)='27', 0x2) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setxattr$incfs_size(0x0, 0x0, 0x0, 0x0, 0x6) syz_io_uring_setup(0xd3a, &(0x7f0000000280)={0x0, 0x8000002, 0x3a10, 0x3, 0x3}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) 1.069597987s ago: executing program 2 (id=6007): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='27', 0x2) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x54, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r1, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=t', 0x31) 818.157015ms ago: executing program 2 (id=6010): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000580)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x118) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000640)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b23000d"], 0xffdd) 665.625322ms ago: executing program 7 (id=6011): sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000003c0)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) 665.336967ms ago: executing program 2 (id=6012): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000002c0)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x400, 0x7ffffffffffffffe, 0x10000000014, 0x100, 0x9, 0x1000, 0x100, 0x10, 0x4, 0x7ffffffffffffffd, 0x1, 0x0, 0x3, 0x7, 0x6], 0x0, 0x110900}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 487.610242ms ago: executing program 7 (id=6013): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100', 0x3) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) mount(0x0, 0x0, 0x0, 0xa70040, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) 437.686771ms ago: executing program 7 (id=6014): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000440)={@in={{0x2, 0x4e22, @local}}, 0x0, 0x0, 0x33, 0x0, "cebd7ceedb7b0ad952e966bbe242b92b746b023df2cb59e32e10366456deac64e782206bd4aee372005a52a40b7161161a8b2749fe184fb0d08bc63f90010a1ed2bf603d2c3fcc250c30136f9ef2ef8b"}, 0xd8) sendto$inet(r0, &(0x7f0000000540), 0xffffffffffffff94, 0x0, 0x0, 0x11) shutdown(r0, 0x1) recvfrom$inet(r0, &(0x7f0000000580)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) 233.561731ms ago: executing program 7 (id=6015): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f00000002c0)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000340)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) shutdown(r0, 0x0) 165.743472ms ago: executing program 8 (id=6016): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000540)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt\x00', 0x1ff) mount(&(0x7f00000005c0)=@filename='./dev/sda1\x00', &(0x7f0000000600)='./mnt\x00', &(0x7f0000000640)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000680)='./mnt\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./mnt\x00', 0x0, 0x21) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)=@v1={0x0, @aes128, 0x10, @desc1}) 99.946028ms ago: executing program 7 (id=6017): r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000040)=0x8, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xff59, 0x0, 0x0, &(0x7f0000000380)}, 0x80) write(r0, &(0x7f0000000000)="01", 0x1) 99.659691ms ago: executing program 8 (id=6018): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000200)="662e0f1f84", 0x5) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x7, 0x12, r1, 0x0) mprotect(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x5) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x2, 0x3, &(0x7f00000003c0)=@framed, &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000008c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x1}}, 0x40) close_range(r0, 0xffffffffffffffff, 0x3f00000000000000) 64.354064ms ago: executing program 7 (id=6019): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e20, @local}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @remote}, 0x10) syz_extract_tcp_res$synack(&(0x7f0000000200)={0x0, 0x0}, 0x1, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000240)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x64, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4e20, 0x44434241, r1, 0x0, 0x0, 0x8, 0x12, 0x1000, 0x0, 0x0, {[@mptcp=@capable_synack={0x1e, 0xc, 0x1, 0x0, 0xa1, 0x1122334455665788}]}}}}}}}, 0x0) sendto$inet(r0, &(0x7f0000000380)='EF', 0x2, 0x40, 0x0, 0x0) 0s ago: executing program 8 (id=6020): r0 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) write(0xffffffffffffffff, &(0x7f0000001000)="4f4f4f4fffffffff000000010000028000000168", 0x14) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x59, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@userptr={0x0, 0x1, 0x400000, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000401000)}, 0x400000}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f00000001c0)=0x2) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000200)=0x1) kernel console output (not intermixed with test programs): =1 [ 300.647516][ T5893] usb 13-1: new high-speed USB device number 21 using dummy_hcd [ 300.763885][T19820] ip_tables: iptables: counters copy to user failed while replacing table [ 300.796430][ T5893] usb 13-1: Using ep0 maxpacket: 8 [ 300.799148][ T5893] usb 13-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 300.801267][ T5893] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 300.801339][ T5893] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 300.801352][ T5893] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 300.801363][ T5893] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 300.801373][ T5893] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 300.801391][ T5893] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.924061][T19830] ima: Unable to open file: / (-22) [ 300.924334][T19829] ima: policy update failed [ 300.924617][ T43] audit: type=1802 audit(1794392607.704:1142): pid=19829 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.6.5137" res=0 errno=-22 [ 300.961833][T19833] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 300.963067][ T43] audit: type=1400 audit(1794392607.744:1143): avc: denied { mounton } for pid=19832 comm="syz.6.5138" path="/1183/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 301.322164][T19843] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 301.396338][ T1938] usb 11-1: new high-speed USB device number 21 using dummy_hcd [ 301.547471][ T1938] usb 11-1: Using ep0 maxpacket: 8 [ 301.548142][ T1938] usb 11-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 301.549383][ T1938] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 301.549453][ T1938] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 301.549465][ T1938] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 301.549475][ T1938] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 301.549486][ T1938] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 301.549504][ T1938] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.571893][T19858] usbtmc 13-1:16.0: simple usb_control_msg failed -32 [ 301.573372][ T5893] usb 13-1: USB disconnect, device number 21 [ 301.760569][ T1938] usb 11-1: usb_control_msg returned -32 [ 301.760640][ T1938] usbtmc 11-1:16.0: can't read capabilities [ 301.914456][ T43] audit: type=1400 audit(1794392608.694:1144): avc: denied { setopt } for pid=19876 comm="syz.0.5159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 302.138129][T19893] device-mapper: table: 248:12: multipath: invalid number of feature args (-EINVAL) [ 302.138144][T19893] device-mapper: ioctl: error adding target to table [ 302.283630][ T43] audit: type=1400 audit(1794392609.064:1145): avc: denied { write } for pid=19908 comm="syz.8.5171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 302.324408][ T11] usb 11-1: USB disconnect, device number 21 [ 302.340165][T19909] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 302.602353][T19921] SELinux: Context system_u:object_r:modem_device_t:s0 is not valid (left unmapped). [ 302.604233][ T43] audit: type=1400 audit(1794392609.384:1146): avc: denied { relabelto } for pid=19920 comm="syz.0.5176" name="file0" dev="tmpfs" ino=6892 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:modem_device_t:s0" [ 302.606761][ T43] audit: type=1400 audit(1794392609.394:1147): avc: denied { associate } for pid=19920 comm="syz.0.5176" name="file0" dev="tmpfs" ino=6892 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:modem_device_t:s0" [ 302.814310][T19936] ecryptfs_get_tree: kern_path() failed [ 302.817164][T19936] Reading sb failed; rc = [-2] [ 302.924513][T19946] vcan0: tx drop: invalid sa for name 0x0102030405060708 [ 303.110181][ T43] audit: type=1400 audit(1794392609.894:1148): avc: denied { mount } for pid=19957 comm="syz.8.5194" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 303.132008][ T43] audit: type=1400 audit(1794392609.914:1149): avc: denied { unmount } for pid=8122 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 303.224632][T19971] loop6: detected capacity change from 0 to 1 [ 303.233713][T19971] Dev loop6: unable to read RDB block 1 [ 303.233735][T19971] loop6: unable to read partition table [ 303.233821][T19971] loop6: partition table beyond EOD, truncated [ 303.233841][T19971] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 303.249442][ C0] operation not supported error, dev loop6, sector 0 op 0x9:(WRITE_ZEROES) flags 0x20800800 phys_seg 0 prio class 2 [ 303.305703][ T43] audit: type=1400 audit(1794392610.084:1150): avc: denied { ioctl } for pid=19974 comm="syz.0.5201" path="socket:[88609]" dev="sockfs" ino=88609 ioctlcmd=0x8b32 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 303.437377][ T43] audit: type=1400 audit(1794392610.214:1151): avc: denied { append } for pid=19989 comm="syz.8.5208" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 303.645311][T20012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.647203][T20012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.694847][T20017] could not open pipe file descriptor [ 303.776395][ T11] usb 11-1: new high-speed USB device number 22 using dummy_hcd [ 303.927321][ T11] usb 11-1: New USB device found: idVendor=0b48, idProduct=1005, bcdDevice=1.00 [ 303.928631][ T11] usb 11-1: config 1 interface 1 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 303.928656][ T11] usb 11-1: config 1 interface 1 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 303.928677][ T11] usb 11-1: config 1 interface 1 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 303.930439][ T11] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 303.930459][ T11] usb 11-1: Product: syz [ 303.930472][ T11] usb 11-1: Manufacturer: syz [ 304.136824][T19997] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 304.136891][T19997] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 304.153932][ T11] dvb_ttusb_budget: ttusb_init_controller: error [ 304.153969][ T11] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 304.189992][ T11] DVB: Unable to find symbol cx22700_attach() [ 304.211608][ T11] DVB: Unable to find symbol tda10046_attach() [ 304.211622][ T11] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 304.363926][ T11] usb 11-1: USB disconnect, device number 22 [ 304.886323][ T5985] usb 13-1: new high-speed USB device number 22 using dummy_hcd [ 305.036790][ T5985] usb 13-1: Using ep0 maxpacket: 8 [ 305.037883][ T5985] usb 13-1: New USB device found: idVendor=046d, idProduct=c623, bcdDevice=0.00 [ 305.039591][ T5985] usb 13-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.039617][ T5985] usb 13-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.039632][ T5985] usb 13-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 305.039648][ T5985] usb 13-1: config 0 interface 0 has no altsetting 0 [ 305.039672][ T5985] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.043363][ T5985] usb 13-1: config 0 descriptor?? [ 305.356468][ T11] usb 11-1: new high-speed USB device number 23 using dummy_hcd [ 305.371272][T20099] fuse: fd is not a fuse device [ 305.462785][ T5985] input: HID 046d:c623 as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/0003:046D:C623.0006/input/input24 [ 305.510346][ T11] usb 11-1: Using ep0 maxpacket: 8 [ 305.512890][ T11] usb 11-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 305.513739][ T11] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 305.513762][ T11] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 305.513773][ T11] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 305.513783][ T11] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 305.513793][ T11] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 305.513811][ T11] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.558993][ T5985] logitech 0003:046D:C623.0006: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 046d:c623] on usb-dummy_hcd.8-1/input0 [ 305.681270][ T7488] usb 13-1: USB disconnect, device number 22 [ 305.729286][ T11] usb 11-1: GET_CAPABILITIES returned 0 [ 305.729311][ T11] usbtmc 11-1:16.0: can't read capabilities [ 305.930213][ T5985] usb 11-1: USB disconnect, device number 23 [ 306.273464][ T6488] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.359589][ T6488] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.454870][ T6488] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.503657][ T5786] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 306.511490][ T5786] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 306.512915][ T5786] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 306.513520][ T5786] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 306.513922][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 306.538080][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 306.540110][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 306.540451][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 306.541902][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 306.542375][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 306.588719][ T6488] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.897049][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 306.897066][ T43] audit: type=1400 audit(1794392613.684:1154): avc: denied { write } for pid=20180 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 306.939363][ T43] audit: type=1400 audit(1794392613.724:1155): avc: denied { lock } for pid=20184 comm="syz.6.5291" path="/1201/file0/file0" dev="9p" ino=72095473 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 307.015598][ T43] audit: type=1400 audit(1794392613.794:1156): avc: denied { write } for pid=20186 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 307.083865][ T6488] bond1 (unregistering): (slave bridge2): Releasing active interface [ 307.103491][ T6488] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 307.104585][ T6488] bond0 (unregistering): Released all slaves [ 307.119315][ T6488] bond1 (unregistering): Released all slaves [ 307.143157][ T6488] bond2 (unregistering): (slave veth3): Releasing backup interface [ 307.145965][ T6488] bond2 (unregistering): (slave dummy0): Releasing backup interface [ 307.167432][ T6488] bond2 (unregistering): Released all slaves [ 307.177819][ T5497] 8021q: adding VLAN 0 to HW filter on device eth23 [ 307.193395][T20160] rxe_eth0 speed is unknown, defaulting to 1000 [ 307.257734][ T6488] tipc: Left network mode [ 307.291041][T20203] overlayfs: failed to clone upperpath [ 307.353028][T20160] wlan1 speed is unknown, defaulting to 1000 [ 307.381778][ T43] audit: type=1400 audit(1794392614.164:1157): avc: denied { write } for pid=20204 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 307.430829][ T43] audit: type=1400 audit(1794392614.214:1158): avc: denied { write } for pid=20210 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 307.489279][ T5497] 8021q: adding VLAN 0 to HW filter on device eth24 [ 307.690747][ T43] audit: type=1400 audit(1794392614.474:1159): avc: denied { write } for pid=20219 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 307.775076][ T43] audit: type=1400 audit(1794392614.554:1160): avc: denied { write } for pid=20230 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 307.871985][ T5497] 8021q: adding VLAN 0 to HW filter on device eth25 [ 307.924869][ T6488] hsr_slave_0: left promiscuous mode [ 307.925321][ T6488] hsr_slave_1: left promiscuous mode [ 307.946829][ T6488] veth1_macvtap: left promiscuous mode [ 307.946865][ T6488] veth0_macvtap: left promiscuous mode [ 307.947204][ T6488] veth1_vlan: left promiscuous mode [ 308.108749][ T7917] smc: removing ib device syz2 [ 308.308081][T20267] smpboot: CPU 3 is now offline [ 308.373888][T20270] smpboot: Booting Node 0 Processor 3 APIC 0x3 [ 308.600821][ T1938] infiniband syz2: ib_query_port failed (-19) [ 308.636654][ T5784] Bluetooth: hci2: command tx timeout [ 308.711920][ T7917] smbdirect: ib_dev[syz2] removed [ 308.792569][ T43] audit: type=1400 audit(1794392615.574:1161): avc: denied { write } for pid=20290 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 308.855110][T20160] bridge0: port 1(bridge_slave_0) entered blocking state [ 308.855238][T20160] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.855314][T20160] bridge_slave_0: entered allmulticast mode [ 308.874647][T20160] bridge_slave_0: entered promiscuous mode [ 308.878463][T20160] bridge0: port 2(bridge_slave_1) entered blocking state [ 308.878504][T20160] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.878644][T20160] bridge_slave_1: entered allmulticast mode [ 308.882294][T20160] bridge_slave_1: entered promiscuous mode [ 308.916816][ T43] audit: type=1400 audit(1794392615.694:1162): avc: denied { write } for pid=20300 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 308.947499][T20160] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 308.950019][T20160] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 308.989531][ T5497] 8021q: adding VLAN 0 to HW filter on device eth26 [ 309.011038][T20160] team0: Port device team_slave_0 added [ 309.012934][T20160] team0: Port device team_slave_1 added [ 309.079540][T20160] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 309.079552][T20160] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 309.079564][T20160] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 309.080311][T20160] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 309.080319][T20160] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 309.080331][T20160] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 309.133442][T20160] hsr_slave_0: entered promiscuous mode [ 309.133964][T20160] hsr_slave_1: entered promiscuous mode [ 309.382136][ T6488] IPVS: stop unused estimator thread 0... [ 309.422151][T20160] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 309.424554][T20160] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 309.424986][T20160] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 309.426854][T20160] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 309.427277][T20160] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 309.429364][T20160] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 309.429765][T20160] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 309.431342][T20160] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 309.452138][T20160] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.452186][T20160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.452293][T20160] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.452342][T20160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.494818][T20160] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.504014][ T7917] bridge0: port 1(bridge_slave_0) entered disabled state [ 309.504572][ T7917] bridge0: port 2(bridge_slave_1) entered disabled state [ 309.516893][T20160] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.521755][ T7917] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.521834][ T7917] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.525703][ T7917] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.525776][ T7917] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.660194][T20320] ip_tables: iptables: counters copy to user failed while replacing table [ 309.811588][ T43] audit: type=1400 audit(1794392616.594:1163): avc: denied { getopt } for pid=20331 comm="syz.6.5336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 309.848462][T20160] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.021540][T20160] veth0_vlan: entered promiscuous mode [ 310.030193][T20160] veth1_vlan: entered promiscuous mode [ 310.049167][T20160] veth0_macvtap: entered promiscuous mode [ 310.051420][T20160] veth1_macvtap: entered promiscuous mode [ 310.058678][T20160] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 310.065622][T20160] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 310.087880][ T14] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.087909][ T14] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.087927][ T14] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.087993][ T14] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.174284][ T7924] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.174296][ T7924] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.204873][ T1171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.204886][ T1171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.409193][T20351] FAULT_INJECTION: forcing a failure. [ 310.409193][T20351] name failslab, interval 1, probability 0, space 0, times 0 [ 310.409217][T20351] CPU: 0 UID: 0 PID: 20351 Comm: syz.6.5339 Tainted: G L syzkaller #0 PREEMPT(full) [ 310.409232][T20351] Tainted: [L]=SOFTLOCKUP [ 310.409236][T20351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 310.409242][T20351] Call Trace: [ 310.409255][T20351] [ 310.409259][T20351] dump_stack_lvl+0x100/0x190 [ 310.409309][T20351] should_fail_ex.cold+0x5/0xa [ 310.409326][T20351] should_failslab+0xc2/0x120 [ 310.409356][T20351] __kmalloc_cache_noprof+0x91/0x6d0 [ 310.409373][T20351] ? snd_ctl_open+0x14f/0x5a0 [ 310.409416][T20351] snd_ctl_open+0x14f/0x5a0 [ 310.409432][T20351] ? __pfx_snd_ctl_open+0x10/0x10 [ 310.409448][T20351] snd_open+0x201/0x450 [ 310.409460][T20351] ? __pfx_snd_open+0x10/0x10 [ 310.409470][T20351] chrdev_open+0x234/0x6a0 [ 310.409486][T20351] ? __pfx_chrdev_open+0x10/0x10 [ 310.409500][T20351] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 310.409515][T20351] do_dentry_open+0x674/0x1470 [ 310.409528][T20351] ? __pfx_chrdev_open+0x10/0x10 [ 310.409543][T20351] vfs_open_consume+0xcc/0x460 [ 310.409561][T20351] path_openat+0x1547/0x23f0 [ 310.409577][T20351] ? __pfx_path_openat+0x10/0x10 [ 310.409595][T20351] do_file_open+0x20e/0x430 [ 310.409609][T20351] ? __pfx_do_file_open+0x10/0x10 [ 310.409632][T20351] ? _raw_spin_unlock+0x28/0x50 [ 310.409669][T20351] ? alloc_fd+0x471/0x7a0 [ 310.409688][T20351] do_sys_openat2+0x163/0x1d0 [ 310.409704][T20351] ? __pfx_do_sys_openat2+0x10/0x10 [ 310.409719][T20351] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 310.409742][T20351] __x64_sys_openat+0x12d/0x210 [ 310.409757][T20351] ? __pfx___x64_sys_openat+0x10/0x10 [ 310.409779][T20351] do_syscall_64+0x123/0x7b0 [ 310.409794][T20351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.409806][T20351] RIP: 0033:0x7f41c416974e [ 310.409824][T20351] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 310.409835][T20351] RSP: 002b:00007f41c50d5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 310.409848][T20351] RAX: ffffffffffffffda RBX: 00007f41c50d66c0 RCX: 00007f41c416974e [ 310.409855][T20351] RDX: 0000000000000000 RSI: 00007f41c50d5c00 RDI: ffffffffffffff9c [ 310.409863][T20351] RBP: 00007f41c50d5c00 R08: 0000000000000000 R09: 0000000000000000 [ 310.409870][T20351] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 310.409876][T20351] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 310.409892][T20351] [ 310.455986][T20353] Format for adding new device is "id port_count num_queues" (uint uint uint). [ 310.716415][ T5784] Bluetooth: hci2: command tx timeout [ 310.908661][T20384] bonding: b is being created... [ 311.556643][ T2256] usb 14-1: new high-speed USB device number 2 using dummy_hcd [ 311.690243][T20410] tipc: Resetting bearer [ 311.707154][ T2256] usb 14-1: Using ep0 maxpacket: 8 [ 311.707865][ T2256] usb 14-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 311.709851][ T2256] usb 14-1: config index 0 descriptor too short (expected 301, got 45) [ 311.710126][ T2256] usb 14-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 311.710143][ T2256] usb 14-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 311.710162][ T2256] usb 14-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 311.710180][ T2256] usb 14-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 311.710211][ T2256] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.763255][T20410] tipc: Resetting bearer [ 311.923260][ T2256] usb 14-1: usb_control_msg returned -32 [ 311.923301][ T2256] usbtmc 14-1:16.0: can't read capabilities [ 312.043441][T20410] batadv0: left allmulticast mode [ 312.284804][T20443] usbtmc 14-1:16.0: INITIATE_CLEAR returned 0 [ 312.303664][T20447] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 312.408828][T20456] ubi16: attaching mtd0 [ 312.408844][T20456] ubi16 error: ubi_attach_mtd_dev: bad VID header (268435458) or data offsets (268435522) [ 312.477876][ T965] usb 14-1: USB disconnect, device number 2 [ 312.551964][T20463] overlayfs: failed to clone upperpath [ 312.796642][ T5784] Bluetooth: hci2: command tx timeout [ 312.844809][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 312.844826][ T43] audit: type=1400 audit(1794392619.624:1167): avc: denied { remount } for pid=20476 comm="syz.8.5393" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 313.057025][ T965] usb 11-1: new high-speed USB device number 24 using dummy_hcd [ 313.209263][ T965] usb 11-1: New USB device found: idVendor=1199, idProduct=b000, bcdDevice=0.00 [ 313.212325][ T965] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 313.212341][ T965] usb 11-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 313.212358][ T965] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.313490][ T43] audit: type=1400 audit(1794392620.094:1168): avc: denied { unmount } for pid=20160 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 313.380691][T20513] macvlan0: entered promiscuous mode [ 313.444310][ T965] usb 11-1: USB disconnect, device number 24 [ 313.814079][T20538] misc userio: Begin command sent, but we're already running [ 314.126409][ T5985] usb 13-1: new high-speed USB device number 23 using dummy_hcd [ 314.276273][ T5985] usb 13-1: Using ep0 maxpacket: 8 [ 314.276763][ T5985] usb 13-1: New USB device found: idVendor=04d8, idProduct=00dd, bcdDevice=0.00 [ 314.277726][ T5985] usb 13-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 314.277741][ T5985] usb 13-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 314.277752][ T5985] usb 13-1: config 0 interface 0 has no altsetting 0 [ 314.277767][ T5985] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.282603][ T5985] usb 13-1: config 0 descriptor?? [ 314.702700][ T5985] hid_parser_main: 3 callbacks suppressed [ 314.702722][ T5985] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 314.702744][ T5985] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 314.702763][ T5985] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 314.702782][ T5985] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 314.702801][ T5985] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 314.704057][ T5985] mcp2221 0003:04D8:00DD.0007: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.8-1/input0 [ 314.876727][ T5784] Bluetooth: hci2: command tx timeout [ 314.911912][ T7488] usb 13-1: USB disconnect, device number 23 [ 315.126986][ T2256] usb 2-1: new high-speed USB device number 3 using ehci-pci [ 315.307619][ T2256] usb 2-1: New USB device found: idVendor=0627, idProduct=0001, bcdDevice=0.00 [ 315.321624][ T2256] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 315.321640][ T2256] usb 2-1: Product: QEMU USB Tablet [ 315.321647][ T2256] usb 2-1: Manufacturer: QEMU [ 315.321655][ T2256] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 315.324306][T20581] macvtap1: entered promiscuous mode [ 315.324389][T20581] macvtap1: entered allmulticast mode [ 315.324396][T20581] veth1_vlan: entered allmulticast mode [ 315.361133][ T2256] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/0003:0627:0001.0008/input/input27 [ 315.426777][ T2256] hid-generic 0003:0627:0001.0008: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 315.476008][ T43] audit: type=1400 audit(1794392622.254:1169): avc: denied { write } for pid=20584 comm="syz.8.5442" name="bcdDevice" dev="configfs" ino=92439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 315.477332][ T43] audit: type=1400 audit(1794392622.264:1170): avc: denied { open } for pid=20584 comm="syz.8.5442" path="/1083/config/usb_gadget/g1/bcdDevice" dev="configfs" ino=92439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 315.478894][ T43] audit: type=1400 audit(1794392622.264:1171): avc: denied { read } for pid=20584 comm="syz.8.5442" name="bcdDevice" dev="configfs" ino=92439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 315.917989][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880400a9800: rx timeout, send abort [ 315.918389][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880400a9800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 315.996298][ T42] usb 13-1: new high-speed USB device number 24 using dummy_hcd [ 315.997569][ T43] audit: type=1400 audit(1794392622.784:1172): avc: denied { mounton } for pid=20625 comm="syz.6.5459" path="/proc/2817" dev="proc" ino=92487 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 316.005399][ T43] audit: type=1400 audit(1794392622.784:1173): avc: denied { read } for pid=20629 comm="syz.9.5461" name="trace_pipe_raw" dev="tracefs" ino=6475 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 316.005648][ T43] audit: type=1400 audit(1794392622.784:1174): avc: denied { open } for pid=20629 comm="syz.9.5461" path="/41/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=6475 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 316.029111][T20628] ref_ctr_offset mismatch. inode: 0x1f80 offset: 0x0 ref_ctr_offset(old): 0x20040 ref_ctr_offset(new): 0x0 [ 316.077776][ T43] audit: type=1400 audit(1794392622.854:1175): avc: denied { write } for pid=20160 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 316.080829][ T43] audit: type=1400 audit(1794392622.864:1176): avc: denied { setattr } for pid=20160 comm="syz-executor" path="/41/tracing/instances" dev="tracefs" ino=6532 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 316.148301][ T42] usb 13-1: Using ep0 maxpacket: 8 [ 316.149027][ T42] usb 13-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 316.149928][ T42] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 316.149951][ T42] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 316.149961][ T42] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 316.149972][ T42] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 316.149983][ T42] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 316.150001][ T42] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.360563][ T42] usb 13-1: GET_CAPABILITIES returned 0 [ 316.360588][ T42] usbtmc 13-1:16.0: can't read capabilities [ 316.567115][ T5884] usb 13-1: USB disconnect, device number 24 [ 316.639025][ T14] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.776665][T20665] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5479'. [ 316.780216][ T5786] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 316.795835][ T14] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.801974][ T5786] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 316.807704][ T5786] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 316.814252][ T5786] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 316.820988][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 316.921355][ T14] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.998900][ T14] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.037765][ T1448] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.037796][ T1448] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.186451][T20696] size and base must be multiples of 4 kiB [ 317.186466][T20696] CPU: 3 UID: 0 PID: 20696 Comm: syz.6.5490 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.186503][T20696] Tainted: [L]=SOFTLOCKUP [ 317.186508][T20696] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 317.186514][T20696] Call Trace: [ 317.186519][T20696] [ 317.186525][T20696] dump_stack_lvl+0x100/0x190 [ 317.186546][T20696] mtrr_del.cold+0x72/0x85 [ 317.186558][T20696] mtrr_ioctl+0xbc8/0xcf0 [ 317.186572][T20696] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 317.186609][T20696] ? __pfx_mtrr_ioctl+0x10/0x10 [ 317.186622][T20696] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 317.186637][T20696] ? __fget_files+0x34/0x3d0 [ 317.186658][T20696] ? __pfx_mtrr_ioctl+0x10/0x10 [ 317.186672][T20696] proc_reg_unlocked_ioctl+0x229/0x320 [ 317.186699][T20696] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 317.186712][T20696] __x64_sys_ioctl+0x18e/0x210 [ 317.186726][T20696] do_syscall_64+0x123/0x7b0 [ 317.186742][T20696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.186754][T20696] RIP: 0033:0x7f41c41a8f19 [ 317.186764][T20696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 317.186774][T20696] RSP: 002b:00007f41c50d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 317.186785][T20696] RAX: ffffffffffffffda RBX: 00007f41c4425fa0 RCX: 00007f41c41a8f19 [ 317.186792][T20696] RDX: 0000200000000a00 RSI: 0000000040104d04 RDI: 0000000000000003 [ 317.186798][T20696] RBP: 00007f41c4237f6d R08: 0000000000000000 R09: 0000000000000000 [ 317.186805][T20696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 317.186811][T20696] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 317.186825][T20696] [ 317.283176][ T42] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 317.294368][T20662] rxe_eth0 speed is unknown, defaulting to 1000 [ 317.313581][T20699] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5492'. [ 317.313598][T20699] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5492'. [ 317.353938][ T14] bridge_slave_1: left allmulticast mode [ 317.353956][ T14] bridge_slave_1: left promiscuous mode [ 317.354115][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.357517][ T42] hid-generic 0000:0000:0000.0009: hidraw1: HID v0.00 Device [syz1] on syz0 [ 317.371624][ T14] bridge_slave_0: left allmulticast mode [ 317.371649][ T14] bridge_slave_0: left promiscuous mode [ 317.371847][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.469299][T20701] fido_id[20701]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 317.592825][ T14] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 317.604229][ T14] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 317.605095][ T14] bond0 (unregistering): Released all slaves [ 317.610843][ T14] b (unregistering): Released all slaves [ 317.639300][T20662] wlan1 speed is unknown, defaulting to 1000 [ 317.874531][ T5497] 8021q: adding VLAN 0 to HW filter on device eth27 [ 317.909238][ T5985] usb 11-1: new high-speed USB device number 25 using dummy_hcd [ 317.963038][T20662] bridge0: port 1(bridge_slave_0) entered blocking state [ 317.963159][T20662] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.963304][T20662] bridge_slave_0: entered allmulticast mode [ 317.973420][T20662] bridge_slave_0: entered promiscuous mode [ 317.977394][T20662] bridge0: port 2(bridge_slave_1) entered blocking state [ 317.979243][T20662] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.979321][T20662] bridge_slave_1: entered allmulticast mode [ 317.980326][T20662] bridge_slave_1: entered promiscuous mode [ 318.024644][T20662] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 318.037290][T20662] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 318.094422][ T5985] usb 11-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 318.095394][ T5985] usb 11-1: config 1 has an invalid interface number: 3 but max is 0 [ 318.095414][ T5985] usb 11-1: config 1 has no interface number 0 [ 318.108571][ T5985] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.108593][ T5985] usb 11-1: Product: syz [ 318.108605][ T5985] usb 11-1: Manufacturer: syz [ 318.108618][ T5985] usb 11-1: SerialNumber: syz [ 318.173205][T20662] team0: Port device team_slave_0 added [ 318.173566][ T43] kauditd_printk_skb: 105 callbacks suppressed [ 318.173577][ T43] audit: type=1400 audit(1794392624.954:1282): avc: denied { write } for pid=20756 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.193297][ T5985] usb 11-1: 3:0 : does not exist [ 318.193319][ T5985] usb 11-1: 3:0 : does not exist [ 318.195227][T20662] team0: Port device team_slave_1 added [ 318.240229][ T43] audit: type=1400 audit(1794392625.024:1283): avc: denied { write } for pid=20762 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.284020][ T43] audit: type=1326 audit(1794392625.064:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20766 comm="syz.7.5513" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0c5e5a8f19 code=0x0 [ 318.293872][ T14] hsr_slave_0: left promiscuous mode [ 318.294929][ T14] hsr_slave_1: left promiscuous mode [ 318.295341][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 318.295352][ T14] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 318.296846][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 318.296860][ T14] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 318.329947][ T14] veth1_vlan: left allmulticast mode [ 318.330165][ T14] veth1_macvtap: left promiscuous mode [ 318.330192][ T14] veth0_macvtap: left promiscuous mode [ 318.330297][ T14] veth1_vlan: left promiscuous mode [ 318.330558][ T14] veth0_vlan: left promiscuous mode [ 318.578734][ T14] team0 (unregistering): Port device team_slave_1 removed [ 318.594811][ T14] team0 (unregistering): Port device team_slave_0 removed [ 318.704270][T20662] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 318.704282][T20662] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.704295][T20662] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 318.705345][ T5497] 8021q: adding VLAN 0 to HW filter on device eth28 [ 318.734083][T20662] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 318.734095][T20662] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.734107][T20662] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 318.765355][T20662] hsr_slave_0: entered promiscuous mode [ 318.766119][T20662] hsr_slave_1: entered promiscuous mode [ 318.877768][ T5784] Bluetooth: hci2: command tx timeout [ 318.967142][ T43] audit: type=1400 audit(1794392625.754:1285): avc: denied { write } for pid=20775 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.069805][ T43] audit: type=1400 audit(1794392625.854:1286): avc: denied { write } for pid=20783 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.215935][ T5497] 8021q: adding VLAN 0 to HW filter on device eth29 [ 319.341586][ T43] audit: type=1400 audit(1794392626.124:1287): avc: denied { write } for pid=20796 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.429807][ T43] audit: type=1400 audit(1794392626.214:1288): avc: denied { write } for pid=20804 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.515295][ T5497] 8021q: adding VLAN 0 to HW filter on device eth30 [ 319.565997][T20662] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 319.573352][T20662] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 319.574498][T20662] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 319.584724][T20662] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 319.585562][T20662] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 319.596382][T20662] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 319.597160][T20662] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 319.600303][T20662] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 319.674004][ T43] audit: type=1400 audit(1794392626.454:1289): avc: denied { write } for pid=20823 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.714607][T20830] macvlan1: entered promiscuous mode [ 319.715922][T20830] macvlan1: left promiscuous mode [ 319.741118][T20662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 319.763493][T20662] 8021q: adding VLAN 0 to HW filter on device team0 [ 319.780733][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.780782][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 319.790463][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 319.790548][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 319.792170][T20834] ip_tables: iptables: counters copy to user failed while replacing table [ 319.821150][ T43] audit: type=1400 audit(1794392626.604:1290): avc: denied { write } for pid=20832 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 320.000507][ T43] audit: type=1400 audit(1794392626.784:1291): avc: denied { write } for pid=20843 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 320.295896][T20662] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 320.354671][T20662] veth0_vlan: entered promiscuous mode [ 320.372300][T20662] veth1_vlan: entered promiscuous mode [ 320.419087][T20662] veth0_macvtap: entered promiscuous mode [ 320.434394][T20662] veth1_macvtap: entered promiscuous mode [ 320.468441][T20662] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 320.492464][T20662] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 320.516600][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.516644][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.516672][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.516700][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.681240][ T42] usb 11-1: USB disconnect, device number 25 [ 320.713323][ T7917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.713343][ T7917] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.860838][ T1172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.860859][ T1172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.881470][T20834] ceph: No mds server is up or the cluster is laggy [ 320.966719][ T5784] Bluetooth: hci2: command tx timeout [ 321.717620][T20934] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=20934 comm=syz.2.5552 [ 322.424302][T20970] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 323.036470][ T5784] Bluetooth: hci2: command tx timeout [ 323.368669][ T43] kauditd_printk_skb: 26 callbacks suppressed [ 323.368688][ T43] audit: type=1400 audit(1794392630.154:1318): avc: denied { write } for pid=20999 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.448561][ T43] audit: type=1400 audit(1794392630.234:1319): avc: denied { write } for pid=21009 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.695932][ T43] audit: type=1400 audit(1794392630.474:1320): avc: denied { write } for pid=21015 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.760711][ T43] audit: type=1400 audit(1794392630.544:1321): avc: denied { write } for pid=21036 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.860335][ T43] audit: type=1400 audit(1794392630.644:1322): avc: denied { setattr } for pid=21043 comm="syz.6.5580" name="trace_pipe" dev="tracefs" ino=6435 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 323.951635][ T43] audit: type=1400 audit(1794392630.724:1323): avc: denied { write } for pid=21040 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 324.066177][ T43] audit: type=1400 audit(1794392630.844:1324): avc: denied { write } for pid=21061 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 324.105070][T21060] device-mapper: table: 248:13: : unknown target type [ 324.105146][T21060] device-mapper: ioctl: error adding target to table [ 324.244759][T21079] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5593'. [ 324.251552][T21079] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5593'. [ 324.296657][ T7493] usb 11-1: new high-speed USB device number 26 using dummy_hcd [ 324.414876][T21092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5598'. [ 324.447823][ T7493] usb 11-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 324.450610][ T7493] usb 11-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 324.450699][ T7493] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 324.450721][ T7493] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 324.450739][ T7493] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 324.450770][ T7493] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.458906][ T7493] usb 11-1: config 0 descriptor?? [ 324.532957][T21096] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 324.643748][ T43] audit: type=1400 audit(1794392631.424:1325): avc: denied { relabelfrom } for pid=21107 comm="syz.2.5604" name="" dev="pipefs" ino=94485 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 324.893355][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893374][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893424][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893437][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893448][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893460][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893471][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893482][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893493][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.893505][ T7493] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 324.913467][ T7493] plantronics 0003:047F:FFFF.000A: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 325.095671][ T7493] usb 11-1: USB disconnect, device number 26 [ 325.117077][ T5784] Bluetooth: hci2: command tx timeout [ 325.552234][T21158] lapbether: lapb_data_request error - 4 [ 325.756143][ T43] audit: type=1400 audit(1794392632.534:1326): avc: denied { map } for pid=21166 comm="syz.8.5630" path="socket:[95298]" dev="sockfs" ino=95298 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 325.780868][T21169] device-mapper: ioctl: Invalid target message parameters. [ 325.952833][T21181] FAULT_INJECTION: forcing a failure. [ 325.952833][T21181] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 325.952861][T21181] CPU: 2 UID: 0 PID: 21181 Comm: syz.6.5637 Tainted: G L syzkaller #0 PREEMPT(full) [ 325.952889][T21181] Tainted: [L]=SOFTLOCKUP [ 325.952897][T21181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 325.952908][T21181] Call Trace: [ 325.952915][T21181] [ 325.952924][T21181] dump_stack_lvl+0x100/0x190 [ 325.952961][T21181] should_fail_ex.cold+0x5/0xa [ 325.953016][T21181] should_fail_alloc_page+0xeb/0x140 [ 325.953044][T21181] prepare_alloc_pages+0x1f0/0x5b0 [ 325.953073][T21181] __alloc_frozen_pages_noprof+0x1b9/0x31e0 [ 325.953111][T21181] ? stack_trace_save+0x8e/0xc0 [ 325.953137][T21181] ? __pfx_stack_trace_save+0x10/0x10 [ 325.953162][T21181] ? stack_depot_save_flags+0x27/0xa10 [ 325.953183][T21181] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 325.953209][T21181] ? kasan_save_stack+0x3f/0x50 [ 325.953229][T21181] ? kasan_save_stack+0x30/0x50 [ 325.953248][T21181] ? kasan_save_track+0x14/0x30 [ 325.953266][T21181] ? __kasan_kmalloc+0xaa/0xb0 [ 325.953285][T21181] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 325.953308][T21181] ? mon_bin_open+0x1a8/0x470 [ 325.953345][T21181] ? chrdev_open+0x234/0x6a0 [ 325.953368][T21181] ? do_dentry_open+0x674/0x1470 [ 325.953388][T21181] ? vfs_open_consume+0xcc/0x460 [ 325.953409][T21181] ? path_openat+0x1547/0x23f0 [ 325.953430][T21181] ? do_file_open+0x20e/0x430 [ 325.953452][T21181] ? do_sys_openat2+0x163/0x1d0 [ 325.953475][T21181] ? __x64_sys_openat+0x12d/0x210 [ 325.953499][T21181] ? do_syscall_64+0x123/0x7b0 [ 325.953521][T21181] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.953555][T21181] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 325.953589][T21181] ? policy_nodemask+0xed/0x5e0 [ 325.953615][T21181] alloc_pages_mpol+0x201/0x560 [ 325.953639][T21181] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 325.953669][T21181] alloc_pages_noprof+0x1a/0x160 [ 325.953695][T21181] get_zeroed_page_noprof+0x18/0xb0 [ 325.953715][T21181] mon_alloc_buff+0xce/0x1b0 [ 325.953737][T21181] mon_bin_open+0x207/0x470 [ 325.953754][T21181] ? __pfx_mon_bin_open+0x10/0x10 [ 325.953772][T21181] chrdev_open+0x234/0x6a0 [ 325.953796][T21181] ? __pfx_chrdev_open+0x10/0x10 [ 325.953820][T21181] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 325.953845][T21181] do_dentry_open+0x674/0x1470 [ 325.953863][T21181] ? __pfx_chrdev_open+0x10/0x10 [ 325.953889][T21181] vfs_open_consume+0xcc/0x460 [ 325.953918][T21181] path_openat+0x1547/0x23f0 [ 325.953947][T21181] ? __pfx_path_openat+0x10/0x10 [ 325.953976][T21181] do_file_open+0x20e/0x430 [ 325.954000][T21181] ? __pfx_do_file_open+0x10/0x10 [ 325.954048][T21181] ? _raw_spin_unlock+0x28/0x50 [ 325.954067][T21181] ? alloc_fd+0x471/0x7a0 [ 325.954097][T21181] do_sys_openat2+0x163/0x1d0 [ 325.954122][T21181] ? __pfx_do_sys_openat2+0x10/0x10 [ 325.954146][T21181] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 325.954182][T21181] __x64_sys_openat+0x12d/0x210 [ 325.954206][T21181] ? __pfx___x64_sys_openat+0x10/0x10 [ 325.954242][T21181] do_syscall_64+0x123/0x7b0 [ 325.954267][T21181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.954285][T21181] RIP: 0033:0x7f41c416974e [ 325.954301][T21181] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 325.954316][T21181] RSP: 002b:00007f41c50d5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 325.954336][T21181] RAX: ffffffffffffffda RBX: 00007f41c50d66c0 RCX: 00007f41c416974e [ 325.954350][T21181] RDX: 0000000000000000 RSI: 00007f41c50d5c00 RDI: ffffffffffffff9c [ 325.954364][T21181] RBP: 00007f41c50d5c00 R08: 0000000000000000 R09: 0000000000000000 [ 325.954376][T21181] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 325.954388][T21181] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 325.954416][T21181] [ 326.585141][T21233] netlink: 'syz.7.5657': attribute type 11 has an invalid length. [ 326.734524][T21241] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 327.086399][ T5884] usb 11-1: new high-speed USB device number 27 using dummy_hcd [ 327.238217][ T5884] usb 11-1: New USB device found: idVendor=06cd, idProduct=0135, bcdDevice=1.00 [ 327.239339][ T5884] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 327.239374][ T5884] usb 11-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 6 [ 327.239404][ T5884] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.244477][ T5884] keyspan 11-1:1.0: Keyspan 2 port adapter converter detected [ 327.244718][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 81 [ 327.244773][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 1 [ 327.247181][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 84 [ 327.247245][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 2 [ 327.249266][ T5884] usb 11-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 327.251890][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 88 [ 327.251950][ T5884] keyspan 11-1:1.0: found no endpoint descriptor for endpoint 6 [ 327.263865][ T5884] usb 11-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 327.553741][T20423] usb 11-1: USB disconnect, device number 27 [ 327.560085][T20423] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 327.562811][T20423] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 327.563083][T20423] keyspan 11-1:1.0: device disconnected [ 327.982005][T21265] kvm: apic: phys broadcast and lowest prio [ 328.149052][T21273] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5676'. [ 328.202836][ T43] audit: type=1400 audit(1794392634.984:1327): avc: denied { append } for pid=21276 comm="syz.6.5678" name="loop5" dev="devtmpfs" ino=661 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 328.215312][T21277] loop5: detected capacity change from 0 to 4095 [ 328.332444][T21277] Buffer I/O error on dev loop5, logical block 511, async page read [ 328.337985][T14328] Buffer I/O error on dev loop5, logical block 511, async page read [ 328.744310][T21308] gadgetfs: bound to dummy_udc driver [ 328.946015][T21320] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 328.967394][T21324] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 328.973714][ T43] audit: type=1400 audit(1794392635.754:1328): avc: denied { write } for pid=21322 comm="syz.2.5699" name="enable" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 329.002844][ T43] audit: type=1400 audit(1794392635.784:1329): avc: denied { getopt } for pid=21325 comm="syz.7.5697" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 329.040478][T21328] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input28 [ 329.074636][T21330] sctp: Failed to create the SCTP UDP tunneling v4 sock [ 329.147659][ T43] audit: type=1400 audit(1794392635.934:1330): avc: denied { write } for pid=21335 comm="syz.2.5703" name="functions" dev="configfs" ino=13814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 329.152700][T21337] LUN: removable file: (no medium) [ 329.229542][T21350] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5709'. [ 329.299917][T21355] device-mapper: ioctl: Empty message received. [ 329.606403][ T965] usb 11-1: new high-speed USB device number 28 using dummy_hcd [ 329.631240][T21390] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5727'. [ 329.756392][ T965] usb 11-1: Using ep0 maxpacket: 8 [ 329.756878][ T965] usb 11-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 329.758176][ T965] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 329.758201][ T965] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 329.758212][ T965] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 329.758223][ T965] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 329.758233][ T965] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 329.758252][ T965] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.806375][ T5884] usb 13-1: new full-speed USB device number 25 using dummy_hcd [ 329.845017][ T43] audit: type=1400 audit(1794392636.624:1331): avc: denied { write } for pid=21395 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 329.911473][ T43] audit: type=1400 audit(1794392636.694:1332): avc: denied { write } for pid=21398 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 329.959848][ T5884] usb 13-1: not running at top speed; connect to a high speed hub [ 329.959877][ T5884] usb 13-1: New USB device found: idVendor=0c4b, idProduct=0100, bcdDevice=1.00 [ 329.961711][ T5884] usb 13-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 14385, setting to 64 [ 329.961748][ T5884] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.966071][T21384] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 329.967352][ T965] usb 11-1: usb_control_msg returned -32 [ 329.967373][ T965] usbtmc 11-1:16.0: can't read capabilities [ 330.009952][ T5884] cyberjack 13-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 330.014725][ T5884] usb 13-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 330.023908][ T965] usb 11-1: USB disconnect, device number 28 [ 330.303701][T21402] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 330.398951][ T50] usb 13-1: USB disconnect, device number 25 [ 330.401902][ T50] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 330.402190][ T50] cyberjack 13-1:1.0: device disconnected [ 330.649527][T21422] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 330.649550][T21422] block device autoloading is deprecated and will be removed. [ 330.726261][T21422] md: md2 stopped. [ 330.766447][ T965] usb 11-1: new high-speed USB device number 29 using dummy_hcd [ 330.917060][ T965] usb 11-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 330.917084][ T965] usb 11-1: too many configurations: 9, using maximum allowed: 8 [ 330.919028][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.919051][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.919101][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.919890][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.919910][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.919922][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.920690][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.920749][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.920762][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.921575][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.921596][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.921656][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.923057][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.923078][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.923090][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.925360][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.925381][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.925393][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.926495][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.926519][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.926531][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.928564][ T965] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.928632][ T965] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.928646][ T965] usb 11-1: config 0 interface 0 has no altsetting 0 [ 330.931716][ T965] usb 11-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 330.931728][ T965] usb 11-1: Product: syz [ 330.931735][ T965] usb 11-1: Manufacturer: syz [ 330.931742][ T965] usb 11-1: SerialNumber: syz [ 330.934582][ T965] usb 11-1: config 0 descriptor?? [ 330.947566][ T965] yurex 11-1:0.0: USB YUREX device now attached to Yurex #0 [ 331.120381][T21430] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input29 [ 331.149988][ T50] usb 11-1: USB disconnect, device number 29 [ 331.152714][ T50] yurex 11-1:0.0: USB YUREX #0 now disconnected [ 331.259478][T21437] device-mapper: table: 248:7: thin-pool: Error opening metadata block device (-ENOENT) [ 331.259493][T21437] device-mapper: ioctl: error adding target to table [ 331.260237][T21437] device-mapper: ioctl: The device has no table. [ 331.573702][T21463] syzkaller1: entered promiscuous mode [ 331.573723][T21463] syzkaller1: entered allmulticast mode [ 331.908933][ T5985] usb 13-1: new high-speed USB device number 26 using dummy_hcd [ 332.057495][ T5985] usb 13-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 332.058391][ T5985] usb 13-1: config 1 has an invalid interface number: 3 but max is 0 [ 332.058403][ T5985] usb 13-1: config 1 has no interface number 0 [ 332.060110][ T5985] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.060123][ T5985] usb 13-1: Product: syz [ 332.060130][ T5985] usb 13-1: Manufacturer: syz [ 332.060137][ T5985] usb 13-1: SerialNumber: syz [ 332.063901][ T5985] usb 13-1: 3:0 : does not exist [ 332.063913][ T5985] usb 13-1: 3:0 : does not exist [ 332.216312][ T79] usb 11-1: new high-speed USB device number 30 using dummy_hcd [ 332.278882][ T965] usb 13-1: USB disconnect, device number 26 [ 332.281631][T21473] fuse: fd is not a fuse device [ 332.345409][ T43] audit: type=1800 audit(1794392639.124:1333): pid=21477 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.7.5765" name="nullb0" dev="tmpfs" ino=8629 res=0 errno=-22 [ 332.376362][ T79] usb 11-1: Using ep0 maxpacket: 32 [ 332.378257][ T79] usb 11-1: New USB device found: idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 332.379153][ T79] usb 11-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 332.379189][ T79] usb 11-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 332.379202][ T79] usb 11-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 332.379215][ T79] usb 11-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 332.381014][ T79] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.381027][ T79] usb 11-1: Product: syz [ 332.381033][ T79] usb 11-1: Manufacturer: syz [ 332.381040][ T79] usb 11-1: SerialNumber: syz [ 332.384202][ C3] imon 11-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 332.385453][ T79] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:155.0/input/input30 [ 332.512654][T21485] overlay: filesystem on ./bus is read-only [ 332.609045][ T79] imon 11-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 332.609067][ T79] (id 0x00) [ 332.656485][ T79] rc_core: IR keymap rc-imon-pad not found [ 332.656502][ T79] Registered IR keymap rc-empty [ 332.656569][ T79] imon 11-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 332.656584][ T79] imon 11-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 332.804422][ T43] audit: type=1400 audit(1794392639.584:1334): avc: denied { map } for pid=21490 comm="syz.8.5771" path="/1178/dev/sda" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 332.806794][ T79] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:155.0/rc/rc0 [ 332.807616][ T79] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:155.0/rc/rc0/input31 [ 332.818389][ T79] imon 11-1:155.0: iMON device (15c2:ffdc) on usb<11:30> initialized [ 332.988314][T21471] imon:vfd_write: invalid payload size [ 332.988863][ T79] usb 11-1: USB disconnect, device number 30 [ 333.226376][ T965] usb 13-1: new high-speed USB device number 27 using dummy_hcd [ 333.396413][ T965] usb 13-1: Using ep0 maxpacket: 8 [ 333.401229][ T965] usb 13-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 333.402290][ T965] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 333.402314][ T965] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 333.402324][ T965] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 333.402340][ T965] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 333.402355][ T965] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 333.402447][ T965] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.612661][T21510] tipc: Enabled bearer , priority 10 [ 333.628285][ T965] usb 13-1: usb_control_msg returned -32 [ 333.628309][ T965] usbtmc 13-1:16.0: can't read capabilities [ 333.831225][ T5884] usb 13-1: USB disconnect, device number 27 [ 334.040876][T21538] netlink: 28 bytes leftover after parsing attributes in process `syz.7.5792'. [ 334.183447][T21549] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 334.206919][T21556] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 334.206940][T21556] audit: out of memory in audit_log_start [ 334.247688][ T43] audit: type=1400 audit(1794392641.024:1335): avc: denied { write } for pid=21551 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 334.329984][ T43] audit: type=1400 audit(1794392641.114:1336): avc: denied { write } for pid=21563 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 334.481093][T21575] syz_tun: tun_net_xmit 246 [ 335.145907][ T43] audit: type=1400 audit(1794392641.924:1337): avc: denied { write } for pid=21580 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.198204][ T43] audit: type=1400 audit(1794392641.984:1338): avc: denied { write } for pid=21583 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.298609][ T43] audit: type=1400 audit(1794392642.084:1339): avc: denied { write } for pid=21586 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.412628][ T43] audit: type=1400 audit(1794392642.194:1340): avc: denied { write } for pid=21589 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.449666][T21596] overlayfs: failed to clone upperpath [ 335.676982][ T965] usb 11-1: new high-speed USB device number 31 using dummy_hcd [ 335.836338][ T965] usb 11-1: Using ep0 maxpacket: 8 [ 335.836595][ T5893] usb 13-1: new full-speed USB device number 28 using dummy_hcd [ 335.837070][ T965] usb 11-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 335.838027][ T965] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 335.838053][ T965] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 335.838064][ T965] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 335.838075][ T965] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 335.838087][ T965] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.838105][ T965] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.986780][ T5893] usb 13-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 335.987718][ T5893] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 335.987734][ T5893] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 335.987745][ T5893] usb 13-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 335.987764][ T5893] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.989086][ T5893] usb 13-1: config 0 descriptor?? [ 336.046147][ T965] usb 11-1: usb_control_msg returned -32 [ 336.046172][ T965] usbtmc 11-1:16.0: can't read capabilities [ 336.209098][T21608] macvlan0: left promiscuous mode [ 336.212162][T21608] netlink: 'syz.7.5817': attribute type 1 has an invalid length. [ 336.212176][T21608] netlink: 'syz.7.5817': attribute type 2 has an invalid length. [ 336.397072][ T5893] hid_parser_main: 5 callbacks suppressed [ 336.397088][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397102][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397114][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397125][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397137][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397148][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397159][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397171][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397182][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.397193][ T5893] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 336.402171][ T5893] plantronics 0003:047F:FFFF.000B: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 336.500492][ T965] usb 11-1: USB disconnect, device number 31 [ 336.597678][ T5893] usb 13-1: USB disconnect, device number 28 [ 336.818001][T21616] ip_tables: iptables: counters copy to user failed while replacing table [ 337.388036][T21664] FAULT_INJECTION: forcing a failure. [ 337.388036][T21664] name failslab, interval 1, probability 0, space 0, times 0 [ 337.388057][T21664] CPU: 3 UID: 0 PID: 21664 Comm: syz.6.5839 Tainted: G L syzkaller #0 PREEMPT(full) [ 337.388071][T21664] Tainted: [L]=SOFTLOCKUP [ 337.388076][T21664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 337.388083][T21664] Call Trace: [ 337.388103][T21664] [ 337.388108][T21664] dump_stack_lvl+0x100/0x190 [ 337.388162][T21664] should_fail_ex.cold+0x5/0xa [ 337.388188][T21664] should_failslab+0xc2/0x120 [ 337.388235][T21664] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 337.388255][T21664] ? __d_alloc+0x34/0xad0 [ 337.388284][T21664] __d_alloc+0x34/0xad0 [ 337.388305][T21664] ? set_nlink+0xb4/0x190 [ 337.388326][T21664] d_make_root+0x3e/0x90 [ 337.388348][T21664] proc_fill_super+0x58c/0x880 [ 337.388397][T21664] ? __pfx_proc_fill_super+0x10/0x10 [ 337.388415][T21664] get_tree_nodev+0xe3/0x190 [ 337.388436][T21664] vfs_get_tree+0x92/0x320 [ 337.388461][T21664] path_mount+0x7d0/0x2850 [ 337.388497][T21664] ? __pfx_path_mount+0x10/0x10 [ 337.388522][T21664] ? lockdep_hardirqs_on+0x7d/0x110 [ 337.388594][T21664] ? putname+0xb1/0x110 [ 337.388616][T21664] ? kmem_cache_free+0x127/0x6c0 [ 337.388648][T21664] ? __x64_sys_mount+0x293/0x310 [ 337.388671][T21664] __x64_sys_mount+0x293/0x310 [ 337.388697][T21664] ? __pfx___x64_sys_mount+0x10/0x10 [ 337.388727][T21664] do_syscall_64+0x123/0x7b0 [ 337.388750][T21664] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.388768][T21664] RIP: 0033:0x7f41c41a8f19 [ 337.388795][T21664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.388812][T21664] RSP: 002b:00007f41c50d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 337.388831][T21664] RAX: ffffffffffffffda RBX: 00007f41c4425fa0 RCX: 00007f41c41a8f19 [ 337.388844][T21664] RDX: 0000200000000700 RSI: 00002000000006c0 RDI: 0000000000000000 [ 337.388855][T21664] RBP: 00007f41c4237f6d R08: 0000000000000000 R09: 0000000000000000 [ 337.388866][T21664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 337.388876][T21664] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 337.388901][T21664] [ 337.388990][T21664] proc_fill_super: allocate dentry failed [ 337.460910][ T965] usb 13-1: new high-speed USB device number 29 using dummy_hcd [ 337.504440][T21666] kvm: kvm [21665]: vcpu0, guest rIP: 0x540a3 Unhandled RDMSR(0x40000033) [ 337.626584][ T965] usb 13-1: Using ep0 maxpacket: 8 [ 337.627590][T21675] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5844'. [ 337.628195][ T965] usb 13-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 337.629575][ T965] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 337.629598][ T965] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 337.629609][ T965] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 337.629620][ T965] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 337.629630][ T965] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 337.629648][ T965] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.683757][T21679] ip_tables: iptables: counters copy to user failed while replacing table [ 337.780876][T21684] input: syz1 as /devices/virtual/input/input32 [ 337.875011][ T965] usb 13-1: usb_control_msg returned -32 [ 337.875050][ T965] usbtmc 13-1:16.0: can't read capabilities [ 338.012714][T21696] kvm: vcpu 3: requested lapic timer restore with starting count register 0x390=3537391390 (14149565560 ns) > initial count (1640997352 ns). Using initial count to start timer. [ 338.427493][T21705] usb 13-1: usbtmc_ioctl_clear_in_halt returned -32 [ 339.227662][T21721] rxe_eth0 speed is unknown, defaulting to 1000 [ 339.354603][T21721] wlan1 speed is unknown, defaulting to 1000 [ 339.456370][ T79] usb 11-1: new high-speed USB device number 32 using dummy_hcd [ 339.607338][ T79] usb 11-1: New USB device found: idVendor=067b, idProduct=2303, bcdDevice=1.00 [ 339.608939][ T79] usb 11-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 339.608963][ T79] usb 11-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 339.608981][ T79] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 339.609000][ T79] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 339.609028][ T79] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.613470][T21723] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 339.613557][T21723] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 339.618901][ T79] pl2303 11-1:1.0: pl2303 converter detected [ 339.630937][ T79] usb 11-1: pl2303 converter now attached to ttyUSB0 [ 340.196537][ T965] usb 13-1: USB disconnect, device number 29 [ 340.314406][T21750] ipip0: entered promiscuous mode [ 340.314427][T21750] ipip0: entered allmulticast mode [ 340.346744][T21742] pl2303 ttyUSB0: pl2303_set_line_request - failed: -110 [ 340.347275][T21742] pl2303 11-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 340.347352][T21742] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 340.437117][ T79] usb 11-1: USB disconnect, device number 32 [ 340.470252][ T79] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 340.470863][ T79] pl2303 11-1:1.0: device disconnected [ 340.706468][ T965] usb 13-1: new full-speed USB device number 30 using dummy_hcd [ 340.877496][ T965] usb 13-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 340.880466][ T965] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 340.884526][ T965] usb 13-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 340.884548][ T965] usb 13-1: Product: syz [ 340.884559][ T965] usb 13-1: Manufacturer: syz [ 340.884571][ T965] usb 13-1: SerialNumber: syz [ 340.907265][ T965] usb 13-1: config 0 descriptor?? [ 340.909559][ T965] keyspan 13-1:0.0: Keyspan 4 port adapter converter detected [ 340.909720][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 81 [ 340.909806][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 88 [ 340.911237][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 1 [ 340.912770][ T965] usb 13-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 340.915036][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 2 [ 340.934741][ T965] usb 13-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 340.941148][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 4 [ 340.945336][ T965] usb 13-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 340.952441][ T965] keyspan 13-1:0.0: found no endpoint descriptor for endpoint 6 [ 340.960013][ T965] usb 13-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 341.158729][T21766] FAULT_INJECTION: forcing a failure. [ 341.158729][T21766] name failslab, interval 1, probability 0, space 0, times 0 [ 341.158754][T21766] CPU: 2 UID: 0 PID: 21766 Comm: syz.2.5880 Tainted: G L syzkaller #0 PREEMPT(full) [ 341.158773][T21766] Tainted: [L]=SOFTLOCKUP [ 341.158778][T21766] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 341.158785][T21766] Call Trace: [ 341.158791][T21766] [ 341.158812][T21766] dump_stack_lvl+0x100/0x190 [ 341.158842][T21766] should_fail_ex.cold+0x5/0xa [ 341.158865][T21766] should_failslab+0xc2/0x120 [ 341.158883][T21766] kmem_cache_alloc_noprof+0x92/0x6a0 [ 341.158905][T21766] ? d_instantiate+0x8a/0xb0 [ 341.158925][T21766] ? alloc_empty_file+0x5b/0x1c0 [ 341.158953][T21766] alloc_empty_file+0x5b/0x1c0 [ 341.158975][T21766] alloc_file_pseudo+0x17e/0x290 [ 341.158998][T21766] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 341.159018][T21766] ? _raw_spin_unlock+0x28/0x50 [ 341.159033][T21766] ? alloc_fd+0x471/0x7a0 [ 341.159052][T21766] __anon_inode_getfile+0xe8/0x280 [ 341.159072][T21766] anon_inode_getfd+0x68/0xc0 [ 341.159089][T21766] do_inotify_init+0x454/0x5a0 [ 341.159108][T21766] __x64_sys_inotify_init1+0x30/0x40 [ 341.159125][T21766] do_syscall_64+0x123/0x7b0 [ 341.159143][T21766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.159158][T21766] RIP: 0033:0x7fa171da8f19 [ 341.159170][T21766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.159183][T21766] RSP: 002b:00007fa172ca4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000126 [ 341.159197][T21766] RAX: ffffffffffffffda RBX: 00007fa172025fa0 RCX: 00007fa171da8f19 [ 341.159207][T21766] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000800 [ 341.159216][T21766] RBP: 00007fa171e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 341.159225][T21766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 341.159234][T21766] R13: 00007fa172026038 R14: 00007fa172025fa0 R15: 00007ffcf4739288 [ 341.159254][T21766] [ 341.202914][ T5893] usb 13-1: USB disconnect, device number 30 [ 341.357246][ T5893] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 341.359968][ T5893] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 341.365637][ T5893] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 341.371240][ T5893] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 341.371556][ T5893] keyspan 13-1:0.0: device disconnected [ 341.725488][T21787] FAULT_INJECTION: forcing a failure. [ 341.725488][T21787] name failslab, interval 1, probability 0, space 0, times 0 [ 341.725522][T21787] CPU: 2 UID: 0 PID: 21787 Comm: syz.2.5887 Tainted: G L syzkaller #0 PREEMPT(full) [ 341.725549][T21787] Tainted: [L]=SOFTLOCKUP [ 341.725556][T21787] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 341.725568][T21787] Call Trace: [ 341.725574][T21787] [ 341.725580][T21787] dump_stack_lvl+0x100/0x190 [ 341.725617][T21787] should_fail_ex.cold+0x5/0xa [ 341.725642][T21787] should_failslab+0xc2/0x120 [ 341.725664][T21787] __kmalloc_noprof+0xfc/0x840 [ 341.725681][T21787] ? kasan_save_track+0x14/0x30 [ 341.725701][T21787] ? drm_atomic_commit_init+0xf4/0x490 [ 341.725776][T21787] drm_atomic_commit_init+0xf4/0x490 [ 341.725797][T21787] drm_atomic_commit_alloc+0xd3/0x120 [ 341.725814][T21787] drm_client_modeset_commit_atomic+0xcc/0x7e0 [ 341.725835][T21787] ? rcu_is_watching+0x13/0xc0 [ 341.725853][T21787] ? trace_contention_end+0x126/0x160 [ 341.725880][T21787] ? drm_client_modeset_commit_locked+0x4c/0x580 [ 341.725901][T21787] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 341.725918][T21787] ? drm_master_internal_acquire+0x21/0x80 [ 341.725934][T21787] ? __mutex_lock+0x267/0x1c10 [ 341.725972][T21787] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 341.725997][T21787] drm_client_modeset_commit_locked+0x14d/0x580 [ 341.726025][T21787] drm_fb_helper_pan_display+0x32d/0xa40 [ 341.726046][T21787] ? enable_work+0x24c/0x320 [ 341.726063][T21787] fb_pan_display+0x195/0x820 [ 341.726088][T21787] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 341.726108][T21787] bit_update_start+0x48/0x1f0 [ 341.726125][T21787] fbcon_switch+0x1119/0x19f0 [ 341.726144][T21787] ? __pfx_fbcon_switch+0x10/0x10 [ 341.726167][T21787] ? __pfx_bit_cursor+0x10/0x10 [ 341.726197][T21787] ? fbcon_cursor+0x24c/0x5e0 [ 341.726213][T21787] ? is_console_locked+0x9/0x20 [ 341.726228][T21787] ? con_is_visible+0x65/0x150 [ 341.726249][T21787] redraw_screen+0x2c1/0x760 [ 341.726268][T21787] ? __pfx_redraw_screen+0x10/0x10 [ 341.726286][T21787] ? fbcon_set_palette+0x156/0x5f0 [ 341.726308][T21787] fbcon_modechanged+0x4ee/0x7f0 [ 341.726335][T21787] fbcon_update_vcs+0x47/0x60 [ 341.726355][T21787] fb_set_var_from_user+0xa7/0xc0 [ 341.726397][T21787] do_fb_ioctl+0x1f3/0x730 [ 341.726417][T21787] ? __pfx_do_fb_ioctl+0x10/0x10 [ 341.726437][T21787] ? __pfx_futex_wait+0x10/0x10 [ 341.726457][T21787] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 341.726479][T21787] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 341.726491][T21787] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 341.726536][T21787] fb_ioctl+0xe5/0x150 [ 341.726551][T21787] ? __pfx_fb_ioctl+0x10/0x10 [ 341.726568][T21787] __x64_sys_ioctl+0x18e/0x210 [ 341.726581][T21787] do_syscall_64+0x123/0x7b0 [ 341.726597][T21787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.726609][T21787] RIP: 0033:0x7fa171da8f19 [ 341.726620][T21787] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.726630][T21787] RSP: 002b:00007fa172ca4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 341.726642][T21787] RAX: ffffffffffffffda RBX: 00007fa172025fa0 RCX: 00007fa171da8f19 [ 341.726650][T21787] RDX: 0000200000000180 RSI: 0000000000004601 RDI: 0000000000000004 [ 341.726657][T21787] RBP: 00007fa171e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 341.726664][T21787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 341.726671][T21787] R13: 00007fa172026038 R14: 00007fa172025fa0 R15: 00007ffcf4739288 [ 341.726689][T21787] [ 341.908573][T21790] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 342.247964][T21799] md: array md6 already initialised! [ 342.468045][T21799] md: could not open device unknown-block(1,13). [ 342.468077][T21799] md: error, md_import_device() returned -16 [ 342.471879][T21806] ip6gre1: entered promiscuous mode [ 342.471892][T21806] ip6gre1: entered allmulticast mode [ 342.694693][ T1166] IPVS: starting estimator thread 0... [ 342.759835][ T43] audit: type=1400 audit(1794392649.544:1341): avc: denied { relabelfrom } for pid=21832 comm="syz.8.5905" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 342.764198][ T43] audit: type=1400 audit(1794392649.544:1342): avc: denied { relabelto } for pid=21832 comm="syz.8.5905" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 342.778327][T21828] IPVS: using max 45 ests per chain, 108000 per kthread [ 342.814404][T21839] ip_tables: iptables: counters copy to user failed while replacing table [ 342.894351][ T13] nci: nci_ntf_packet: unknown ntf opcode 0x73b [ 343.185606][T21859] netlink: 'syz.8.5915': attribute type 8 has an invalid length. [ 343.451021][ T43] audit: type=1400 audit(1794392650.234:1343): avc: denied { watch_sb } for pid=21867 comm="syz.6.5918" path="/1343/file0" dev="tmpfs" ino=7176 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 343.546806][T21871] device-mapper: table: 248:10: integrity: Device lookup failed (-EBUSY) [ 343.546824][T21871] device-mapper: ioctl: error adding target to table [ 343.648786][T21878] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5922'. [ 343.769762][T21884] mac80211_hwsim hwsim16 syzkaller1: entered promiscuous mode [ 343.769789][T21884] mac80211_hwsim hwsim16 syzkaller1: entered allmulticast mode [ 343.946290][ T965] usb 13-1: new high-speed USB device number 31 using dummy_hcd [ 344.126256][ T965] usb 13-1: Using ep0 maxpacket: 32 [ 344.126981][ T965] usb 13-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 344.127838][ T965] usb 13-1: config index 0 descriptor too short (expected 156, got 27) [ 344.127855][ T965] usb 13-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 344.127872][ T965] usb 13-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 344.127885][ T965] usb 13-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 344.127896][ T965] usb 13-1: config 0 interface 0 has no altsetting 0 [ 344.130202][ T965] usb 13-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 344.130215][ T965] usb 13-1: Product: syz [ 344.130222][ T965] usb 13-1: Manufacturer: syz [ 344.130229][ T965] usb 13-1: SerialNumber: syz [ 344.133330][ T965] usb 13-1: config 0 descriptor?? [ 344.138274][ T965] ldusb 13-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 344.145661][ T965] ldusb 13-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 344.261594][T21900] syz_tun: tun_net_xmit 62 [ 344.262055][ C0] syz_tun: tun_net_xmit 62 [ 344.262493][ C0] syz_tun: tun_net_xmit 62 [ 344.262860][ C0] syz_tun: tun_net_xmit 62 [ 344.263223][ C0] syz_tun: tun_net_xmit 62 [ 344.263576][ C0] syz_tun: tun_net_xmit 62 [ 344.263908][ C0] syz_tun: tun_net_xmit 62 [ 344.264258][ C0] syz_tun: tun_net_xmit 62 [ 344.264601][ C0] syz_tun: tun_net_xmit 62 [ 344.264947][ C0] syz_tun: tun_net_xmit 62 [ 344.265289][ C0] syz_tun: tun_net_xmit 62 [ 344.265621][ C0] syz_tun: tun_net_xmit 62 [ 344.265829][ C0] syz_tun: tun_net_xmit 62 [ 344.266287][ C0] syz_tun: tun_net_xmit 62 [ 344.266645][ C0] syz_tun: tun_net_xmit 62 [ 344.266932][ C0] syz_tun: tun_net_xmit 62 [ 344.267201][ C0] syz_tun: tun_net_xmit 62 [ 344.267448][ C0] syz_tun: tun_net_xmit 62 [ 344.267680][ C0] syz_tun: tun_net_xmit 62 [ 344.267916][ C0] syz_tun: tun_net_xmit 62 [ 344.268157][ C0] syz_tun: tun_net_xmit 62 [ 344.268411][ C0] syz_tun: tun_net_xmit 62 [ 344.268652][ C0] syz_tun: tun_net_xmit 62 [ 344.268891][ C0] syz_tun: tun_net_xmit 62 [ 344.269158][ C0] syz_tun: tun_net_xmit 62 [ 344.269390][ C0] syz_tun: tun_net_xmit 62 [ 344.269632][ C0] syz_tun: tun_net_xmit 62 [ 344.269910][ C0] syz_tun: tun_net_xmit 62 [ 344.270166][ C0] syz_tun: tun_net_xmit 62 [ 344.270449][ C0] syz_tun: tun_net_xmit 62 [ 344.270703][ C0] syz_tun: tun_net_xmit 62 [ 344.270962][ C0] syz_tun: tun_net_xmit 62 [ 344.271220][ C0] syz_tun: tun_net_xmit 62 [ 344.271468][ C0] syz_tun: tun_net_xmit 62 [ 344.271718][ C0] syz_tun: tun_net_xmit 62 [ 344.272039][ C0] syz_tun: tun_net_xmit 62 [ 344.272296][ C0] syz_tun: tun_net_xmit 62 [ 344.272544][ C0] syz_tun: tun_net_xmit 62 [ 344.272798][ C0] syz_tun: tun_net_xmit 62 [ 344.273053][ C0] syz_tun: tun_net_xmit 62 [ 344.273303][ C0] syz_tun: tun_net_xmit 62 [ 344.273583][ C0] syz_tun: tun_net_xmit 62 [ 344.273820][ C0] syz_tun: tun_net_xmit 62 [ 344.274061][ C0] syz_tun: tun_net_xmit 62 [ 344.274309][ C0] syz_tun: tun_net_xmit 62 [ 344.274581][ C0] syz_tun: tun_net_xmit 62 [ 344.274832][ C0] syz_tun: tun_net_xmit 62 [ 344.275079][ C0] syz_tun: tun_net_xmit 62 [ 344.275328][ C0] syz_tun: tun_net_xmit 62 [ 344.275600][ C0] syz_tun: tun_net_xmit 62 [ 344.275851][ C0] syz_tun: tun_net_xmit 62 [ 344.276107][ C0] syz_tun: tun_net_xmit 62 [ 344.276427][ C0] syz_tun: tun_net_xmit 62 [ 344.276683][ C0] syz_tun: tun_net_xmit 62 [ 344.279235][ C0] syz_tun: tun_net_xmit 62 [ 344.279559][ C0] syz_tun: tun_net_xmit 62 [ 344.279817][ C0] syz_tun: tun_net_xmit 62 [ 344.280077][ C0] syz_tun: tun_net_xmit 62 [ 344.280329][ C0] syz_tun: tun_net_xmit 62 [ 344.280583][ C0] syz_tun: tun_net_xmit 62 [ 344.280829][ C0] syz_tun: tun_net_xmit 62 [ 344.281074][ C0] syz_tun: tun_net_xmit 62 [ 344.281311][ C0] syz_tun: tun_net_xmit 62 [ 344.281536][ C0] syz_tun: tun_net_xmit 62 [ 344.281762][ C0] syz_tun: tun_net_xmit 62 [ 344.282292][ C0] syz_tun: tun_net_xmit 62 [ 344.282577][ C0] syz_tun: tun_net_xmit 62 [ 344.282781][ C0] syz_tun: tun_net_xmit 62 [ 344.282970][ C0] syz_tun: tun_net_xmit 62 [ 344.283194][ C0] syz_tun: tun_net_xmit 62 [ 344.283394][ C0] syz_tun: tun_net_xmit 62 [ 344.283580][ C0] syz_tun: tun_net_xmit 62 [ 344.283766][ C0] syz_tun: tun_net_xmit 62 [ 344.283969][ C0] syz_tun: tun_net_xmit 62 [ 344.284228][ C0] syz_tun: tun_net_xmit 62 [ 344.284422][ C0] syz_tun: tun_net_xmit 62 [ 344.284617][ C0] syz_tun: tun_net_xmit 62 [ 344.284808][ C0] syz_tun: tun_net_xmit 62 [ 344.285014][ C0] syz_tun: tun_net_xmit 62 [ 344.285206][ C0] syz_tun: tun_net_xmit 62 [ 344.285504][ C0] syz_tun: tun_net_xmit 62 [ 344.285748][ C0] syz_tun: tun_net_xmit 62 [ 344.285991][ C0] syz_tun: tun_net_xmit 62 [ 344.286313][ C0] syz_tun: tun_net_xmit 62 [ 344.286588][ C0] syz_tun: tun_net_xmit 62 [ 344.286833][ C0] syz_tun: tun_net_xmit 62 [ 344.287067][ C0] syz_tun: tun_net_xmit 62 [ 344.287304][ C0] syz_tun: tun_net_xmit 62 [ 344.287543][ C0] syz_tun: tun_net_xmit 62 [ 344.287776][ C0] syz_tun: tun_net_xmit 62 [ 344.288010][ C0] syz_tun: tun_net_xmit 62 [ 344.288235][ C0] syz_tun: tun_net_xmit 62 [ 344.288472][ C0] syz_tun: tun_net_xmit 62 [ 344.288699][ C0] syz_tun: tun_net_xmit 62 [ 344.288935][ C0] syz_tun: tun_net_xmit 62 [ 344.289177][ C0] syz_tun: tun_net_xmit 62 [ 344.289407][ C0] syz_tun: tun_net_xmit 62 [ 344.289653][ C0] syz_tun: tun_net_xmit 62 [ 344.289883][ C0] syz_tun: tun_net_xmit 62 [ 344.290125][ C0] syz_tun: tun_net_xmit 62 [ 344.290394][ C0] syz_tun: tun_net_xmit 62 [ 344.290634][ C0] syz_tun: tun_net_xmit 62 [ 344.290874][ C0] syz_tun: tun_net_xmit 62 [ 344.291110][ C0] syz_tun: tun_net_xmit 62 [ 344.291359][ C0] syz_tun: tun_net_xmit 62 [ 344.291598][ C0] syz_tun: tun_net_xmit 62 [ 344.291837][ C0] syz_tun: tun_net_xmit 62 [ 344.292133][ C0] syz_tun: tun_net_xmit 62 [ 344.292367][ C0] syz_tun: tun_net_xmit 62 [ 344.292595][ C0] syz_tun: tun_net_xmit 62 [ 344.292830][ C0] syz_tun: tun_net_xmit 62 [ 344.293102][ C0] syz_tun: tun_net_xmit 62 [ 344.293346][ C0] syz_tun: tun_net_xmit 62 [ 344.293583][ C0] syz_tun: tun_net_xmit 62 [ 344.293832][ C0] syz_tun: tun_net_xmit 62 [ 344.294091][ C0] syz_tun: tun_net_xmit 62 [ 344.294326][ C0] syz_tun: tun_net_xmit 62 [ 344.294646][ C0] syz_tun: tun_net_xmit 62 [ 344.294878][ C0] syz_tun: tun_net_xmit 62 [ 344.295117][ C0] syz_tun: tun_net_xmit 62 [ 344.295350][ C0] syz_tun: tun_net_xmit 62 [ 344.295586][ C0] syz_tun: tun_net_xmit 62 [ 344.295873][ C0] syz_tun: tun_net_xmit 62 [ 344.296114][ C0] syz_tun: tun_net_xmit 62 [ 344.296409][ C0] syz_tun: tun_net_xmit 62 [ 344.296662][ C0] syz_tun: tun_net_xmit 62 [ 344.297219][ C0] syz_tun: tun_net_xmit 54 [ 344.358895][ T965] usb 13-1: USB disconnect, device number 31 [ 344.358951][ C0] ldusb 13-1:0.0: usb_submit_urb failed (-19) [ 344.364360][ T965] ldusb 13-1:0.0: LD USB Device #0 now disconnected [ 344.366560][ C0] syz_tun: tun_net_xmit 54 [ 344.456471][ C0] syz_tun: tun_net_xmit 54 [ 345.524959][T21922] fuse: fd is not a fuse device [ 345.612059][T21927] xt_hashlimit: size too large, truncated to 1048576 [ 345.620446][ T43] audit: type=1400 audit(1794392652.394:1344): avc: denied { map } for pid=21923 comm="syz.8.5943" path="socket:[97155]" dev="sockfs" ino=97155 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 345.813476][T21837] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 345.856235][T21938] netlink: 'syz.8.5947': attribute type 1 has an invalid length. [ 345.879086][T21938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 345.903203][T21938] bond0: (slave gretap1): making interface the new active one [ 345.903881][T21938] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 345.938829][T21943] FAULT_INJECTION: forcing a failure. [ 345.938829][T21943] name failslab, interval 1, probability 0, space 0, times 0 [ 345.938852][T21943] CPU: 3 UID: 0 PID: 21943 Comm: syz.8.5950 Tainted: G L syzkaller #0 PREEMPT(full) [ 345.938870][T21943] Tainted: [L]=SOFTLOCKUP [ 345.938875][T21943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 345.938881][T21943] Call Trace: [ 345.938886][T21943] [ 345.938890][T21943] dump_stack_lvl+0x100/0x190 [ 345.938912][T21943] should_fail_ex.cold+0x5/0xa [ 345.938929][T21943] should_failslab+0xc2/0x120 [ 345.938943][T21943] __kmalloc_noprof+0xfc/0x840 [ 345.938955][T21943] ? mpi_alloc_limb_space+0x31/0x60 [ 345.938974][T21943] mpi_alloc_limb_space+0x31/0x60 [ 345.938989][T21943] mpi_powm+0x107e/0x1e40 [ 345.939011][T21943] ? __pfx_mpi_powm+0x10/0x10 [ 345.939026][T21943] ? mpi_free+0x60/0x150 [ 345.939040][T21943] ? mpi_free+0xe1/0x150 [ 345.939053][T21943] ? kfree+0x22b/0x6d0 [ 345.939069][T21943] ? mpi_free+0xe6/0x150 [ 345.939102][T21943] rsa_enc+0x1fe/0x3b0 [ 345.939118][T21943] ? __pfx_rsa_enc+0x10/0x10 [ 345.939131][T21943] ? __virt_addr_valid+0x239/0x430 [ 345.939146][T21943] ? sg_init_one+0xf5/0x1b0 [ 345.939159][T21943] rsassa_pkcs1_verify+0x4ef/0xc20 [ 345.939178][T21943] ? __pfx_rsassa_pkcs1_verify+0x10/0x10 [ 345.939202][T21943] ? rsa_max_size+0xd/0x70 [ 345.939212][T21943] ? rsassa_pkcs1_set_pub_key+0x17d/0x1f0 [ 345.939227][T21943] public_key_verify_signature+0x5ee/0x910 [ 345.939246][T21943] ? __pfx_public_key_verify_signature+0x10/0x10 [ 345.939270][T21943] ? asymmetric_key_generate_id+0x7e/0x180 [ 345.939288][T21943] x509_check_for_self_signed+0x325/0x510 [ 345.939301][T21943] x509_cert_parse+0x60c/0x910 [ 345.939313][T21943] x509_key_preparse+0x65/0x9c0 [ 345.939327][T21943] asymmetric_key_preparse+0xce/0x1d0 [ 345.939341][T21943] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 345.939356][T21943] __key_create_or_update+0x3f6/0xe30 [ 345.939376][T21943] ? __pfx___key_create_or_update+0x10/0x10 [ 345.939387][T21943] ? lookup_user_key+0x58c/0x14f0 [ 345.939403][T21943] ? __lock_acquire+0x5c0/0x1f40 [ 345.939420][T21943] ? __pfx_lookup_user_key+0x10/0x10 [ 345.939443][T21943] ? __pfx_keyring_search_iterator+0x10/0x10 [ 345.939461][T21943] key_create_or_update+0x42/0x60 [ 345.939475][T21943] __do_sys_add_key+0x2e8/0x460 [ 345.939491][T21943] ? __pfx___do_sys_add_key+0x10/0x10 [ 345.939511][T21943] do_syscall_64+0x123/0x7b0 [ 345.939527][T21943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.939538][T21943] RIP: 0033:0x7f970a5a8f19 [ 345.939548][T21943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 345.939558][T21943] RSP: 002b:00007f970b3f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 345.939569][T21943] RAX: ffffffffffffffda RBX: 00007f970a825fa0 RCX: 00007f970a5a8f19 [ 345.939576][T21943] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 345.939582][T21943] RBP: 00007f970a637f6d R08: 000000003e1af90e R09: 0000000000000000 [ 345.939589][T21943] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 345.939595][T21943] R13: 00007f970a826038 R14: 00007f970a825fa0 R15: 00007ffce646cb98 [ 345.939610][T21943] [ 346.059254][T21949] FAULT_INJECTION: forcing a failure. [ 346.059254][T21949] name failslab, interval 1, probability 0, space 0, times 0 [ 346.059276][T21949] CPU: 0 UID: 0 PID: 21949 Comm: syz.8.5953 Tainted: G L syzkaller #0 PREEMPT(full) [ 346.059292][T21949] Tainted: [L]=SOFTLOCKUP [ 346.059297][T21949] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 346.059303][T21949] Call Trace: [ 346.059308][T21949] [ 346.059313][T21949] dump_stack_lvl+0x100/0x190 [ 346.059336][T21949] should_fail_ex.cold+0x5/0xa [ 346.059367][T21949] should_failslab+0xc2/0x120 [ 346.059382][T21949] __kmalloc_cache_noprof+0x91/0x6d0 [ 346.059397][T21949] ? drm_atomic_commit_alloc+0xb8/0x120 [ 346.059416][T21949] drm_atomic_commit_alloc+0xb8/0x120 [ 346.059430][T21949] drm_client_modeset_commit_atomic+0xcc/0x7e0 [ 346.059446][T21949] ? rcu_is_watching+0x13/0xc0 [ 346.059458][T21949] ? trace_contention_end+0x126/0x160 [ 346.059476][T21949] ? drm_client_modeset_commit_locked+0x4c/0x580 [ 346.059490][T21949] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 346.059506][T21949] ? drm_master_internal_acquire+0x21/0x80 [ 346.059520][T21949] ? __mutex_lock+0x267/0x1c10 [ 346.059544][T21949] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 346.059561][T21949] drm_client_modeset_commit_locked+0x14d/0x580 [ 346.059585][T21949] drm_fb_helper_pan_display+0x32d/0xa40 [ 346.059605][T21949] ? enable_work+0x24c/0x320 [ 346.059624][T21949] fb_pan_display+0x195/0x820 [ 346.059637][T21949] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 346.059657][T21949] bit_update_start+0x48/0x1f0 [ 346.059674][T21949] fbcon_switch+0x1119/0x19f0 [ 346.059692][T21949] ? __pfx_fbcon_switch+0x10/0x10 [ 346.059715][T21949] ? __pfx_bit_cursor+0x10/0x10 [ 346.059729][T21949] ? fbcon_cursor+0x24c/0x5e0 [ 346.059743][T21949] ? is_console_locked+0x9/0x20 [ 346.059756][T21949] ? con_is_visible+0x65/0x150 [ 346.059773][T21949] redraw_screen+0x2c1/0x760 [ 346.059785][T21949] ? __pfx_redraw_screen+0x10/0x10 [ 346.059797][T21949] ? fbcon_set_palette+0x156/0x5f0 [ 346.059811][T21949] fbcon_modechanged+0x4ee/0x7f0 [ 346.059835][T21949] fbcon_update_vcs+0x47/0x60 [ 346.059854][T21949] fb_set_var_from_user+0xa7/0xc0 [ 346.059869][T21949] do_fb_ioctl+0x1f3/0x730 [ 346.059884][T21949] ? __pfx_do_fb_ioctl+0x10/0x10 [ 346.059911][T21949] ? __pfx_futex_wait+0x10/0x10 [ 346.059936][T21949] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 346.059956][T21949] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 346.059966][T21949] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 346.059993][T21949] fb_ioctl+0xe5/0x150 [ 346.060008][T21949] ? __pfx_fb_ioctl+0x10/0x10 [ 346.060030][T21949] __x64_sys_ioctl+0x18e/0x210 [ 346.060043][T21949] do_syscall_64+0x123/0x7b0 [ 346.060059][T21949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.060071][T21949] RIP: 0033:0x7f970a5a8f19 [ 346.060082][T21949] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.060092][T21949] RSP: 002b:00007f970b3f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 346.060103][T21949] RAX: ffffffffffffffda RBX: 00007f970a825fa0 RCX: 00007f970a5a8f19 [ 346.060110][T21949] RDX: 0000200000000180 RSI: 0000000000004601 RDI: 0000000000000004 [ 346.060116][T21949] RBP: 00007f970a637f6d R08: 0000000000000000 R09: 0000000000000000 [ 346.060122][T21949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 346.060128][T21949] R13: 00007f970a826038 R14: 00007f970a825fa0 R15: 00007ffce646cb98 [ 346.060145][T21949] [ 346.483196][T21959] kvm_intel: kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x6a07 [ 346.495895][T21959] kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0xb207 [ 346.496052][T21959] kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xc206 [ 346.510515][T21959] kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0x11e) = 0x6406 [ 346.523143][T21959] kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9606 [ 346.523292][T21959] kvm [21958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0xa606 [ 346.552817][T21959] kvm: MONITOR instruction emulated as NOP! [ 347.239160][T21983] jffs2: notice: (21983) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 347.733211][T22000] FAULT_INJECTION: forcing a failure. [ 347.733211][T22000] name failslab, interval 1, probability 0, space 0, times 0 [ 347.733231][T22000] CPU: 2 UID: 0 PID: 22000 Comm: syz.6.5970 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.733245][T22000] Tainted: [L]=SOFTLOCKUP [ 347.733249][T22000] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 347.733255][T22000] Call Trace: [ 347.733259][T22000] [ 347.733264][T22000] dump_stack_lvl+0x100/0x190 [ 347.733285][T22000] should_fail_ex.cold+0x5/0xa [ 347.733304][T22000] should_failslab+0xc2/0x120 [ 347.733318][T22000] __kvmalloc_node_noprof+0x113/0x9b0 [ 347.733329][T22000] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 347.733338][T22000] ? __kmalloc_cache_noprof+0x201/0x6d0 [ 347.733352][T22000] ? io_alloc_cache_init+0x38/0x170 [ 347.733372][T22000] io_alloc_cache_init+0x38/0x170 [ 347.733388][T22000] io_rsrc_cache_init+0x26/0x50 [ 347.733403][T22000] io_uring_setup.cold+0x4c0/0x1c7e [ 347.733416][T22000] ? lock_acquire+0x1d1/0x380 [ 347.733430][T22000] ? avc_has_perm_noaudit+0x56/0x470 [ 347.733443][T22000] ? __pfx_io_uring_setup+0x10/0x10 [ 347.733455][T22000] ? find_held_lock+0x2b/0x80 [ 347.733466][T22000] ? avc_has_perm_noaudit+0x11e/0x470 [ 347.733478][T22000] ? avc_has_perm_noaudit+0x11e/0x470 [ 347.733506][T22000] ? __pfx___x64_sys_futex+0x10/0x10 [ 347.733524][T22000] __x64_sys_io_uring_setup+0xc2/0x170 [ 347.733540][T22000] do_syscall_64+0x123/0x7b0 [ 347.733555][T22000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.733567][T22000] RIP: 0033:0x7f41c41a8f19 [ 347.733579][T22000] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.733589][T22000] RSP: 002b:00007f41c50d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 347.733600][T22000] RAX: ffffffffffffffda RBX: 00007f41c4425fa0 RCX: 00007f41c41a8f19 [ 347.733607][T22000] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000004b22 [ 347.733614][T22000] RBP: 00007f41c4237f6d R08: 0000000000000000 R09: 0000000000000000 [ 347.733620][T22000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.733626][T22000] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 347.733641][T22000] [ 347.952267][ T43] audit: type=1400 audit(1794392654.734:1345): avc: denied { remount } for pid=22014 comm="syz.6.5977" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 347.952378][T22015] proc: Unknown parameter 'subj_user' [ 347.952657][T22015] FAULT_INJECTION: forcing a failure. [ 347.952657][T22015] name failslab, interval 1, probability 0, space 0, times 0 [ 347.952673][T22015] CPU: 0 UID: 0 PID: 22015 Comm: syz.6.5977 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.952687][T22015] Tainted: [L]=SOFTLOCKUP [ 347.952692][T22015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 347.952697][T22015] Call Trace: [ 347.952702][T22015] [ 347.952706][T22015] dump_stack_lvl+0x100/0x190 [ 347.952729][T22015] should_fail_ex.cold+0x5/0xa [ 347.952758][T22015] should_failslab+0xc2/0x120 [ 347.952774][T22015] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 347.952787][T22015] ? key_alloc+0x44c/0x1330 [ 347.952801][T22015] kmemdup_noprof+0x29/0x60 [ 347.952814][T22015] key_alloc+0x44c/0x1330 [ 347.952828][T22015] ? __pfx_key_alloc+0x10/0x10 [ 347.952841][T22015] ? hook_cred_prepare+0x177/0x370 [ 347.952856][T22015] keyring_alloc+0x44/0xc0 [ 347.952870][T22015] lookup_user_key+0x828/0x14f0 [ 347.952888][T22015] ? __pfx_lookup_user_key+0x10/0x10 [ 347.952918][T22015] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 347.952941][T22015] ? strncpy_from_user+0x19d/0x2d0 [ 347.952960][T22015] __do_sys_add_key+0x2a6/0x460 [ 347.952975][T22015] ? __pfx___do_sys_add_key+0x10/0x10 [ 347.952995][T22015] do_syscall_64+0x123/0x7b0 [ 347.953010][T22015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.953021][T22015] RIP: 0033:0x7f41c41a8f19 [ 347.953031][T22015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.953040][T22015] RSP: 002b:00007f41c50d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 347.953051][T22015] RAX: ffffffffffffffda RBX: 00007f41c4425fa0 RCX: 00007f41c41a8f19 [ 347.953058][T22015] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000740 [ 347.953065][T22015] RBP: 00007f41c4237f6d R08: fffffffffffffffe R09: 0000000000000000 [ 347.953071][T22015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.953077][T22015] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 347.953091][T22015] [ 348.030872][T22017] FAULT_INJECTION: forcing a failure. [ 348.030872][T22017] name failslab, interval 1, probability 0, space 0, times 0 [ 348.030891][T22017] CPU: 0 UID: 0 PID: 22017 Comm: syz.6.5978 Tainted: G L syzkaller #0 PREEMPT(full) [ 348.030911][T22017] Tainted: [L]=SOFTLOCKUP [ 348.030915][T22017] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 348.030922][T22017] Call Trace: [ 348.030926][T22017] [ 348.030931][T22017] dump_stack_lvl+0x100/0x190 [ 348.030953][T22017] should_fail_ex.cold+0x5/0xa [ 348.030984][T22017] should_failslab+0xc2/0x120 [ 348.030998][T22017] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 348.031010][T22017] ? sidtab_sid2str_get+0x84/0x670 [ 348.031023][T22017] ? sidtab_sid2str_get+0x17a/0x670 [ 348.031037][T22017] kmemdup_noprof+0x29/0x60 [ 348.031050][T22017] sidtab_sid2str_get+0x17a/0x670 [ 348.031065][T22017] security_sid_to_context_core+0x373/0x700 [ 348.031079][T22017] avc_audit_post_callback+0x1aa/0x910 [ 348.031093][T22017] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 348.031106][T22017] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 348.031118][T22017] ? skb_put+0x138/0x180 [ 348.031166][T22017] ? audit_log_n_string+0x2ac/0x5b0 [ 348.031187][T22017] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 348.031199][T22017] common_lsm_audit+0x23f/0x2b0 [ 348.031212][T22017] ? __pfx_common_lsm_audit+0x10/0x10 [ 348.031226][T22017] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 348.031242][T22017] slow_avc_audit+0x186/0x210 [ 348.031256][T22017] ? __pfx_slow_avc_audit+0x10/0x10 [ 348.031271][T22017] ? avc_denied+0x14a/0x190 [ 348.031284][T22017] ? avc_has_perm_noaudit+0x3a2/0x470 [ 348.031300][T22017] avc_has_perm+0x1a6/0x1e0 [ 348.031314][T22017] ? __pfx_avc_has_perm+0x10/0x10 [ 348.031328][T22017] ? tomoyo_mount_permission+0x252/0x460 [ 348.031343][T22017] inode_has_perm.isra.0+0x143/0x1a0 [ 348.031357][T22017] selinux_mount+0x37f/0x460 [ 348.031370][T22017] ? __pfx_selinux_mount+0x10/0x10 [ 348.031388][T22017] security_sb_mount+0x10b/0x270 [ 348.031404][T22017] path_mount+0x158/0x2850 [ 348.031422][T22017] ? __pfx_path_mount+0x10/0x10 [ 348.031437][T22017] ? lockdep_hardirqs_on+0x7d/0x110 [ 348.031451][T22017] ? putname+0xb1/0x110 [ 348.031465][T22017] ? kmem_cache_free+0x127/0x6c0 [ 348.031484][T22017] ? __x64_sys_mount+0x293/0x310 [ 348.031499][T22017] __x64_sys_mount+0x293/0x310 [ 348.031516][T22017] ? __pfx___x64_sys_mount+0x10/0x10 [ 348.031536][T22017] do_syscall_64+0x123/0x7b0 [ 348.031550][T22017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.031561][T22017] RIP: 0033:0x7f41c41a8f19 [ 348.031572][T22017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.031581][T22017] RSP: 002b:00007f41c50d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 348.031592][T22017] RAX: ffffffffffffffda RBX: 00007f41c4425fa0 RCX: 00007f41c41a8f19 [ 348.031599][T22017] RDX: 0000200000000200 RSI: 00002000000001c0 RDI: 0000200000000180 [ 348.031605][T22017] RBP: 00007f41c4237f6d R08: 0000000000000000 R09: 0000000000000000 [ 348.031611][T22017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 348.031618][T22017] R13: 00007f41c4426038 R14: 00007f41c4425fa0 R15: 00007ffe72ed40b8 [ 348.031635][T22017] [ 348.031716][ T43] audit: type=1400 audit(1794392654.814:1346): avc: denied { mounton } for pid=22016 comm="syz.6.5978" path="/1368/file0" dev="tmpfs" ino=7317 scontext=root:sysadm_r:sysadm_t tsid=156 tclass=blk_file permissive=1 [ 348.033228][T22017] jffs2: notice: (22017) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 349.187965][T22053] FAULT_INJECTION: forcing a failure. [ 349.187965][T22053] name failslab, interval 1, probability 0, space 0, times 0 [ 349.188011][T22053] CPU: 2 UID: 0 PID: 22053 Comm: syz.2.5993 Tainted: G L syzkaller #0 PREEMPT(full) [ 349.188036][T22053] Tainted: [L]=SOFTLOCKUP [ 349.188056][T22053] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 349.188067][T22053] Call Trace: [ 349.188073][T22053] [ 349.188081][T22053] dump_stack_lvl+0x100/0x190 [ 349.188117][T22053] should_fail_ex.cold+0x5/0xa [ 349.188143][T22053] should_failslab+0xc2/0x120 [ 349.188164][T22053] __kmalloc_noprof+0xfc/0x840 [ 349.188183][T22053] ? tomoyo_encode2+0xfb/0x3c0 [ 349.188205][T22053] tomoyo_encode2+0xfb/0x3c0 [ 349.188225][T22053] tomoyo_encode+0x29/0x50 [ 349.188241][T22053] tomoyo_realpath_from_path+0x18c/0x690 [ 349.188265][T22053] tomoyo_mount_acl+0x1b6/0x8b0 [ 349.188280][T22053] ? is_bpf_text_address+0x8a/0x1a0 [ 349.188301][T22053] ? is_bpf_text_address+0x8a/0x1a0 [ 349.188323][T22053] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 349.188348][T22053] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 349.188371][T22053] ? kernel_text_address+0x8d/0x100 [ 349.188393][T22053] ? unwind_get_return_address+0x59/0xa0 [ 349.188411][T22053] ? arch_stack_walk+0xa6/0xf0 [ 349.188439][T22053] ? __lock_acquire+0x5c0/0x1f40 [ 349.188473][T22053] ? tomoyo_mount_permission+0x1f6/0x460 [ 349.188493][T22053] ? tomoyo_domain+0xb2/0x150 [ 349.188512][T22053] ? tomoyo_profile+0x47/0x60 [ 349.188534][T22053] tomoyo_mount_permission+0x214/0x460 [ 349.188550][T22053] ? tomoyo_mount_permission+0x1f6/0x460 [ 349.188568][T22053] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 349.188602][T22053] security_sb_mount+0xdd/0x270 [ 349.188645][T22053] path_mount+0x158/0x2850 [ 349.188678][T22053] ? __pfx_path_mount+0x10/0x10 [ 349.188702][T22053] ? lockdep_hardirqs_on+0x7d/0x110 [ 349.188724][T22053] ? putname+0xb1/0x110 [ 349.188747][T22053] ? kmem_cache_free+0x127/0x6c0 [ 349.188779][T22053] ? __x64_sys_mount+0x293/0x310 [ 349.188804][T22053] __x64_sys_mount+0x293/0x310 [ 349.188828][T22053] ? __pfx___x64_sys_mount+0x10/0x10 [ 349.188859][T22053] do_syscall_64+0x123/0x7b0 [ 349.188896][T22053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.188917][T22053] RIP: 0033:0x7fa171da8f19 [ 349.188933][T22053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.188950][T22053] RSP: 002b:00007fa172ca4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 349.188968][T22053] RAX: ffffffffffffffda RBX: 00007fa172025fa0 RCX: 00007fa171da8f19 [ 349.188980][T22053] RDX: 00002000000001c0 RSI: 0000200000000100 RDI: 0000000000000000 [ 349.188992][T22053] RBP: 00007fa171e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 349.189002][T22053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.189012][T22053] R13: 00007fa172026038 R14: 00007fa172025fa0 R15: 00007ffcf4739288 [ 349.189036][T22053] [ 349.190811][T22053] ERROR: Out of memory at tomoyo_realpath_from_path. [ 349.284260][ T43] audit: type=1400 audit(1794392656.054:1347): avc: denied { create } for pid=22055 comm="syz.8.5995" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=2321202E2F6367726F75702F66696C65306161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 [ 349.548645][T22064] FAULT_INJECTION: forcing a failure. [ 349.548645][T22064] name failslab, interval 1, probability 0, space 0, times 0 [ 349.548686][T22064] CPU: 3 UID: 0 PID: 22064 Comm: syz.8.5997 Tainted: G L syzkaller #0 PREEMPT(full) [ 349.548713][T22064] Tainted: [L]=SOFTLOCKUP [ 349.548717][T22064] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 349.548723][T22064] Call Trace: [ 349.548728][T22064] [ 349.548733][T22064] dump_stack_lvl+0x100/0x190 [ 349.548755][T22064] should_fail_ex.cold+0x5/0xa [ 349.548773][T22064] should_failslab+0xc2/0x120 [ 349.548787][T22064] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 349.548798][T22064] ? __alloc_skb+0x5b7/0x710 [ 349.548811][T22064] ? __alloc_skb+0x140/0x710 [ 349.548825][T22064] __alloc_skb+0x140/0x710 [ 349.548836][T22064] ? __alloc_skb+0x5b7/0x710 [ 349.548848][T22064] ? __pfx___alloc_skb+0x10/0x10 [ 349.548860][T22064] ? find_held_lock+0x2b/0x80 [ 349.548871][T22064] ? avc_has_perm_noaudit+0x11e/0x470 [ 349.548889][T22064] ? avc_has_perm_noaudit+0x11e/0x470 [ 349.548907][T22064] alloc_skb_with_frags+0xdb/0x750 [ 349.548925][T22064] ? avc_has_perm+0x135/0x1e0 [ 349.548940][T22064] sock_alloc_send_pskb+0x86a/0x9e0 [ 349.548958][T22064] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 349.548971][T22064] ? sock_has_perm+0x254/0x320 [ 349.548988][T22064] ? __pfx_sock_has_perm+0x10/0x10 [ 349.549003][T22064] ? __pfx_avc_has_perm+0x10/0x10 [ 349.549021][T22064] hci_sock_sendmsg+0x1c7/0x26f0 [ 349.549063][T22064] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 349.549079][T22064] ? selinux_socket_sendmsg+0x198/0x2f0 [ 349.549098][T22064] sock_write_iter+0x560/0x5d0 [ 349.549115][T22064] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 349.549130][T22064] ? __pfx_sock_write_iter+0x10/0x10 [ 349.549151][T22064] ? bpf_lsm_file_permission+0x9/0x10 [ 349.549168][T22064] ? security_file_permission+0x76/0x210 [ 349.549179][T22064] ? rw_verify_area+0xce/0x6d0 [ 349.549197][T22064] vfs_write+0x6af/0x1040 [ 349.549208][T22064] ? __pfx_sock_write_iter+0x10/0x10 [ 349.549225][T22064] ? __pfx_vfs_write+0x10/0x10 [ 349.549235][T22064] ? find_held_lock+0x2b/0x80 [ 349.549255][T22064] ksys_write+0x1f8/0x250 [ 349.549266][T22064] ? __pfx_ksys_write+0x10/0x10 [ 349.549282][T22064] do_syscall_64+0x123/0x7b0 [ 349.549296][T22064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.549307][T22064] RIP: 0033:0x7f970a5a8f19 [ 349.549316][T22064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.549326][T22064] RSP: 002b:00007f970b3f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 349.549337][T22064] RAX: ffffffffffffffda RBX: 00007f970a825fa0 RCX: 00007f970a5a8f19 [ 349.549344][T22064] RDX: 0000000000000006 RSI: 0000200000000c00 RDI: 0000000000000004 [ 349.549350][T22064] RBP: 00007f970a637f6d R08: 0000000000000000 R09: 0000000000000000 [ 349.549356][T22064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.549362][T22064] R13: 00007f970a826038 R14: 00007f970a825fa0 R15: 00007ffce646cb98 [ 349.549377][T22064] [ 349.745605][ T43] audit: type=1400 audit(1794392656.524:1348): avc: denied { write } for pid=22071 comm="syz.2.6001" lport=54684 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 350.156033][T22084] FAULT_INJECTION: forcing a failure. [ 350.156033][T22084] name failslab, interval 1, probability 0, space 0, times 0 [ 350.156063][T22084] CPU: 0 UID: 0 PID: 22084 Comm: syz.2.6006 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.156089][T22084] Tainted: [L]=SOFTLOCKUP [ 350.156111][T22084] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.156124][T22084] Call Trace: [ 350.156130][T22084] [ 350.156139][T22084] dump_stack_lvl+0x100/0x190 [ 350.156173][T22084] should_fail_ex.cold+0x5/0xa [ 350.156202][T22084] should_failslab+0xc2/0x120 [ 350.156224][T22084] __kvmalloc_node_noprof+0x113/0x9b0 [ 350.156244][T22084] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 350.156261][T22084] ? __kmalloc_cache_noprof+0x201/0x6d0 [ 350.156287][T22084] ? io_alloc_cache_init+0x38/0x170 [ 350.156322][T22084] io_alloc_cache_init+0x38/0x170 [ 350.156353][T22084] io_rsrc_cache_init+0x26/0x50 [ 350.156381][T22084] io_uring_setup.cold+0x4c0/0x1c7e [ 350.156406][T22084] ? lock_acquire+0x1d1/0x380 [ 350.156432][T22084] ? avc_has_perm_noaudit+0x56/0x470 [ 350.156455][T22084] ? __pfx_io_uring_setup+0x10/0x10 [ 350.156477][T22084] ? find_held_lock+0x2b/0x80 [ 350.156497][T22084] ? avc_has_perm_noaudit+0x11e/0x470 [ 350.156519][T22084] ? avc_has_perm_noaudit+0x11e/0x470 [ 350.156560][T22084] ? xfd_validate_state+0x129/0x190 [ 350.156592][T22084] __x64_sys_io_uring_setup+0xc2/0x170 [ 350.156618][T22084] do_syscall_64+0x123/0x7b0 [ 350.156664][T22084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.156686][T22084] RIP: 0033:0x7fa171da8f19 [ 350.156702][T22084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.156722][T22084] RSP: 002b:00007fa172ca3fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 350.156742][T22084] RAX: ffffffffffffffda RBX: 0000200000000280 RCX: 00007fa171da8f19 [ 350.156757][T22084] RDX: 0000200000000340 RSI: 0000200000000280 RDI: 0000000000000d3a [ 350.156770][T22084] RBP: 00007fa171e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 350.156782][T22084] R10: 0000200000000380 R11: 0000000000000206 R12: 0000200000000340 [ 350.156795][T22084] R13: 0000200000000380 R14: 0000200000000300 R15: 00007ffcf4739288 [ 350.156823][T22084] [ 350.340064][T22086] FAULT_INJECTION: forcing a failure. [ 350.340064][T22086] name failslab, interval 1, probability 0, space 0, times 0 [ 350.340095][T22086] CPU: 0 UID: 0 PID: 22086 Comm: syz.2.6007 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.340123][T22086] Tainted: [L]=SOFTLOCKUP [ 350.340131][T22086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.340144][T22086] Call Trace: [ 350.340152][T22086] [ 350.340175][T22086] dump_stack_lvl+0x100/0x190 [ 350.340214][T22086] should_fail_ex.cold+0x5/0xa [ 350.340247][T22086] should_failslab+0xc2/0x120 [ 350.340270][T22086] __kmalloc_noprof+0xfc/0x840 [ 350.340288][T22086] ? lockdep_init_map_type+0x5c/0x250 [ 350.340318][T22086] ? nvme_tcp_create_ctrl+0x87b/0x1430 [ 350.340375][T22086] nvme_tcp_create_ctrl+0x87b/0x1430 [ 350.340406][T22086] nvmf_dev_write+0x4ee/0xb60 [ 350.340432][T22086] vfs_write+0x2aa/0x1040 [ 350.340456][T22086] ? __pfx_nvmf_dev_write+0x10/0x10 [ 350.340472][T22086] ? lock_acquire+0x1d1/0x380 [ 350.340497][T22086] ? __fget_files+0x34/0x3d0 [ 350.340522][T22086] ? __pfx_vfs_write+0x10/0x10 [ 350.340540][T22086] ? find_held_lock+0x2b/0x80 [ 350.340557][T22086] ? __fget_files+0x215/0x3d0 [ 350.340576][T22086] ? __fget_files+0x215/0x3d0 [ 350.340605][T22086] ? __fget_files+0x21f/0x3d0 [ 350.340637][T22086] ksys_write+0x12a/0x250 [ 350.340658][T22086] ? __pfx_ksys_write+0x10/0x10 [ 350.340687][T22086] do_syscall_64+0x123/0x7b0 [ 350.340714][T22086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.340733][T22086] RIP: 0033:0x7fa171da8f19 [ 350.340751][T22086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.340769][T22086] RSP: 002b:00007fa172ca4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 350.340788][T22086] RAX: ffffffffffffffda RBX: 00007fa172025fa0 RCX: 00007fa171da8f19 [ 350.340800][T22086] RDX: 0000000000000031 RSI: 0000200000000180 RDI: 0000000000000004 [ 350.340812][T22086] RBP: 00007fa171e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 350.340823][T22086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 350.340834][T22086] R13: 00007fa172026038 R14: 00007fa172025fa0 R15: 00007ffcf4739288 [ 350.340861][T22086] [ 350.479390][T22095] syzkaller0: entered promiscuous mode [ 350.479400][T22095] syzkaller0: entered allmulticast mode [ 350.480440][T22095] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 351.400270][ C2] ------------[ cut here ]------------ [ 351.400302][ C2] !rcu_read_lock_held() [ 351.400308][ C2] WARNING: ./include/net/dst.h:326 at xfrm_output_resume+0x54c6/0x7200, CPU#2: ksoftirqd/2/24 [ 351.412717][ C2] Modules linked in: [ 351.414300][ C2] CPU: 2 UID: 0 PID: 24 Comm: ksoftirqd/2 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.417876][ C2] Tainted: [L]=SOFTLOCKUP [ 351.419292][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.422505][ C2] RIP: 0010:xfrm_output_resume+0x54c6/0x7200 [ 351.424470][ C2] Code: fe ff ff e8 8c 10 b3 fa 31 ff 41 89 c4 89 c6 e8 b0 47 86 f7 45 84 e4 0f 85 1b f0 ff ff 31 db e9 20 f0 ff ff e8 8b 4d 86 f7 90 <0f> 0b 90 e9 cd ef ff ff c6 85 c0 fe ff ff 00 31 db 49 8d 46 4d e9 [ 351.430664][ C2] RSP: 0018:ffffc9000062f868 EFLAGS: 00010246 [ 351.432620][ C2] RAX: 0000000000000000 RBX: ffff888040869c80 RCX: 0000000000000100 [ 351.435164][ C2] RDX: ffff888020ea2580 RSI: ffffffff8a883375 RDI: 0000000000000005 [ 351.437949][ C2] RBP: ffffc9000062f9e0 R08: 0000000000000000 R09: 0000000000000000 [ 351.441094][ C2] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 [ 351.444565][ C2] R13: ffff88802d1eea40 R14: ffff88803f24c5f0 R15: dffffc0000000000 [ 351.448075][ C2] FS: 0000000000000000(0000) GS:ffff8880d4673000(0000) knlGS:0000000000000000 [ 351.450933][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 351.453111][ C2] CR2: 0000000000000000 CR3: 000000004292f000 CR4: 0000000000352ef0 [ 351.455993][ C2] Call Trace: [ 351.457459][ C2] [ 351.458630][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.460469][ C2] ? __pfx_xfrm_output_resume+0x10/0x10 [ 351.462564][ C2] ? __asan_memset+0x23/0x50 [ 351.464377][ C2] ? __skb_ext_alloc+0x6c/0x80 [ 351.466339][ C2] ? skb_ext_add+0x624/0x810 [ 351.468186][ C2] ? xfrm_state_mtu+0xd3/0x450 [ 351.470007][ C2] xfrm_output+0x33f/0x2040 [ 351.471888][ C2] iptfs_delay_timer+0x1ab7/0x3c20 [ 351.473890][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 351.475884][ C2] ? __pfx_iptfs_delay_timer+0x10/0x10 [ 351.477824][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 351.479897][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 351.481617][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 351.484716][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 351.486675][ C2] ? __hrtimer_run_queues+0x361/0x9a0 [ 351.488412][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.489985][ C2] ? __pfx_iptfs_delay_timer+0x10/0x10 [ 351.491799][ C2] __hrtimer_run_queues+0x448/0x9a0 [ 351.493497][ C2] hrtimer_run_softirq+0x1ca/0x360 [ 351.495191][ C2] handle_softirqs+0x216/0xa20 [ 351.496874][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 351.498640][ C2] ? run_ksoftirqd+0x56/0x60 [ 351.500146][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.501683][ C2] run_ksoftirqd+0x38/0x60 [ 351.503157][ C2] smpboot_thread_fn+0x41f/0xb90 [ 351.504744][ C2] ? kthread+0x13a/0x450 [ 351.506126][ C2] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 351.507963][ C2] kthread+0x373/0x450 [ 351.509275][ C2] ? __pfx_kthread+0x10/0x10 [ 351.510850][ C2] ret_from_fork+0x730/0xd60 [ 351.512333][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 351.513981][ C2] ? __switch_to+0x800/0x10e0 [ 351.515520][ C2] ? __pfx_kthread+0x10/0x10 [ 351.517115][ C2] ret_from_fork_asm+0x1a/0x30 [ 351.518727][ C2] [ 351.519753][ C2] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 351.522029][ C2] CPU: 2 UID: 0 PID: 24 Comm: ksoftirqd/2 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.525320][ C2] Tainted: [L]=SOFTLOCKUP [ 351.526713][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.529891][ C2] Call Trace: [ 351.530981][ C2] [ 351.531931][ C2] dump_stack_lvl+0x100/0x190 [ 351.533425][ C2] vpanic+0x2dc/0x6f8 [ 351.534806][ C2] panic+0xd1/0xe0 [ 351.536112][ C2] ? __pfx_panic+0x10/0x10 [ 351.537614][ C2] check_panic_on_warn.cold+0x19/0x34 [ 351.539535][ C2] ? xfrm_output_resume+0x54c6/0x7200 [ 351.541265][ C2] __warn.cold+0x191/0x321 [ 351.542929][ C2] __report_bug+0x30f/0x440 [ 351.544442][ C2] ? xfrm_output_resume+0x54c6/0x7200 [ 351.546260][ C2] ? __pfx___report_bug+0x10/0x10 [ 351.548171][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 351.550255][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 351.551913][ C2] ? lock_acquire+0x1d1/0x380 [ 351.553474][ C2] ? xfrm_output_resume+0x54c6/0x7200 [ 351.555230][ C2] report_bug+0xb3/0x220 [ 351.557152][ C2] ? xfrm_output_resume+0x54c6/0x7200 [ 351.559839][ C2] handle_bug+0x16a/0x2a0 [ 351.561275][ C2] exc_invalid_op+0x17/0x50 [ 351.562770][ C2] asm_exc_invalid_op+0x1a/0x20 [ 351.564336][ C2] RIP: 0010:xfrm_output_resume+0x54c6/0x7200 [ 351.566304][ C2] Code: fe ff ff e8 8c 10 b3 fa 31 ff 41 89 c4 89 c6 e8 b0 47 86 f7 45 84 e4 0f 85 1b f0 ff ff 31 db e9 20 f0 ff ff e8 8b 4d 86 f7 90 <0f> 0b 90 e9 cd ef ff ff c6 85 c0 fe ff ff 00 31 db 49 8d 46 4d e9 [ 351.572620][ C2] RSP: 0018:ffffc9000062f868 EFLAGS: 00010246 [ 351.574631][ C2] RAX: 0000000000000000 RBX: ffff888040869c80 RCX: 0000000000000100 [ 351.577187][ C2] RDX: ffff888020ea2580 RSI: ffffffff8a883375 RDI: 0000000000000005 [ 351.580029][ C2] RBP: ffffc9000062f9e0 R08: 0000000000000000 R09: 0000000000000000 [ 351.582546][ C2] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 [ 351.585040][ C2] R13: ffff88802d1eea40 R14: ffff88803f24c5f0 R15: dffffc0000000000 [ 351.587680][ C2] ? xfrm_output_resume+0x54c5/0x7200 [ 351.589649][ C2] ? xfrm_output_resume+0x54c5/0x7200 [ 351.591413][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.593242][ C2] ? __pfx_xfrm_output_resume+0x10/0x10 [ 351.595306][ C2] ? __asan_memset+0x23/0x50 [ 351.596899][ C2] ? __skb_ext_alloc+0x6c/0x80 [ 351.598532][ C2] ? skb_ext_add+0x624/0x810 [ 351.600073][ C2] ? xfrm_state_mtu+0xd3/0x450 [ 351.601643][ C2] xfrm_output+0x33f/0x2040 [ 351.603184][ C2] iptfs_delay_timer+0x1ab7/0x3c20 [ 351.604848][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 351.606503][ C2] ? __pfx_iptfs_delay_timer+0x10/0x10 [ 351.608557][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 351.610594][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 351.612272][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 351.614177][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 351.616061][ C2] ? __hrtimer_run_queues+0x361/0x9a0 [ 351.617868][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.619501][ C2] ? __pfx_iptfs_delay_timer+0x10/0x10 [ 351.621340][ C2] __hrtimer_run_queues+0x448/0x9a0 [ 351.623099][ C2] hrtimer_run_softirq+0x1ca/0x360 [ 351.624763][ C2] handle_softirqs+0x216/0xa20 [ 351.626392][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 351.628416][ C2] ? run_ksoftirqd+0x56/0x60 [ 351.630233][ C2] ? rcu_is_watching+0x13/0xc0 [ 351.631854][ C2] run_ksoftirqd+0x38/0x60 [ 351.633342][ C2] smpboot_thread_fn+0x41f/0xb90 [ 351.635012][ C2] ? kthread+0x13a/0x450 [ 351.636392][ C2] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 351.638351][ C2] kthread+0x373/0x450 [ 351.639709][ C2] ? __pfx_kthread+0x10/0x10 [ 351.641214][ C2] ret_from_fork+0x730/0xd60 [ 351.642771][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 351.644363][ C2] ? __switch_to+0x800/0x10e0 [ 351.645899][ C2] ? __pfx_kthread+0x10/0x10 [ 351.647502][ C2] ret_from_fork_asm+0x1a/0x30 [ 351.649571][ C2] [ 351.651603][ C2] Kernel Offset: disabled [ 351.653171][ C2] Rebooting in 86400 seconds..